Apache Magpie is a framework of agent-assisted workflows for maintaining Apache software projects, including issue triage, pull-request review, contributor mentoring, and security-report handling. Apache maintainers and developers use it to delegate repetitive project work to coding agents while retaining human review. Its catalogue entries are the skills, instructions, plugin, and settings that implement these workflows.
Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/apache/magpienpx agentmods add skills/apache/magpie/generate-cve-jsonWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/apache/magpie/generate-cve-json)<a href="https://agentmods.dev/skills/apache/magpie/generate-cve-json"><img src="https://agentmods.dev/badge/skills/apache/magpie/generate-cve-json.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00131 | $0.06941 |
| Opus 5 | $0.00066 | $0.03470 |
| Sonnet 5 | $0.00026 | $0.01388 |
| Haiku 4.5 | $0.00013 | $0.00694 |
Grade A, and why
generate-cve-json scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 567 lines — stays where its author put it; the contents beside it link to each section on GitHub.
generate-cve-json
This skill produces a CVE 5.x JSON document from a tracking issue in
<tracker>, ready to
paste into the Vulnogram "#source" tab of the ASF CVE tool. The goal is
to eliminate the manual "copy each field from the issue into the right
Vulnogram form input" step when you are preparing to publish an advisory.
Project-agnostic by design. All project-specific values (vendor, top-level product / package name, project display map, CNA org id, generator tag, …) are loaded from a TOML config the adopting project ships at
<project-config>/tools/cve-tool-vulnogram/cve-json-config.toml. Concreteapache-foo-project-*strings appearing in this document are illustrative examples of how a project with a project-style package layout would configure things; replace them mentally with the adopter's own package taxonomy. The schema is documented in the package README.
Golden rule: the script generates a proposal JSON document. It parses a handful of structured fields from the issue body, but it cannot read the security team member's mind. Always review the generated JSON before pasting, and always do the final review inside Vulnogram before moving the CVE from DRAFT → REVIEW → READY → PUBLIC.
Release-vote gating (opt-in, recommended for ASF projects). The
emitted CNA_private.state follows a tri-state state machine:
DRAFT— the CNA is incomplete or the project has opted into release-vote gating and no vote is in progress yet.REVIEW— the CNA is review-ready (CVE ID + title + description + affected versions + CWE + severity + ≥ 1 credit + ≥ 1 reference) and either the project hasn't opted into gating (legacy: ready ⇒ REVIEW) or an RC vote is in progress (signalled by the configured tracker label or a--reviewCLI flag).PUBLIC— the CNA is review-ready and the public advisory has shipped (avendor-advisoryreference is present).
Projects opt into gating by setting [workflow].release_vote_gating = true in their cve-json-config.toml and choosing the label name
via [workflow].rc_voting_label (default "rc voting"). The sync
skill is responsible for detecting [VOTE] threads on the project's
dev list (e.g. dev@<project>.apache.org) and proposing the label
add/remove; the generator only reads the label on the tracker. Non-
ASF adopters who publish advisories without a separate release-vote
step typically leave gating off — the legacy "ready ⇒ REVIEW"
behaviour is the right default for that workflow.
Determinism: the same input issue body produces exactly the same JSON bytes on every run. The script uses only the Python standard library, has no timestamps or machine-dependent values in its output, sorts JSON keys, and sorts references alphabetically. This lets you paste the result into Vulnogram, tweak fields in the tool, re-run the script later, and cleanly diff the two to see what the tool has added / what you changed by hand.
What ships with it
13 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- .gitignore 81 B
- pyproject.toml 3.1 KB
- README.md 3.3 KB
- src/generate_cve_json/__init__.py 2.7 KB runs code
- src/generate_cve_json/__main__.py 951 B runs code
- src/generate_cve_json/cve_json.py 90 KB runs code
- tests/__init__.py 0 B runs code
- tests/conftest.py 1.8 KB runs code
- tests/fixtures/cve-json-config-providers.toml 2.3 KB
- tests/fixtures/cve-json-config.toml 5.8 KB
- tests/test_cli.py 29 KB runs code
- tests/test_config_resolution.py 3.1 KB runs code
- tests/test_generate_cve_json.py 66 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 567 lines · 131 tokens per session scan A 43ab4113b80f
generate-cve-json is a skill published in the GitHub repository apache/magpie (87 stars, last pushed 5d ago), licensed Apache-2.0. It adds 131 tokens to every session and 6,941 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
security-compliance
Guides security professionals in implementing defense-in-depth security architectures, achieving compliance with industry frameworks (SOC2, ISO27001, GDPR, HIPAA), conducting threat modeling and risk assessments, managing security operations and incident response, and embedding security throughout the SDLC.
contract-clause-extractor
Extract and analyze key clauses from construction contracts. Identify payment terms, change order procedures, dispute resolution, warranties, and risk allocation provisions.
safety-inspection-checklist
Digital safety inspection checklists for construction sites. Generate, conduct, and track safety inspections with automated reporting and compliance monitoring.
lien-waiver-tracker
Track and manage construction lien waivers. Monitor conditional and unconditional waivers, ensure compliance before payments, and prevent lien exposure.
ai-policy-generator
AI governance policy creation for nonprofits and enterprises with frameworks, risk assessment, ethical guidelines, and compliance templates. Use when drafting AI usage policies, responsible AI frameworks, or organizational AI governance documents.
compliance-engineering
SOC2, HIPAA, GDPR, PCI-DSS, FedRAMP compliance implementation in code. Audit logging, data encryption, access controls, privacy by design, and regulatory requirement mapping. Use when implementing compliance controls, preparing for audits, or building privacy-compliant systems.