Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ArabelaTso/Skills-4-SE --skill cve-watchlist-action-recommendation-generatorgit clone --depth 1 https://github.com/ArabelaTso/Skills-4-SEWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/arabelatso/skills-4-se/cve-watchlist-action-recommendation-generator)<a href="https://agentmods.dev/skills/arabelatso/skills-4-se/cve-watchlist-action-recommendation-generator"><img src="https://agentmods.dev/badge/skills/arabelatso/skills-4-se/cve-watchlist-action-recommendation-generator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/arabelatso/skills-4-se/cve-watchlist-action-recommendation-generator"><img src="https://agentmods.dev/badge/skills/arabelatso/skills-4-se/cve-watchlist-action-recommendation-generator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00138 | $0.01735 |
| Opus 5 | $0.00069 | $0.00868 |
| Sonnet 5 | $0.00028 | $0.00347 |
| Haiku 4.5 | $0.00014 | $0.00173 |
Grade A, and why
cve-watchlist-action-recommendation-generator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 245 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CVE Watchlist & Action Recommendation Generator
Generate prioritized CVE watchlists with actionable security recommendations for development and security teams.
Workflow
1. Gather Input Data
Collect required inputs:
Required:
- Repository name/path
- CVE scan results (JSON/SARIF format from npm audit, pip-audit, Snyk, etc.)
- Cutoff date (YYYY-MM-DD) for filtering new CVEs
Optional but recommended:
- Reachability analysis results (which vulnerable code paths are actually used)
- Exploit intelligence data (CISA KEV, ExploitDB)
- Dependency criticality ratings (how critical each dependency is)
Parse scan results:
python scripts/parse_scan_results.py scan_results.json auto 2024-01-01 > parsed_cves.json
2. Calculate Risk Scores
Combine multiple risk factors to prioritize CVEs:
python scripts/calculate_risk_score.py parsed_cves.json reachability.json exploits.json criticality.json > scored_cves.json
Risk scoring formula:
Risk Score = (Severity × 0.35) + (Reachability × 0.30) + (Exploitability × 0.20) + (Dependency Criticality × 0.15)
See risk_scoring.md for detailed methodology.
3. Generate Recommendations
For each CVE, determine appropriate action based on risk score and context:
Decision tree:
- Risk ≥ 80 (Critical) → Immediate upgrade (24-48h)
- Risk 60-79 (High) → Upgrade within days (3-5 days)
- Risk 40-59 (Medium) → Next maintenance cycle (2-4 weeks)
- Risk 20-39 (Low) → Monitor or defer
- Risk < 20 (Minimal) → Ignore with justification
See action_guidelines.md for complete decision tree and recommendation templates.
4. Generate Report
Create markdown-formatted report using template:
Report structure:
- Executive Summary (CVE counts by risk tier)
- Prioritized CVE Watchlist (grouped by risk tier)
- For each CVE:
- Risk score and breakdown
- Affected package and versions
- Reachability status
- Exploit availability
- Concrete action recommendation
- Upgrade commands
- Mitigation options (if applicable)
- Summary of Actions (immediate, short-term, medium-term)
- Dependency Overview
- Next Steps
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago First seen · 245 lines · 138 tokens per session scan A 3d634c6a461a
cve-watchlist-action-recommendation-generator is a skill published in the GitHub repository ArabelaTso/Skills-4-SE (252 stars, last pushed 22d ago), licensed Apache-2.0. It adds 138 tokens to every session and 1,735 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analysis-to-delivery
A routing guide for turning a new feature request into an analysis and development workflow.
exploratory-data-analysis
Perform bounded, local exploratory analysis of explicitly supported scientific files. Use for redacted CSV/TSV/JSON profiles; optional NumPy, HDF5, FASTA/FASTQ, and basic image metadata inspection; missingness/leakage audits; outlier and transformation sensitivity; and rigorous EDA report scaffolds. Other domain…
google-ads-audit
Google Ads account audit and business context setup. Use for account-health audits and business-context setup. Trigger on "audit my ads", "ads audit", "set up my ads", "onboard", "account overview", "how's my account", "ads health check", "what should I fix in my ads", or when the user is new to NotFair and hasn't run…
webhook-management
Configure and validate CCAM webhook targets across supported chat, incident, automation, and generic providers. Use when listing provider requirements, creating or updating a target, scoping it to alert rules, sending a test notification, reviewing delivery history, or deleting a target.
gesellschaftsrechtliche-satzungen-agb
Für Gesellschaftsrechtliche Satzungen AGB Abgrenzung: ordnet Norm, Beweislast und Gegenargument; Ergebnis: Prüfprodukt mit Risiko und nächstem Schritt. Fachgebiet: AGB-Recht-Prüfer. Route: gesellschaftsrechtliche-satzungen-agb.
master-yinguang
A reference-based assistant for questions about Yinguang and Pure Land Buddhism, a Buddhist tradition focused on faith, ethical living, and practice connected with rebirth in the Pure Land. It can answer in Yinguang’s historical teaching style.