What is arn-code-batch-cve-scan?

A workflow for finding, reviewing, grouping, and tracking security advisories affecting project dependencies. Dependency vulnerabilities are weaknesses in third-party packages your code relies on.

Discovering dependency security issues, grouping and triaging them, recording accepted exceptions, creating tracker tickets, and producing or applying a review proposal.

It brings findings from supported advisory and local scanning sources into a review process, including existing waivers and deferred decisions.

arn-code-batch-cve-scan — Skill by AppsVortex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/appsvortex/arness/arn-code-batch-cve-scan

Any agent

npx skills add AppsVortex/arness --skill arn-code-batch-cve-scan

Clone the repo

git clone --depth 1 https://github.com/AppsVortex/arness

Made for: Claude Code, Codex.

Per session 244 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,910 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00244	$0.02910
Opus 5	$0.00122	$0.01455
Sonnet 5	$0.00049	$0.00582
Haiku 4.5	$0.00024	$0.00291

Measured 2d ago against content hash de73eb43d22e, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

arn-code-batch-cve-scan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/arn-code/skills/arn-code-batch-cve-scan/SKILL.md · 208 lines

How it starts

The opening of the file, as written. The whole thing — 208 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Arness Batch CVE Scan

Discover, triage, and ticket security advisories across project dependencies. Dual-source CVE discovery (GitHub Dependabot + locally-detected scanners), per-CVE triage via the arn-code-cve-analyst agent, project-existing waiver capture, and pre-triage parent + per-group sub-issue ticketing. All scanner / waiver / tracker detection is evidence-based — this skill never enumerates tool names; everything delegates to <code-patterns-dir>/security-scanning.md (written by Phase 1's codebase-analyzer extension).

Three modes (--mode=<value>):

interactive (default): full ergonomics, inline ticketing, prompts for waivers, AskUserQuestion available.
proposal: ZERO user prompts, ZERO writes to GitHub / Jira / project waiver files; emits a CVE_SCAN_PROPOSAL.md + .json sidecar that finalize mode consumes. Safe to schedule via Claude Code Routines or claude -p headless.
finalize: reads a previously-emitted proposal, walks needs-review items via AskUserQuestion, applies deferred writes behind a single consent gate.

This skill is a sequencer — it MUST NOT duplicate sub-reference logic. All procedural detail lives in references/. The body below names the steps and points to the right reference.

Pipeline position:

                  arn-code-codebase-analyzer (security-scanning.md)
                                  │
                                  ▼
                  **arn-code-batch-cve-scan** (3 modes)
                                  │
                  dispatches per-CVE
                                  │
                                  ▼
                  arn-code-cve-analyst (per-CVE triage)
                                  │
                                  ▼
                  Ticketing (interactive / proposal-render / finalize-POST)
                                  │
                                  ▼
                  arn-code-batch-cve-fix (consumes tickets)

Step 0: Ensure Configuration

Read the full file on GitHub · 208 lines

Files

What ships with it

11 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 208 lines · 244 tokens per session scan A de73eb43d22e

Subscribe to this mod's changes

arn-code-batch-cve-scan is a skill published in the GitHub repository AppsVortex/arness (33 stars, last pushed 1mo ago), licensed MIT. It adds 244 tokens to every session and 2,910 once invoked, about $0.0012 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Code review Productivity Security ai-workflows claude-code claude-code-plugin developer-tools infrastructure-as-code mcp

arn-code-batch-cve-scan

Getting it into your agent

What it costs to keep this loaded

Grade A, and why

Nothing flagged

How it starts

Arness Batch CVE Scan

Step 0: Ensure Configuration

What ships with it

What this file has done since we first saw it

Other skills, from other repositories

agent-framework-azure-ai-py

agentmail

aria

luna

max

agent-self-scheduling