{"id":8779,"external_id":"plugin_asdk_app_6ac270bba9b48191a54808e45417444b","name":"cve","display_name":"CVE Risk Check","developer":"Agent Tools","category":"Security","listing_language":"en","listing_language_details":{"method":"cld-0.13.0/listing-v1","reliable":true,"detected_at":"2026-10-28T12:04:38Z","input_sha256":"e12435a9816e3429960017cc0df5e61d44cbd553032ce22aa2ba04caa6c557ff","source_fields":["release.description","release.interface.short_description","release.interface.long_description"]},"version":"1.2.0","skill_count":0,"first_seen_at":"2026-10-28T12:00:01.921Z","last_seen_at":"2026-11-04T06:00:02.689Z","last_changed_at":"2026-10-28T12:00:01.921Z","install_count":null,"search_matches":[],"research_summary":null,"research_reviewed_at":null,"metadata":{"canonical_app_id":"asdk_app_6ac270bba9b48191a54808e45417444b","connector_id":"asdk_app_6ac270bba9b48191a54808e45417444b","created_at":"2026-10-04T16:43:54.262889Z","discoverability":"LISTED","id":"plugin_asdk_app_6ac270bba9b48191a54808e45417444b","is_template":false,"is_template_instance":false,"name":"cve","release":{"app_ids":["asdk_app_6ac270bba9b48191a54808e45417444b"],"app_manifest":{"apps":{"cve":{"id":"asdk_app_6ac270bba9b48191a54808e45417444b","required":true}}},"app_templates":[],"description":"Triage security vulnerabilities: by CVE id (how severe it is, whether it is being exploited, how likely exploitation is) or for a whole dependency list (which 3 packages to upgrade first, and to what version).","display_name":"CVE Risk Check","id":"pluginrel_0e63084a8c888191a148a8831976d40e","interface":{"brand_color":"#B91C1C","capabilities":["Looks up a CVE's description, CVSS score and severity, and publication date from the NVD","Shows whether the CISA Known Exploited Vulnerabilities catalog lists a CVE, with its due date and required action","Adds the EPSS score: the modelled chance of exploitation in the next 30 days","Gives each CVE a priority: exploited, likely or routine","Ranks a batch of up to 10 CVEs with the most urgent first","Reads an npm, pnpm, yarn, Poetry, uv, Cargo or Go lockfile and names the 3 packages to upgrade first, with the fix","Matches package versions to OSV.dev advisories in 8 ecosystems, including npm, PyPI, Go, Maven and crates.io","Lists CVEs recently added to the CISA exploited list, optionally filtered by a product word","Links a patch or vendor advisory when NVD tags one, and names its sources and dates"],"category":"Security","composer_icon_dark_url":null,"composer_icon_url":"https://files.openai.com/content?id=file_0000000017288207a452561246c0059c","default_prompt":"How bad is CVE-2021-44228?","default_prompts":["How bad is CVE-2021-44228?","Which of CVE-2023-4863, CVE-2024-3094 and CVE-2019-0708 should I patch first?","Which dependencies in my package-lock.json should I fix first?"],"developer_name":"Agent Tools","logo_url":"https://files.openai.com/content?id=file_000000007b6c8207a806328760ee73bf","logo_url_dark":null,"long_description":"Triage security vulnerabilities: by CVE id (how severe it is, whether it is being exploited, how likely exploitation is) or for a whole dependency list (which 3 packages to upgrade first, and to what version).\n\nAsk \"how bad is CVE-2021-44228?\", \"which of these CVEs should I patch first?\", \"what did CISA add to its exploited list this month?\" or \"which dependencies in this package-lock.json should I fix first?\".\n\nCVE Risk Check reads two free public sources. The National Vulnerability Database (NVD) gives the description, the CVSS score and severity, the publication date, a link to a patch or vendor advisory when one is tagged, and whether the CISA Known Exploited Vulnerabilities (KEV) catalog lists the CVE, with CISA's due date and required action. FIRST's EPSS gives the modelled probability that the CVE is exploited in the next 30 days.\n\nEach CVE gets a priority: \"exploited\" when CISA lists it, \"likely\" when its EPSS score is 0.1 or more, otherwise \"routine\", or \"unknown\" when EPSS could not be read. A batch of up to 10 CVEs comes back sorted with the most urgent first.\n\nEvery answer names its sources and the date the NVD record and the EPSS score are from. NVD limits requests without a key, so records are cached for a few hours; a recent change to a CVE can take that long to appear, and when NVD asks this service to slow down the answer says so and when to retry.\n\nFor a dependency list, pass the text of a lockfile (package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, uv.lock, Cargo.lock, go.sum or go.mod), a package.json or a requirements.txt, or a list of packages with exact versions (npm, PyPI, Go, crates.io, Maven, RubyGems, NuGet or Packagist). Each package version is matched to its known advisories in OSV.dev, which collects the GitHub Advisory Database and other open databases. The advisories' CVE ids are then checked against the CISA exploited list and EPSS. The answer is the few packages to fix first, each with a priority (malicious, exploited, likely, routine or unknown), a one-line reason and the version to upgrade to, followed by a short list of the rest. A match is by exact name and version: it does not show that your code reaches the vulnerable code.\n\nIt does not scan your systems, read your source code, confirm that you are vulnerable, or tell you how to exploit anything. The CVE ids and dependency lists you send are not stored; the only lasting record is a daily count of calls per tool.","plugin_category_id":"security","privacy_policy_url":"https://tools.openkrill.app/privacy","screenshot_urls":[],"short_description":"CVE and dependency triage","terms_of_service_url":"https://tools.openkrill.app/terms","website_url":"https://tools.openkrill.app/"},"keywords":[],"onboarding_skill_name":null,"requires_local_executor":false,"skills":[],"version":"1.2.0"},"scope":"GLOBAL","status":"ENABLED"},"research":null,"package_metadata":{"name":"cve","author":{"url":"https://tools.openkrill.app/","name":"Agent Tools"},"sources":[{"path":"plugin.json","sha256":"312383cba71b80333fe22914977c5bde2fd06017d06b584c1a8a7346c7bcab8f"}],"version":"1.2.0","homepage":"https://tools.openkrill.app/","artifact_id":139208,"observed_at":"2026-11-03T19:13:27Z","support_url":"https://tools.openkrill.app/support","capabilities":["Looks up a CVE's description, CVSS score and severity, and publication date from the NVD","Shows whether the CISA Known Exploited Vulnerabilities catalog lists a CVE, with its due date and required action","Adds the EPSS score: the modelled chance of exploitation in the next 30 days","Gives each CVE a priority: exploited, likely or routine","Ranks a batch of up to 10 CVEs with the most urgent first","Reads an npm, pnpm, yarn, Poetry, uv, Cargo or Go lockfile and names the 3 packages to upgrade first, with the fix","Matches package versions to OSV.dev advisories in 8 ecosystems, including npm, PyPI, Go, Maven and crates.io","Lists CVEs recently added to the CISA exploited list, optionally filtered by a product word","Links a patch or vendor advisory when NVD tags one, and names its sources and dates"],"field_sources":{"name":0,"author":0,"version":0,"homepage":0,"support_url":0,"capabilities":0,"release_notes":0,"review_case_counts":0},"release_notes":"1.2.0 reads more lockfiles in triage_dependencies: pnpm-lock.yaml and yarn.lock for npm, poetry.lock and uv.lock for PyPI, Cargo.lock for crates.io, and go.sum and go.mod for Go. Workspace, git, path and url entries are skipped and listed. 1.1.0 adds triage_dependencies: give it a package-lock.json, package.json, requirements.txt or a package list and it returns the packages to fix first with the version to upgrade to, from OSV.dev, the CISA exploited list and EPSS. 1.0.0 read the NVD and FIRST EPSS: CVE lookup, CISA exploited-list status, a priority per CVE, batch ranking and a list of recent exploited-list additions. Records are cached for a few hours; read-only, no sign-in.","extraction_version":1,"review_case_counts":{"negative":3,"positive":5},"conflicts_or_errors":[]}}