open-cve-scanner오픈소스 취약점 분석 스킬. 사용자가 오픈소스 패키지 이름과 사용 중인 버전을 입력하면, NVD(NIST), OSV.dev(Google), GitHub Advisory 3개 데이터 소스에서 CVE 취약점을 조회하여 최신 버전 정보와 함께 보안 리포트를 생성한다. 마크다운, Exce...
Install via ClawdBot CLI:
clawdbot install rebugui/open-cve-scannerGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Potentially destructive shell commands in tool definitions
eval(Calls external URL not in known-safe list
https://nvd.nist.gov/developers/request-an-api-keyUses known external API (expected, informational)
api.github.comAI Analysis
The skill's external API calls (NVD, OSV.dev, GitHub Advisory) are consistent with its stated purpose of vulnerability scanning and are publicly documented. No hidden instructions, credential harvesting, or obfuscation are present. The primary risk is the potential for the skill to send package names and versions to these external services, which is inherent to its functionality.
Generated Mar 20, 2026
Development teams can use this skill to scan dependencies in package.json or requirements.txt files before deployment, identifying critical vulnerabilities like Log4Shell in libraries. It helps ensure compliance with security standards and prevents exploits in production environments.
Banks and fintech companies can integrate this skill into their CI/CD pipelines to audit open-source components for vulnerabilities, meeting regulatory requirements like PCI DSS. It provides reports in Excel or JSON for documentation and risk assessment.
DevOps engineers can automate vulnerability scanning in build processes using this skill, filtering by severity (e.g., CRITICAL, HIGH) to prioritize fixes. It supports multiple ecosystems like npm and PyPI, reducing manual security checks.
Researchers can utilize the accuracy verification pipeline with 1000 test cases to study CVE trends and validate scanner performance across different data sources like NVD and GitHub Advisory, aiding in academic papers or security tool development.
Companies can scan dependencies from external vendors' software packages to assess security risks before integration, using file uploads for batch analysis. This helps in supply chain security management and due diligence processes.
Offer this skill as a cloud-based service with API access, charging monthly fees based on scan volume or number of users. Revenue comes from enterprises needing continuous vulnerability monitoring and compliance reporting.
Sell on-premise licenses to large organizations for integration into private networks, with custom support and training. Revenue is generated through one-time purchases or annual maintenance contracts tailored to security teams.
Provide a free tier for basic scans with limited data sources, while premium tiers unlock advanced features like high-severity filters, Excel exports, and priority API access. Revenue streams from upgrades and add-ons.
💬 Integration Tip
Integrate this skill into CI/CD tools like Jenkins or GitHub Actions using command-line options for automated scans, and set environment variables for API keys to improve rate limits and performance.
Scored Apr 19, 2026
Audited Apr 17, 2026 · audit v1.0
Perform network reconnaissance and port scanning with Nmap to find open ports, detect services, identify vulnerabilities, and enumerate targets accurately.
Scan networks to discover devices, gather MAC addresses, vendors, and hostnames. Includes safety checks to prevent accidental scanning of public networks.
Security engineering toolkit for threat modeling, vulnerability analysis, secure architecture, and penetration testing. Includes STRIDE analysis, OWASP guida...
Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews.
Test APIs against OWASP API Security Top 10 including discovery, auth abuse, and protocol-specific checks.
Test your AI agent for security vulnerabilities using PwnClaw. Runs 50+ attacks (prompt injection, jailbreaks, social engineering, MCP poisoning, and more) and provides fix instructions. Use when your agent needs a security check or hardening.