Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add transilienceai/communitytools --skill cve-poc-generatorgit clone --depth 1 https://github.com/transilienceai/communitytoolsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/transilienceai/communitytools/cve-poc-generator)<a href="https://agentmods.dev/skills/transilienceai/communitytools/cve-poc-generator"><img src="https://agentmods.dev/badge/skills/transilienceai/communitytools/cve-poc-generator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/transilienceai/communitytools/cve-poc-generator"><img src="https://agentmods.dev/badge/skills/transilienceai/communitytools/cve-poc-generator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.00739 |
| Opus 5 | $0.00023 | $0.00369 |
| Sonnet 5 | $0.00009 | $0.00148 |
| Haiku 4.5 | $0.00005 | $0.00074 |
Grade A, and why
cve-poc-generator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 57 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CVE PoC Generator
Research a CVE by ID, generate a standalone Python proof-of-concept script, and produce a detailed vulnerability report.
Workflow
- NVD Lookup - Query NVD API v2.0 for the CVE ID (
python3 tools/nvd-lookup.py <CVE>). Extract the CVSS score/vector using the v4.0-primary ladder (v4.0 → v3.1 → v3.0 → v2.0; the tool'sJSON_SUMMARYexposescvss_version+cvss_vector), plus CWE IDs, CPE matches, advisory URLs, and patch links. - Advisory Research - Deep-dive vendor advisories, GitHub security advisories, Exploit-DB, and published write-ups. Identify root cause, affected versions, and attack vector details.
- PoC Generation - Write a standalone Python script (
poc.py) that demonstrates the vulnerability safely. Follow the script standards inreference/poc-methodology.md. - Report Generation - Write a comprehensive markdown report (
report.md) with metadata, root cause analysis, risk assessment, and remediation guidance.
NVD Data to Collect
| Field | Source | Usage |
|---|---|---|
| CVE ID | NVD | Primary identifier |
| CVSS Score + Vector (v4.0 primary; v3.1/v3.0/v2.0 fallback) | NVD | Risk scoring |
| CWE ID(s) | NVD | Vulnerability classification |
| CPE Matches | NVD | Affected products and versions |
| Advisory URLs | NVD references | Research sources |
| Patch Links | NVD references / vendor | Remediation guidance |
| Description | NVD | Vulnerability summary |
| Published / Modified dates | NVD | Timeline |
Output
{OUTPUT_DIR}/
artifacts/cve-pocs/CVE-XXXX-XXXXX/
poc.py # Standalone Python PoC script
reports/cve-pocs/CVE-XXXX-XXXXX/
report.md # Detailed vulnerability report
Invocation
/cve-poc-generator CVE-2024-XXXXX
The skill accepts a single CVE ID as argument. Multiple CVEs should be processed with separate invocations.
Rules
- Least harm - PoC scripts MUST demonstrate vulnerability without causing damage. Use detection/verification checks, not destructive payloads.
- Standalone scripts - PoC must run independently with only standard Python libraries plus
requests. No framework dependencies. - Accurate scoring - Use the exact CVSS score and vector from NVD. Do not fabricate or estimate scores.
- Source attribution - Every claim in the report must cite its source (NVD, vendor advisory, CVE description).
- No emoji - Use text severity labels only (CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL).
- Verified data only - Do not hallucinate CVE details. If NVD data is unavailable, state it explicitly.
- Safe defaults - PoC scripts must default to read-only, non-destructive operations. Any potentially harmful action requires explicit
--confirmflag.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 57 lines · 45 tokens per session scan A 793ba897d5ee
cve-poc-generator is a skill published in the GitHub repository transilienceai/communitytools (520 stars, last pushed 1mo ago), licensed MIT. It adds 45 tokens to every session and 739 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ast-grep
Guide for writing ast-grep rules to perform structural code search and analysis. Use when users need to search codebases using Abstract Syntax Tree (AST) patterns, find specific code structures, or perform complex code queries that go beyond simple text search. This skill should be used when users ask to search for…
omh-rust
This is a Hermes-native rust workflow skill.
migrate-better-result-3
Migrate a TypeScript codebase from better-result 2.x to 3.0. Use when upgrading better-result across the TaggedError syntax, removed Result serialization helpers, recovery inference, matching, or retry APIs.
erlang-otp-behaviors
Use when oTP behaviors including genserver for stateful processes, genstatem for state machines, supervisors for fault tolerance, genevent for event handling, and building robust, production-ready Erlang applications with proven patterns.
tdd
Guided test-driven development workflow for .NET 10 using xUnit v3, WebApplicationFactory, Testcontainers, and Verify snapshots. Follows the strict red-green-refactor cycle. Use when: "TDD", "test-driven", "let's TDD this", "red green refactor", "write the test first", or when building a feature with clear acceptance…
compose-ui
Best practices for building UI with Jetpack Compose, focusing on state hoisting, detailed performance optimizations, and theming. Use this when writing or refactoring Composable functions.