Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/openshift-eng/ai-helpers/analyze-cvegit clone --depth 1 https://github.com/openshift-eng/ai-helpersWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/openshift-eng/ai-helpers/analyze-cve)<a href="https://agentmods.dev/commands/openshift-eng/ai-helpers/analyze-cve"><img src="https://agentmods.dev/badge/commands/openshift-eng/ai-helpers/analyze-cve.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00011 | $0.01639 |
| Opus 5 | $0.00005 | $0.00820 |
| Sonnet 5 | $0.00002 | $0.00328 |
| Haiku 4.5 | $0.00001 | $0.00164 |
Grade B, and why
analyze-cve scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
**Optional**: `graphviz` for visual call graph generation (`brew install graphviz` or `sudo apt-get install graphviz`) Copies of this mod
1 near-identical copy found in the catalogue:
- analyze-cve — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 180 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Name
compliance:analyze-cve
Synopsis
/compliance:analyze-cve <CVE-ID> [--algo=vta|rta|cha|static]
Description
The compliance:analyze-cve command performs comprehensive security vulnerability analysis for Go projects. Given a CVE identifier, it gathers vulnerability intelligence, analyzes the codebase for impact, generates a risk report, and optionally applies fixes.
Implementation
Phase 0: Setup and Tool Validation
-
Parse Arguments
- Extract
<CVE-ID>(required) from the first argument - Extract
--algovalue if provided (optional, default:vta) - Valid
--algovalues:vta,rta,cha,static
- Extract
-
Check Required Tools
go version 2>/dev/null || echo "MISSING: go" [ -f go.mod ] || echo "MISSING: go.mod" which govulncheck 2>/dev/null || echo "MISSING: govulncheck" which callgraph 2>/dev/null || echo "MISSING: callgraph" which digraph 2>/dev/null || echo "MISSING: digraph" -
If ANY Tool is Missing → Display installation instructions and exit with error:
go install golang.org/x/vuln/cmd/govulncheck@latest go install golang.org/x/tools/cmd/callgraph@latest go install golang.org/x/tools/cmd/digraph@latest -
If All Tools Present → Continue to Phase 1
Phase 1: CVE Intelligence Gathering
- Skill: cve-intelligence-gathering
- Input: CVE-ID from arguments
- Output: CVE profile (severity, affected packages, fixed versions, remediation guidance, Go relevance)
Decision Point:
- IF invalid CVE format → Exit with error
- IF CVE not found AND user declines to provide info → Exit with error
- IF CVE is not Go-related → Generate "Not Applicable" report → Exit
- IF CVE details found → Continue to Phase 2
Phase 2: Codebase Impact Analysis
- Skill: codebase-impact-analysis
- Sub-skill: call-graph-analysis
- Input: CVE profile from Phase 1,
--algopreference - Output: Risk level (HIGH/MEDIUM/LOW/NEEDS_REVIEW), evidence package, confidence assessment
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 180 lines · 11 tokens per session scan B 0da631d39b38
analyze-cve is a command published in the GitHub repository openshift-eng/ai-helpers (116 stars, last pushed yesterday), licensed Apache-2.0. It adds 11 tokens to every session and 1,639 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other commands, from other repositories
cli-patterns
Reference patterns for implementing CLI commands in internal/cli/.
profile
Profile Go code, identify bottlenecks, optimize, and verify improvements.
create-go-project
Create a new Go web project with Templ, HTMX, Tailwind, and sqlc.
check-go
Run Go code quality checks including formatting, linting, vetting, and tests.
golang-test-review
Use when reviewing Go test code (new or changed test.go files, test harnesses, fixtures, or test tooling) for a Go-test-expert pass — behavior-over-surface, determinism, parallel-safety, build-tag correctness, and harness reuse. Complements the general code-reviewer with test-specific rigor.
skill-go-gin-api
Padrões DARE para APIs REST em Go + Gin (ou stdlib net/http) + sqlc + PostgreSQL. Handlers, services, repositories, middleware, validador, JWT, rate limit, swag OpenAPI.