kev-start

kev-start is a skill for Claude Code, Codex from cruxible-ai/cruxible. It costs 35 tokens per session (1,382 once invoked), scanned A, original, Apache-2.0.

A workflow for adapting a KEV triage kit to local information about assets, owners, software, and services. KEV refers to known exploited vulnerabilities, security flaws that attackers are known to use.

In plain words
What is it for?
Use it to onboard local security data, check its quality, connect it to the KEV workflow, and decide which workflows, queries, and relationships to keep or change.
Why use it?
It connects the published security workflow to an organisation's own inventory and keeps configuration, governed proposals, and review steps organised.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Good fit Use it to onboard local security data, check its quality, connect it to the KEV workflow, and decide which workflows, queries, and relationships to keep or change.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/cruxible-ai/cruxible/kev-start
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add cruxible-ai/cruxible --skill kev-start
Clone the repo
git clone --depth 1 https://github.com/cruxible-ai/cruxible

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for kev-start

README.md
[![agentmods](https://agentmods.dev/badge/skills/cruxible-ai/cruxible/kev-start/github.svg)](https://agentmods.dev/skills/cruxible-ai/cruxible/kev-start)
Your own site
<a href="https://agentmods.dev/skills/cruxible-ai/cruxible/kev-start"><img src="https://agentmods.dev/badge/skills/cruxible-ai/cruxible/kev-start/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for kev-start

Your own site · 80×15
<a href="https://agentmods.dev/skills/cruxible-ai/cruxible/kev-start"><img src="https://agentmods.dev/badge/skills/cruxible-ai/cruxible/kev-start.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 35 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,382 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00035 $0.01382
Opus 5 $0.00017 $0.00691
Sonnet 5 $0.00007 $0.00276
Haiku 4.5 $0.00003 $0.00138

Measured 13d ago against content hash 73d0b97f5de6, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

kev-start scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

kits/kev-triage/skills/kev-start/SKILL.md · 155 lines

How it starts

The opening of the file, as written. The whole thing — 155 lines — stays where its author put it; the contents beside it link to each section on GitHub.

KEV Start

Use this skill when adapting the KEV triage kit to a user's local inventory. Keep this as the judgment layer only. Command syntax belongs in command help; kit structure belongs in generated config views and generated README blocks.

Authoritative Surfaces

  • For kit working mechanics and config-view handling, use kits/README.md "Working With A Kit".
  • For ontology, workflow, governed relationship, and query structure, use the generated README views or cruxible config views.
  • For query parameters and examples, inspect the specific query with cruxible query describe.
  • For command options, use command help. Do not preserve local command recipes in this skill.
  • For refusals, surface the daemon error and stop instead of restating the daemon's policy in prose.

Goal

Produce a working KEV local over the user's data:

  • the published KEV reference layer and local overlay are connected cleanly
  • local assets, owners, software inventory, and services participate in the governed loop
  • the final supported surface is intentionally kept, modified, removed, or extended for this onboarding pass
  • kept workflows build or propose successfully
  • kept named queries execute successfully, with representative non-empty results for surfaces backed by loaded data
  • expected empty results are called out instead of treated as success by silence

Data Sanity Bars

Before building or proposing, verify the local input surfaces are usable KEV data, not merely files on disk:

  • asset, owner, and service IDs are stable and unique
  • service mappings reference known assets and known services
  • software inventory rows reference known assets
  • every software row has product name, version, and vendor, because those are the minimum useful fingerprint for reference product matching
  • optional inputs become required only when the user keeps workflows or queries that depend on them

If a base surface is missing or too messy to normalize cleanly, stop. Do not invent graph state manually to make onboarding appear complete.

Read the full file on GitHub · 155 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 13d ago First seen · 155 lines · 35 tokens per session scan A 73d0b97f5de6

Subscribe to this mod's changes

kev-start is a skill published in the GitHub repository cruxible-ai/cruxible (17 stars, last pushed yesterday), licensed Apache-2.0. It adds 35 tokens to every session and 1,382 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

rijksmuseum-mcp-plus

Research workflows for the Rijksmuseum MCP+ server, addressing Dutch arts, crafts, and history across the museum's holdings. Capabilities include keyword, structured, and semantic text search, AI-driven image analysis, geospatial queries, collection statistics, Iconclass-driven iconographic discovery, AAM/CMOA-aligned…

kintopp/rijksmuseum-mcp-plus · 136 tokens

en-quire

Instructions for using en-quire MCP tools to read, search, edit, and manage markdown and YAML documents. Use this skill whenever working with .md, .mdx, .yaml, or .yml files — SOPs, skill files, session memory, codex articles, specs, and configuration files. Covers section-addressed editing, structural search, YAML…

nullproof-studio/en-quire · 115 tokens

code-graph

Query the Code Graph knowledge graph for this codebase. Use when the user asks about code structure, call relationships, dependencies, blast radius, or wants to run SPARQL queries against the project graph. Requires the backend and MCP server to be running.

valarpirai/code-graph · 55 tokens

Agent Audit Trail

Append-only, hash-chained audit log for AI agents. Records agent actions, tool calls, decisions, and external writes with provenance, timestamps, and sha256 chain integrity. Designed for compliance with EU AI Act Article 12 automatic event recording requirements for high-risk AI systems.

lxyeternal/MalSkillBench · 59 tokens

governance-hotl

OpenMesha governance — fail-closed policy, HOTL for irreversible actions, audit log inspection. Use when reviewing denials, escalations, or audit trails.

ANAMIZED/OpenMesha · 39 tokens

governance-audit

Inspect Server OS policy decisions, capability grants, and the audit log.

ANAMIZED/Server-OS · 20 tokens