openvex-spec
Installation
SKILL.md
OpenVEX Specification: Skill Entry
This SKILL.md is the entrypoint for the OpenVEX specification skill. It provides
OpenVEX v0.2.0 schema references for producing valid VEX documents, understanding
vulnerability exploitability statuses, and looking up CVE data from public sources. Status
determination logic and agent behavioral rules live in the VEX generation instructions.
VEX statuses
| Status | Meaning |
|---|---|
not_affected |
The vulnerability is not exploitable in this product. Requires a justification or impact_statement. |
affected |
The vulnerability is exploitable. Requires an action_statement describing remediation. |
fixed |
The vulnerability was present but has been remediated in this product version. |
under_investigation |
The author is evaluating whether the vulnerability affects this product. Safe default for uncertain cases. |
Justification codes for not_affected
When a statement uses not_affected status, it must include a machine-readable justification: