Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add notque/vexjoy-agent --skill cve-source-checkgit clone --depth 1 https://github.com/notque/vexjoy-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/notque/vexjoy-agent/cve-source-check)<a href="https://agentmods.dev/skills/notque/vexjoy-agent/cve-source-check"><img src="https://agentmods.dev/badge/skills/notque/vexjoy-agent/cve-source-check/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/notque/vexjoy-agent/cve-source-check"><img src="https://agentmods.dev/badge/skills/notque/vexjoy-agent/cve-source-check.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.01452 |
| Opus 5.5 | $0.00022 | $0.00581 |
| Sonnet 5.5 | $0.00011 | $0.00290 |
| Haiku 4.5 | $0.00005 | $0.00145 |
Grade A, and why
cve-source-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 25d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 135 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CVE Source Check
Audit CVE/vulnerability source coverage for a technology stack. Maps components to authoritative CVE feeds via a versioned registry, flags gaps, and produces audit-ready reports (JSON + Markdown).
In scope: component-to-feed mapping, coverage/gap reporting, optional URL reachability checks. Out of scope: running scanners (Trivy/Snyk), fetching CVE content, private vuln databases.
Quick Start
# Inline, offline
python3 scripts/check-cve-sources.py \
--inline "[email protected],[email protected],postgres@16,redis@7,[email protected]" \
--service my-service
# Inventory + monitored feeds + link verification
python3 scripts/check-cve-sources.py \
--inventory examples/inventory.example.json \
--current-sources examples/current-sources.example.txt \
--service my-service --check-urls
Inputs
| Flag | Purpose |
|---|---|
--inventory <file> |
JSON: [{name, version?, type?}, ...] or {components: [...]}. |
--inline "name@ver,..." |
Comma-separated list. Mutually exclusive with --inventory. |
--current-sources <file> |
One URL per line. # comments and blank lines skipped. |
--service <name> |
Name for report header and filenames. |
--check-urls |
HEAD-check every source URL (5s timeout, graceful degradation). |
--registry <path> |
Override default tech-source-registry.json. |
--out-dir <path> |
Output directory (default: cwd). |
JSON only. YAML not supported (no stdlib parser).
Outputs
Files: cve-source-report-{service}-{YYYYMMDD}.{md,json} in --out-dir.
| Exit | Meaning |
|---|---|
| 0 | Full coverage. |
| 1 | Gaps (unmapped components or unmonitored sources). |
| 2 | Unreachable source URL (only with --check-urls). |
| 3 | Input error (missing/malformed registry or inventory). |
Workflow
Phase 1: LOAD
- Locate
tech-source-registry.json(next to SKILL.md by default, or--registry). - Build inventory from
--inventory(JSON list or{components: [...]}) or--inline(comma-splitname@version). - If
--current-sourcesprovided, read URLs and normalize for case-insensitive comparison.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 26d ago Changed · -89 lines · -30 tokens per session 5cef8bb2f635
- 27d ago Changed · -43 lines 2ff4a8e9a2d2
- 1mo ago First seen · 178 lines · 54 tokens per session scan A a399c7bb51bd
cve-source-check is a skill published in the GitHub repository notque/vexjoy-agent (442 stars, last pushed today), licensed MIT. It adds 54 tokens to every session and 1,452 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
pcbway
PCBWay PCB fabrication and assembly — turnkey/consigned assembly, design rules, ordering workflow. Alternative to JLCPCB for manufacturing. Use with KiCad. Use this skill when the user mentions PCBWay, needs turnkey assembly (PCBWay sources parts by MPN), has parts not available on LCSC, needs assembled boards with…
influence-psychology
Apply the seven principles of ethical persuasion (reciprocity, commitment, social proof, authority, liking, scarcity, unity) to product design, copy, and sales. Use when the user mentions "social proof", "persuasive copy", "why users dont convert", "ethical persuasion", "reciprocity", "scarcity tactics", "commitment…
refactoring-ui
Audit and fix visual hierarchy, spacing, color, and depth in web UIs. Use when the user mentions "my UI looks off" (or amateur/unprofessional), "fix the design", "Tailwind styling", "color palette", "visual hierarchy", "design system", "spacing scale", or "component styling". Also trigger when building consistent…
develop-solution-brief
Creates a concise one-page solution overview that communicates the proposed approach, key decisions, and trade-offs. Use when pitching solutions to stakeholders, aligning teams on approach, or documenting solution intent before detailed specification.
remotion-interactivity
Best practices for writing Remotion animations that stay intuitive for agents and editable in Remotion Studio Visual Mode.
imagen
Generate images using Google Gemini's image generation capabilities. Use this skill when the user needs to create, generate, or produce images for any purpose including UI mockups, icons, illustrations, diagrams, concept art, placeholder images, or visual representations.