cve-search
Installation
SKILL.md
CVE Search
Turn vulnerability records into an applicability decision with known coverage. A public record or matching banner does not establish that an asset is affected.
Identify and discover
- Capture the product/vendor, ecosystem/package, edition, version/build, platform and relevant configuration from available evidence. Keep asset identity and observation date. If identity is uncertain, search plausible candidates without silently treating the guess as confirmed inventory.
- Match the research window to the question. An installed-asset review can require older CVEs and newly updated advisories; a recent-publication filter alone misses them.
- Discover candidates through the relevant vendor/distro advisories, CVE/CNA records, and ecosystem sources such as OSV or GHSA. Use upstream issues, releases and patches to resolve gaps. Preserve publisher attribution when aggregators combine CNA, ADP or NVD information. Search summaries are leads; inspect the underlying records.
- Follow documented pagination and record filters, retrieval time, source failures and coverage limits. Deduplicate using verified aliases or explicit duplicate/replacement links. Keep relevant advisories without a CVE as separately identified leads; do not invent an ID or discard them.
- Stop when the requested lookup or bounded inventory has been covered, or state which sources/records remain unresolved. Zero hits, missing enrichment or an incomplete response do not establish a clean asset.
Use available source APIs/connectors for structured records and web search for discovery. Tavily can find advisories when available; follow the actual tool schema. Do not mistake ranking, snippets, or generated synthesis for verified applicability.