cve-lookup

What this skill does

Queries CVE details via the NIST NVD (National Vulnerability Database) API v2. Parses CVSS v3/v2 scores and vectors, vulnerability descriptions, reference links, and affected product (CPE) lists, then outputs the results in a human-readable report format.

When to use

• When you need to quickly understand the severity and attack vector of a specific CVE
• When validating and prioritizing vulnerabilities found in scan results
• When checking affected product versions to plan a patching strategy
• When you need official CVE information for writing a vulnerability report

Prerequisites

• curl installed
• jq installed:

  sudo apt-get install -y curl jq
  

• Internet access (NVD API requires no authentication, but rate limits apply)
• API key optional (works without a key; key relaxes rate limits):
  • Request one at: https://nvd.nist.gov/developers/request-an-api-key

Inputs

Variable	Required	Description
SECSKILL_CVE_ID	Required	CVE ID to look up (e.g. CVE-2024-1234)
SECSKILL_OUTPUT_DIR	Optional	Directory to save results (default: ./output)
SECSKILL_NVD_API_KEY	Optional	NVD API key (relaxes rate limits)

Workflow

Step 1: Environment setup and CVE ID validation

export CVE_ID="${SECSKILL_CVE_ID:?Set the SECSKILL_CVE_ID environment variable (e.g. CVE-2024-1234)}"
export OUTDIR="${SECSKILL_OUTPUT_DIR:-./output}"
export NVD_KEY="${SECSKILL_NVD_API_KEY:-}"
mkdir -p "$OUTDIR"

# Validate CVE ID format
if ! echo "$CVE_ID" | grep -qE '^CVE-[0-9]{4}-[0-9]{4,}$'; then
  echo "[-] Invalid CVE ID format: $CVE_ID (expected format: CVE-YYYY-NNNNN)"
  exit 1
fi

echo "[*] Starting CVE lookup: $CVE_ID"
OUTFILE="$OUTDIR/cve_${CVE_ID}.txt"

Step 2: Query the NVD API v2

echo "[*] Querying NVD API..."
NVD_URL="https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=${CVE_ID}"
RAW_JSON="$OUTDIR/cve_raw_${CVE_ID}.json"

# Set API key header
API_HEADER=""
[ -n "$NVD_KEY" ] && API_HEADER="-H apiKey:${NVD_KEY}"

HTTP_CODE=$(curl -s -o "$RAW_JSON" -w "%{http_code}" \
  --max-time 30 \
  --retry 3 \
  --retry-delay 6 \
  $API_HEADER \
  "$NVD_URL")

if [ "$HTTP_CODE" = "404" ]; then
  echo "[-] CVE not found: $CVE_ID"
  exit 1
elif [ "$HTTP_CODE" != "200" ]; then
  echo "[-] NVD API error (HTTP $HTTP_CODE)"
  exit 1
fi

TOTAL=$(jq '.totalResults' "$RAW_JSON" 2>/dev/null)
if [ "$TOTAL" = "0" ] || [ -z "$TOTAL" ]; then
  echo "[-] No data found for $CVE_ID"
  exit 1
fi
echo "[+] CVE data received successfully"