Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/zebbern/pocmap/pocmap-agentnpx skills add zebbern/pocmap --skill pocmap-agentgit clone --depth 1 https://github.com/zebbern/pocmapWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00130 | $0.01629 |
| Opus 5 | $0.00065 | $0.00814 |
| Sonnet 5 | $0.00026 | $0.00326 |
| Haiku 4.5 | $0.00013 | $0.00163 |
Grade A, and why
pocmap-agent scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.
PocMap Agent Skill
Use PocMap to look up CVEs, find exploits/PoCs, discover recent vulnerabilities, map products/packages to CVEs, check KEV/EPSS, find bug bounty reports, and locate practice labs.
Source of truth:
src/pocmap/wins over this skill. The public Python API is synchronous. Full MCP contracts live inreferences/mcp_tools.md(canonical agent consumption guide). CLI flags:references/cli_commands.md.
Quick Start
pip install "pocmap[server]" # CLI + MCP (mcp SDK 2.x / MCPServer via [server])
# from a clone: pip install -e ".[server,dev]"
pocmap lookup CVE-2021-44228
python -m pocmap --help # authoritative CLI list (13 commands)
# MCP server (src/pocmap/mcp/ → pocmap-mcp via mcp_server facade)
uvx --from 'pocmap[server]' pocmap-mcp
pocmap-mcp # after install
python -m pocmap.mcp_server
from pocmap.services import CVEService
with CVEService() as svc:
info = svc.get_cve_info("CVE-2021-44228")
print(info.cvss, info.epss, info.kev_status) # epss is 0–100 in the Python model
Decision Guide
| Goal | MCP tool | CLI |
|---|---|---|
| PoC / exploit repos only | find_github_pocs (first) |
(shown in lookup) |
| Full assessment of known CVE ID(s) | generate_json_report |
pocmap lookup / bulk |
| Look up one CVE (metadata) | lookup_cve |
pocmap lookup CVE-… |
| Recent CVEs / monitoring | find_recent_exploits |
pocmap latest --since 24h |
| CVEs for a deployed product | discover_product_cves |
pocmap discover "Product" |
| CVEs for a dependency / lockfile | discover_package_cves |
— |
GitHub PoCs (+ labels/trust_score/sources) |
find_github_pocs |
(shown in lookup) |
| Metasploit (multi-module; path/type) | find_metasploit_module (limit>1) |
— |
| ExploitDB / Nuclei | find_exploitdb_entry / find_nuclei_template |
— |
| Prioritize known CVE IDs | generate_json_report → read triage |
— |
| How it is exploited (ATT&CK) | get_attack_techniques |
— |
| Verify PoC is real | verify_github_pocs (needs POCMAP_ALLOW_FETCH_POC_SOURCE=1) |
— |
| KEV / EPSS | check_kev_status / get_epss_score |
— |
| Bug bounty / labs | find_bug_bounty_reports / find_practice_labs / find_vulhub_docker |
bugbounty / labs |
| CVE ↔ CPE | cve_to_cpe / cpe_to_cve |
cpes / cpe2cve |
| HTML report | generate_html_report |
pocmap bulk |
| Playbooks | get_*_playbook |
— |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 118 lines · 130 tokens per session scan A 0fd37d8b6ee4
pocmap-agent is a skill published in the GitHub repository zebbern/pocmap (5 stars, last pushed 9d ago), licensed MIT. It adds 130 tokens to every session and 1,629 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
baoyu-imagine
AI image generation with OpenAI GPT Image 2, Azure OpenAI, Google, OpenRouter, DashScope, Z.AI GLM-Image, MiniMax, Jimeng, Seedream and Replicate APIs. Supports text-to-image, reference images, aspect ratios, and batch generation from saved prompt files. Sequential by default; use batch parallel generation when the…
discernment-nudge
After you give a substantive answer or draft that the user may act on — advice or recommendations, drafted artifacts such as goals, plans, pitches, proposals, or emails, estimates or projections, analysis or interpretation of data, factual claims they may rely on, or a multi-step argument — invoke this skill BEFORE…
observal
Operates the Observal CLI for authentication, configuration, setup diagnosis, teamspaces, inbox work, scans, update checks, and authenticated API access. Use when the user wants to log in, configure Observal, inspect local harness setup, manage a teamspace or invitation, process inbox items, check installed registry…
observal-admin
Administers Observal users, settings, diagnostics, review queues, security events, audit logs, SAML, SCIM, local server services, upgrades, rollback, and database migrations. Use when the user needs privileged governance, submission decisions, identity configuration, security investigation, or server operations.
observal-agents
Creates, authors, validates, publishes, updates, versions, pulls, archives, restores, transfers, and manages co-authors for Observal Agents. Use when the user wants to build or install an Agent, change an Agent definition, publish a draft, release a version, or manage Agent ownership.
observal-registry
Searches, recommends, bulk-submits, installs, edits, versions, archives, restores, transfers, and manages co-authors for Observal MCP servers, skills, hooks, prompts, and sandboxes. Use when the user wants to find components, publish one or many they control, install them into a harness, or manage their lifecycle.