Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/deepbitstechnology/claude-plugins/kernel-cve-analysisnpx skills add DeepBitsTechnology/claude-plugins --skill kernel-cve-analysisgit clone --depth 1 https://github.com/DeepBitsTechnology/claude-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00136 | $0.00924 |
| Opus 5 | $0.00068 | $0.00462 |
| Sonnet 5 | $0.00027 | $0.00185 |
| Haiku 4.5 | $0.00014 | $0.00092 |
Grade A, and why
kernel-cve-analysis scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 50 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Android Kernel CVE Analysis
This skill queries the remote Dr. Binary MCP server's Android/AOSP kernel CVE database. It helps determine which kernel vulnerabilities affect a given version, build date, or branch — and which are actually exploitable (bug-inducing code present and fix absent).
When to Use This Skill
Use this skill when the user wants to:
- Look up details for a specific CVE (affected versions, fix, bug-inducing commit, branches)
- Enumerate CVEs affecting a specific AOSP kernel version
- Find CVEs affecting a kernel built at a specific date
- Find unpatched CVEs in a specific branch
- Identify exploitable CVEs for a branch at a point in time
- Browse the CVE database
Available Tools (remote MCP)
| Tool | Use it when… | Arguments |
|---|---|---|
get_cve_info |
The user names a specific CVE | cve_id (e.g. "CVE-2024-12345") |
query_cves_by_version |
"Which CVEs affect kernel <version>?" |
aosp_version, limit? (default 100) |
query_cves_by_date |
"Which CVEs affect a kernel built on <date>?" |
commit_date, limit? (default 100) |
query_cves_by_branch |
"Which CVEs are unpatched in <branch>?" |
branch, limit? (default 100) |
find_exploitable_cves |
"Which CVEs are exploitable in <branch> as of <date>?" |
commit_date, branch, limit? (default 50) |
list_all_cves |
"Show me the CVEs in the database" | limit? (default 100) |
Notes on each tool
get_cve_info— returns a formatted report with type, severity, subcomponent, fixed-in version, affected version ranges, fix commits, and bug-inducing commits.query_cves_by_version— all CVEs affecting a specific AOSP kernel version (e.g.5.10,5.15).query_cves_by_date— CVEs affecting a kernel built at a specific commit date.query_cves_by_branch— unpatched CVEs in a branch (fixes not yet present in that branch).find_exploitable_cves— the flagship query: vulnerabilities present in a branch at a specific time where both the bug-inducing code exists and the fix is absent. Requires bothcommit_dateandbranch.list_all_cves— enumerate the database with basic info.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 50 lines · 136 tokens per session scan A dea8296d1037
kernel-cve-analysis is a skill published in the GitHub repository DeepBitsTechnology/claude-plugins (47 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 136 tokens to every session and 924 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a…
analyzing-cobalt-strike-beacon-configuration
Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure, malleable profiles, and operator tradecraft.
analyzing-network-covert-channels-in-malware
Detect and analyze covert communication channels used by malware, including DNS tunneling, ICMP exfiltration, steganographic HTTP, and other protocol abuse used for C2 and data exfiltration. Use when investigating suspicious DNS/ICMP/HTTP traffic patterns, hunting for hidden C2 channels in network captures, or…
analyzing-ios-app-security-with-objection
Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.
analyzing-malware-persistence-with-autoruns
Use Sysinternals Autoruns to systematically enumerate and analyze malware persistence mechanisms across Windows registry run keys, scheduled tasks, services, drivers, and startup locations. Use when hunting for persistence during Windows incident response, triaging a compromised endpoint, or validating that malware…
analyzing-malicious-pdf-with-peepdf
Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Use when triaging a suspicious PDF attachment from a phishing email, analyzing a PDF-based exploit document, or building detection signatures for weaponized PDF…