Open Cve Scanner

오픈소스 취약점 분석 스킬. 사용자가 오픈소스 패키지 이름과 사용 중인 버전을 입력하면, NVD(NIST), OSV.dev(Google), GitHub Advisory 3개 데이터 소스에서 CVE 취약점을 조회하여 최신 버전 정보와 함께 보안 리포트를 생성한다. 마크다운, Exce...

This skill appears to do what it claims: aggregate CVE data from NVD, OSV, and GitHub and produce reports. Before installing or running it: 1) be prepared for the tool to make outbound network requests to NVD/OSV/GitHub (and possibly other public APIs); 2) supply API keys only if you trust the code and need higher rate limits (the keys increase rate limits but grant access only to those APIs); 3) review utils/llm_ecosystem_detector.py (if present) to see whether any LLM calls go to third-party endpoints you don't expect; and 4) run scripts in a sandbox or review them if you will scan sensitive dependency files, since pipelines write temporary output to /tmp and may perform bulk queries. Overall the skill is coherent with its stated purpose.

Type: OpenClaw Skill Name: open-cve-scanner Version: 1.0.1 The open-cve-scanner skill is a comprehensive vulnerability analysis tool that integrates data from NVD, OSV.dev, and GitHub Advisory. The codebase is well-structured and implements legitimate security scanning logic, including dependency file parsing (scripts/parsers/), multi-source CVE fetching (scripts/cve_sources/), and a sophisticated accuracy verification pipeline (scripts/run_accuracy_pipeline.py). While it interacts with external APIs and registries (e.g., api.osv.dev, services.nvd.nist.gov) and includes an LLM-based ecosystem detector (scripts/utils/llm_ecosystem_detector.py), all network and file operations are strictly aligned with its stated purpose of identifying software vulnerabilities. No evidence of malicious intent, data exfiltration, or unauthorized execution was found.