← Back to Skills Marketplace
354
Downloads
0
Stars
2
Active Installs
2
Versions
Install in OpenClaw
/install open-cve-scanner
Description
오픈소스 취약점 분석 스킬. 사용자가 오픈소스 패키지 이름과 사용 중인 버전을 입력하면, NVD(NIST), OSV.dev(Google), GitHub Advisory 3개 데이터 소스에서 CVE 취약점을 조회하여 최신 버전 정보와 함께 보안 리포트를 생성한다. 마크다운, Exce...
Usage Guidance
This skill appears to do what it claims: aggregate CVE data from NVD, OSV, and GitHub and produce reports. Before installing or running it: 1) be prepared for the tool to make outbound network requests to NVD/OSV/GitHub (and possibly other public APIs); 2) supply API keys only if you trust the code and need higher rate limits (the keys increase rate limits but grant access only to those APIs); 3) review utils/llm_ecosystem_detector.py (if present) to see whether any LLM calls go to third-party endpoints you don't expect; and 4) run scripts in a sandbox or review them if you will scan sensitive dependency files, since pipelines write temporary output to /tmp and may perform bulk queries. Overall the skill is coherent with its stated purpose.
Capability Analysis
Type: OpenClaw Skill
Name: open-cve-scanner
Version: 1.0.1
The open-cve-scanner skill is a comprehensive vulnerability analysis tool that integrates data from NVD, OSV.dev, and GitHub Advisory. The codebase is well-structured and implements legitimate security scanning logic, including dependency file parsing (scripts/parsers/), multi-source CVE fetching (scripts/cve_sources/), and a sophisticated accuracy verification pipeline (scripts/run_accuracy_pipeline.py). While it interacts with external APIs and registries (e.g., api.osv.dev, services.nvd.nist.gov) and includes an LLM-based ecosystem detector (scripts/utils/llm_ecosystem_detector.py), all network and file operations are strictly aligned with its stated purpose of identifying software vulnerabilities. No evidence of malicious intent, data exfiltration, or unauthorized execution was found.
Capability Assessment
Purpose & Capability
The name/description (CVE scanner across NVD/OSV/GitHub) matches the included code and scripts (cve-scanner.py, cve_sources/*, utils/*). Optional API key usage (NVD, GitHub) appears only to increase rate limits, which is appropriate for the stated purpose. There are no requested env vars or binaries that are unrelated to vulnerability scanning.
Instruction Scope
SKILL.md directs the agent/user to run the included Python CLI and optional pipelines (pip install -r requirements.txt; scripts/*.py). The instructions reference only dependency files (package.json, requirements.txt) and temporary output paths (/tmp) which are consistent with bulk scan/ground-truth pipeline behavior. There are no instructions to read unrelated system credentials, global configs, or to exfiltrate data to unexpected endpoints.
Install Mechanism
There is no install spec (instruction-only skill), but the bundle includes many Python scripts and a requirements.txt. That means installing/running the skill will require pip installing packages and executing local Python code. This is expected for this tool, but users should be aware that code will execute locally and perform network calls.
Credentials
No required environment variables are declared. SKILL.md mentions optional NVD_API_KEY and GITHUB_TOKEN to improve API rate limits — these are proportional and typical for a CVE scanner. No unrelated tokens/credentials or config paths are requested.
Persistence & Privilege
The skill does not request 'always: true' or other elevated persistence. It does create and use local files (reports in /tmp and checkpoints) as part of accuracy pipelines, which is consistent with its stated functionality and not an unexplained privilege escalation.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install open-cve-scanner - After installation, invoke the skill by name or use
/open-cve-scanner - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.1
open-cve-scanner 1.0.1
- Added large-scale accuracy testing pipeline, including scripts for generating ~1000 test cases, batch scanning, ground truth building, and verification.
- Introduced new utility and matching modules to improve version detection, matching reliability, and ecosystem analysis.
- Documentation updates: Added details and instructions for running the new accuracy test pipeline and interpreting results.
- Expanded and modularized the codebase for testability, future improvements, and research on CVE detection precision.
- Removed obsolete top-level cve-scanner file as part of refactoring.
v1.0.0
Initial release
Metadata
Frequently Asked Questions
What is Open Cve Scanner?
오픈소스 취약점 분석 스킬. 사용자가 오픈소스 패키지 이름과 사용 중인 버전을 입력하면, NVD(NIST), OSV.dev(Google), GitHub Advisory 3개 데이터 소스에서 CVE 취약점을 조회하여 최신 버전 정보와 함께 보안 리포트를 생성한다. 마크다운, Exce... It is an AI Agent Skill for Claude Code / OpenClaw, with 354 downloads so far.
How do I install Open Cve Scanner?
Run "/install open-cve-scanner" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Open Cve Scanner free?
Yes, Open Cve Scanner is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does Open Cve Scanner support?
Open Cve Scanner is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Open Cve Scanner?
It is built and maintained by rebugui (@rebugui); the current version is v1.0.1.
More Skills