Open Cve Scanner Repo

오픈소스 취약점 분석 스킬. 사용자가 오픈소스 패키지 이름과 사용 중인 버전을 입력하면, NVD(NIST), OSV.dev(Google), GitHub Advisory 3개 데이터 소스에서 CVE 취약점을 조회하여 최신 버전 정보와 함께 보안 리포트를 생성한다. 마크다운, Exce...

This skill appears to be a legitimate CVE scanner: it contains Python clients for NVD, OSV, and GitHub and instructions to install dependencies and run scans. Things to consider before installing: - Source provenance: the registry metadata lists no homepage/source; if you don't trust the origin, review the bundled code yourself (requests to external APIs are visible and expected). - Installation: it instructs pip install -r requirements.txt — run inside a virtualenv or sandbox to avoid affecting your system Python. - API keys: NVD_API_KEY and GITHUB_TOKEN are optional and only increase rate limits; avoid supplying any unrelated secrets. - Network behavior: the tool makes outbound requests to NVD, OSV, registry APIs, and GitHub — this is required for functionality. If you must protect sensitive dependency lists, be aware those names/versions are sent to external services. - License: project uses AGPL-3.0 (per README) which has stronger copyleft obligations; consider legal implications for your use. If you want higher assurance, review scripts/cve-scanner.py and the cve_sources clients (they are included) or run the tool in an isolated environment before adding it to production workflows.

Type: OpenClaw Skill Name: open-cve-scanner-repo Version: 1.0.1 The bundle is a comprehensive CVE scanner designed to analyze open-source packages and independent software (like Docker or Nginx) for vulnerabilities. It fetches data from legitimate public sources including NVD (NIST), OSV.dev (Google), and GitHub Advisory. The code is well-structured, modular, and lacks any signs of obfuscation, data exfiltration, or malicious intent. While some test scripts (e.g., test_independent_software.sh) contain hardcoded local file paths, these appear to be unintentional development artifacts rather than malicious indicators.