‹ 首页

cyberedge-correlate-cves

@symph0nia · 收录于 5 天前 · 上游提交 6 天前

Correlate exact, evidence-backed CPE identities already observed by CyberEdge with normalized NVD CVE records. Use when an AI operator must run CVE intelligence for an authorized Scope, interpret CVSS metadata and lifecycle state, or distinguish completed CPE coverage from missing identity or provider failure without guessing products or versions.

场景漏洞排查安全审计资产匹配

适合你，如果需要在授权范围内运行CVE情报并区分已覆盖与缺失的CPE

/ 下载安装
https://github.com/symph0nia/cyberedge/tree/main/skills/cyberedge-correlate-cves ↗
/ 通过 npx 安装 校验哈希
npx oh-my-skill add symph0nia/cyberedge/cyberedge-correlate-cves
/ 通过 bash 安装
curl -fsSL https://oh-my-skill.com/install.sh | bash -s -- symph0nia/cyberedge/cyberedge-correlate-cves
/ 已经装过?验证本机副本,不用重装
npx oh-my-skill verify symph0nia/cyberedge/cyberedge-correlate-cves
安装目标可用 --agent / --scope 或 --to 明确指定;省略时只会在唯一已存在的 agent 目录上自动选择,零命中或多命中会停止并提示。content_hash 缺失或不一致均拒装。
606GitHub stars
~432最小装载
~432含声明引用
~566文本包总量
索引托管

怎么用

商店整理自技能原文 · 版本 0af016f · 表述以原文为准
它做什么

Claude能根据你授权的网站资产中已识别的软件版本（CPE），自动关联标准化的CVE漏洞情报，并报告漏洞的严重性、状态、证据来源及生命周期。

什么时候触发

当你拥有一个授权范围且已有技术指纹（含精确CPE），需要分析CVE情报时，可以要求Claude运行此技能。

装好后可以这样说
Claude将启动CVE情报扫描并关联CPE。
Claude会查询NVD并返回结果。
Claude区分已完成覆盖和未知覆盖。
技能原文 SKILL.md作者撰写 · Apache-2.0 · 0af016f

CyberEdge Correlate CVEs

Use cyberedge-agent; this machine bridge is not a human CLI.

Preconditions
  • Require an existing authorized Scope with Website inventory produced by policy_service_baseline.
  • Require at least one TechnologyFingerprint containing both an exact cpe_name and its cpe_source provenance.
  • Require this exact Skill/version grant with scan.intelligence, task.read, finding.read, evidence.read, and report.read.
Workflow
  1. Start policy_cve_intelligence for the authorized Scope. Never submit a CPE or CVE query directly.
  2. Watch the Task until it becomes terminal.
  3. Correlate each detector=nvd-cve Finding with its nvd.cve.result Observation and normalized JSON Evidence.
  4. Report the exact CPE, CPE source, CVE ID, NVD status, CVSS score/vector/severity, Evidence ID, references, and Finding lifecycle state.
  5. Treat nvd.cve.coverage as completed negative coverage only for that exact CPE and Asset.
  6. Treat nvd.cve.error or nvd.cve.no_targets as unknown coverage. Do not claim the Scope is free of known vulnerabilities.

An NVD association means the observed exact product identity falls within NVD applicability data. It does not prove exploitability, reachability, or successful exploitation. State this distinction in reports.

Never infer or edit CPEs, query broad vendor/product wildcards, invoke NVD directly, fetch proof-of-concept code, or upgrade confidence beyond the retained Evidence.

{"request_id":"req-1","idempotency_key":"idem-1","agent_id":"codex-main","skill_name":"cyberedge-correlate-cves","skill_version":"0.1.0","action":"start_scan","scope_id":"scope-id","policy_id":"policy_cve_intelligence"}
按 Apache-2.0 许可原样转载,未经改动 · 在 GitHub 查看 →

评论

登录即可评论;带「已验证安装」的,是发布者名下有本店的安装或持有记录。
…