← All skills
generate-cve-json
82 / 100 · Low risk
Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By apache/magpie (GitHub) · security · 146 stars · scanned at commit 8d24b52
Generate a CVE 5.x JSON document from an <tracker> tracking
issue, ready to paste into the Vulnogram `#source` tab of the ASF CVE tool
at https://cveprocess.apache.org/cve5/<CVE-ID>#source. The conversion is
deterministic: same issue in, same JSON bytes out. Handles multiple
credits (one per line) and multiple references (URLs extracted from the
issue's "Public advisory URL" and "PR with the fix" fields; the
"Security mailing list thread" field is treated as internal-only and
never exported).
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 21 places.
Show 17 more
- tools/cve-tool-vulnogram/generate-cve-json/SKILL.md, line 573
uv run --project <framework>/tools/cve-tool-vulnogram/generate-cve-json generate-cve-json 232 \ - tools/cve-tool-vulnogram/generate-cve-json/src/generate_cve_json/cve_json.py, line 673
result = subprocess.run( - tools/cve-tool-vulnogram/generate-cve-json/src/generate_cve_json/cve_json.py, line 693
except subprocess.CalledProcessError as exc: - tools/cve-tool-vulnogram/generate-cve-json/src/generate_cve_json/cve_json.py, line 2336
result = subprocess.run( - tools/cve-tool-vulnogram/generate-cve-json/src/generate_cve_json/cve_json.py, line 2344
except subprocess.CalledProcessError as exc: - tools/cve-tool-vulnogram/generate-cve-json/tests/test_cli.py, line 26
with mocked `subprocess.run`); - tools/cve-tool-vulnogram/generate-cve-json/tests/test_cli.py, line 241
with patch("generate_cve_json.cve_json.subprocess.run", return_value=completed) as run: - tools/cve-tool-vulnogram/generate-cve-json/tests/test_cli.py, line 258
with patch("generate_cve_json.cve_json.subprocess.run", return_value=completed): - tools/cve-tool-vulnogram/generate-cve-json/tests/test_cli.py, line 264
"generate_cve_json.cve_json.subprocess.run", - tools/cve-tool-vulnogram/generate-cve-json/tests/test_cli.py, line 271
err = subprocess.CalledProcessError(returncode=1, cmd=["gh"], stderr="not found") - tools/cve-tool-vulnogram/generate-cve-json/tests/test_cli.py, line 272
with patch("generate_cve_json.cve_json.subprocess.run", side_effect=err): - tools/cve-tool-vulnogram/generate-cve-json/tests/test_cli.py, line 283
with patch("generate_cve_json.cve_json.subprocess.run", return_value=completed) as run: - tools/cve-tool-vulnogram/generate-cve-json/tests/test_cli.py, line 292
with patch("generate_cve_json.cve_json.subprocess.run", return_value=completed): - tools/cve-tool-vulnogram/generate-cve-json/tests/test_cli.py, line 306
with patch("generate_cve_json.cve_json.subprocess.run", side_effect=fake_run): - tools/cve-tool-vulnogram/generate-cve-json/tests/test_cli.py, line 316
"generate_cve_json.cve_json.subprocess.run", - tools/cve-tool-vulnogram/generate-cve-json/tests/test_cli.py, line 323
err = subprocess.CalledProcessError(returncode=22, cmd=["gh"], stderr="rate limited\n") - tools/cve-tool-vulnogram/generate-cve-json/tests/test_cli.py, line 324
with patch("generate_cve_json.cve_json.subprocess.run", side_effect=err):
and 1 more places
Downloads and installs other software
The author does not mention this.
Found in 2 places.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'generate-cve-json' ] || [ -L ~/.agents/skills/'generate-cve-json' ]; then echo 'A skill folder named generate-cve-json already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/apache/magpie' "$d" && git -C "$d" checkout --quiet '8d24b52457f7a2731d7cc3329af96430a16715fd' -- 'tools/cve-tool-vulnogram/generate-cve-json' && mkdir -p ~/.agents/skills && cp -R "$d"/'tools/cve-tool-vulnogram/generate-cve-json' ~/.agents/skills/'generate-cve-json' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'generate-cve-json' ~/.claude/skills/'generate-cve-json' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for apache/magpie shows the score of its lowest-scoring skill.
[](https://zalavijaysinh.github.io/skilltrust/repos/apache/magpie/)
Score history
| Date | Version | Score |
|---|
| 2026-11-13 | 8d24b52 | 82 |
| 2026-11-09 | 3fd660b | 95 |
| 2026-11-07 | c099f3f | 82 |