plugin.json

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "cve",
  "version": "1.2.0",
  "description": "Triage security vulnerabilities: by CVE id (how severe it is, whether it is being exploited, how likely exploitation is) or for a whole dependency list (which 3 packages to upgrade first, and to what version).",
  "author": {
    "name": "Agent Tools",
    "email": "support@openkrill.app",
    "url": "https://tools.openkrill.app/"
  },
  "homepage": "https://tools.openkrill.app/",
  "extensions": {
    "com.openai": {
      "interface": {
        "displayName": "CVE Risk Check",
        "shortDescription": "CVE and dependency triage",
        "longDescription": "Triage security vulnerabilities: by CVE id (how severe it is, whether it is being exploited, how likely exploitation is) or for a whole dependency list (which 3 packages to upgrade first, and to what version).\n\nAsk \"how bad is CVE-2021-44228?\", \"which of these CVEs should I patch first?\", \"what did CISA add to its exploited list this month?\" or \"which dependencies in this package-lock.json should I fix first?\".\n\nCVE Risk Check reads two free public sources. The National Vulnerability Database (NVD) gives the description, the CVSS score and severity, the publication date, a link to a patch or vendor advisory when one is tagged, and whether the CISA Known Exploited Vulnerabilities (KEV) catalog lists the CVE, with CISA's due date and required action. FIRST's EPSS gives the modelled probability that the CVE is exploited in the next 30 days.\n\nEach CVE gets a priority: \"exploited\" when CISA lists it, \"likely\" when its EPSS score is 0.1 or more, otherwise \"routine\", or \"unknown\" when EPSS could not be read. A batch of up to 10 CVEs comes back sorted with the most urgent first.\n\nEvery answer names its sources and the date the NVD record and the EPSS score are from. NVD limits requests without a key, so records are cached for a few hours; a recent change to a CVE can take that long to appear, and when NVD asks this service to slow down the answer says so and when to retry.\n\nFor a dependency list, pass the text of a lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, uv.lock, Cargo.lock, go.sum or go.mod), a package.json or a requirements.txt, or a list of packages with exact versions (npm, PyPI, Go, crates.io, Maven, RubyGems, NuGet or Packagist). Each package version is matched to its known advisories in OSV.dev, which collects the GitHub Advisory Database and other open databases. The advisories' CVE ids are then checked against the CISA exploited list and EPSS. The answer is the few packages to fix first, each with a priority (malicious, exploited, likely, routine or unknown), a one-line reason and the version to upgrade to, followed by a short list of the rest. A match is by exact name and version: it does not show that your code reaches the vulnerable code.\n\nIt does not scan your systems, read your source code, confirm that you are vulnerable, or tell you how to exploit anything. The CVE ids and dependency lists you send are not stored; the only lasting record is a daily count of calls per tool.",
        "developerName": "Agent Tools",
        "category": "Security",
        "capabilities": [
          "Looks up a CVE's description, CVSS score and severity, and publication date from the NVD",
          "Shows whether the CISA Known Exploited Vulnerabilities catalog lists a CVE, with its due date and required action",
          "Adds the EPSS score: the modelled chance of exploitation in the next 30 days",
          "Gives each CVE a priority: exploited, likely or routine",
          "Ranks a batch of up to 10 CVEs with the most urgent first",
          "Reads an npm, pnpm, yarn, Poetry, uv, Cargo or Go lockfile and names the 3 packages to upgrade first, with the fix",
          "Matches package versions to OSV.dev advisories in 8 ecosystems, including npm, PyPI, Go, Maven and crates.io",
          "Lists CVEs recently added to the CISA exploited list, optionally filtered by a product word",
          "Links a patch or vendor advisory when NVD tags one, and names its sources and dates"
        ],
        "websiteURL": "https://tools.openkrill.app/",
        "privacyPolicyURL": "https://tools.openkrill.app/privacy",
        "termsOfServiceURL": "https://tools.openkrill.app/terms",
        "supportURL": "https://tools.openkrill.app/support",
        "defaultPrompt": [
          "How bad is CVE-2021-44228?",
          "Which of CVE-2023-4863, CVE-2024-3094 and CVE-2019-0708 should I patch first?",
          "Which dependencies in my package-lock.json should I fix first?"
        ],
        "brandColor": "#B91C1C",
        "brandColorDark": "#EF5350",
        "composerIcon": "./assets/icon.svg",
        "logo": "./assets/icon.svg"
      },
      "review": {
        "demo_recording_url": "https://tools.openkrill.app/demos/cve.mp4",
        "test_cases": {
          "positive": [
            {
              "description": "status ok, priority exploited, the Log4Shell description, a CVSS 3.1 score of 10.0 (critical), a kev entry with the date CISA added it, an EPSS score near 1, and as_of dates for NVD and EPSS. Check against: https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-44228",
              "prompt": "How bad is CVE-2021-44228?",
              "tools_triggered": "check_cve",
              "expected_behavior": "Calls check_cve with cve \"CVE-2021-44228\"."
            },
            {
              "description": "count 3, a counts object per priority, and the results ordered with exploited CVEs first, each with CVSS, kev and EPSS fields. Check against: https://api.first.org/data/v1/epss?cve=CVE-2023-4863,CVE-2024-3094,CVE-2019-0708",
              "prompt": "Which of CVE-2023-4863, CVE-2024-3094 and CVE-2019-0708 should I patch first?",
              "tools_triggered": "check_cves",
              "expected_behavior": "Calls check_cves with those three ids."
            },
            {
              "description": "status ok, a summary line, counts per priority, and fix_first holding the 3 most urgent vulnerable packages, each with a priority, a one-line why, CVE ids, fixed_in and a fix line such as Upgrade lodash from 4.17.15 to 4.17.21. Check against: https://api.osv.dev/v1/querybatch and https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
              "prompt": "Which dependencies in this package-lock.json should I fix first?",
              "tools_triggered": "triage_dependencies",
              "expected_behavior": "Calls triage_dependencies with the file text as manifest."
            },
            {
              "description": "status ok, one package in fix_first with priority exploited (CVE-2021-44228 is on the CISA list), the CISA due date in why and a fix line naming a later version. Check against: https://api.osv.dev/v1/query",
              "prompt": "Is log4j-core 2.14.1 from Maven a problem, and what should I upgrade to?",
              "tools_triggered": "triage_dependencies",
              "expected_behavior": "Calls triage_dependencies with packages [{ecosystem \"maven\", name \"org.apache.logging.log4j:log4j-core\", version \"2.14.1\"}]."
            },
            {
              "description": "status ok, a from and to date, the number of entries in the window and each entry's CVE id, CISA name, date added, due date and CVSS score, newest first. Check against: https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
              "prompt": "What did CISA add to its exploited vulnerabilities list in the last two weeks?",
              "tools_triggered": "list_recent_kev",
              "expected_behavior": "Calls list_recent_kev with days 14."
            }
          ],
          "negative": [
            {
              "description": "The plugin triages known advisories for named packages; it cannot find new bugs or show that code reaches a vulnerable function. Expected: Does not call a tool. Says CVE Risk Check matches package versions and CVE ids to public advisories and does not read source code, and points to Package Health Check for one package's license and upkeep.",
              "prompt": "Review my source code and tell me which functions have security bugs."
            },
            {
              "description": "The plugin is a triage lookup; it gives no exploitation instructions and the request is not a use it serves. Expected: Declines to write an exploit. May offer the CVE's severity, whether it is exploited and the patch link.",
              "prompt": "Write an exploit for CVE-2021-44228 that I can run against a server."
            },
            {
              "description": "The plugin reads public CVE data only; it cannot inspect a user's systems. Expected: Does not call a tool. Says it cannot scan systems and offers to triage CVE ids the user already has.",
              "prompt": "Scan my network and tell me which servers have critical vulnerabilities."
            }
          ]
        }
      },
      "publication": {
        "release_notes": "1.2.0 reads more lockfiles in triage_dependencies: pnpm-lock.yaml and yarn.lock for npm, poetry.lock and uv.lock for PyPI, Cargo.lock for crates.io, and go.sum and go.mod for Go. Workspace, git, path and url entries are skipped and listed. 1.1.0 adds triage_dependencies: give it a package-lock.json, package.json, requirements.txt or a package list and it returns the packages to fix first with the version to upgrade to, from OSV.dev, the CISA exploited list and EPSS. 1.0.0 read the NVD and FIRST EPSS: CVE lookup, CISA exploited-list status, a priority per CVE, batch ranking and a list of recent exploited-list additions. Records are cached for a few hours; read-only, no sign-in."
      },
      "apps": "./.app.json"
    }
  }
}