# Cve Poc Generator

CVE research, standalone PoC script and report generation.

- Repository: https://github.com/transilienceai/communitytools (600 stars)
- Category: Security
- License: MIT
- Last updated: 2026-07-29
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add transilienceai/communitytools --skill cve-poc-generator -g -a claude-code -y`
Codex: `npx skills add transilienceai/communitytools --skill cve-poc-generator -g -a codex -y`
Cursor: `npx skills add transilienceai/communitytools --skill cve-poc-generator -g -a cursor -y`
Gemini CLI: `npx skills add transilienceai/communitytools --skill cve-poc-generator -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add transilienceai/communitytools`

## Description

CVE research, standalone PoC script and report generation. Given a CVE ID, researches NVD and advisories, generates a safe Python PoC, and writes a detailed vulnerability report.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# CVE PoC Generator

Research a CVE by ID, generate a standalone Python proof-of-concept script, and produce a detailed vulnerability report.

## Workflow

1. **NVD Lookup** - Query NVD API v2.0 for the CVE ID (`python3 tools/nvd-lookup.py <CVE>`). Extract the CVSS score/vector using the v4.0-primary ladder (v4.0 → v3.1 → v3.0 → v2.0; the tool's `JSON_SUMMARY` exposes `cvss_version` + `cvss_vector`), plus CWE IDs, CPE matches, advisory URLs, and patch links.
2. **Advisory Research** - Deep-dive vendor advisories, GitHub security advisories, Exploit-DB, and published write-ups. Identify root cause, affected versions, and attack vector details.
3. **PoC Generation** - Write a standalone Python script (`poc.py`) that demonstrates the vulnerability safely. Follow the script standards in `reference/poc-methodology.md`.
4. **Report Generation** - Write a comprehensive markdown report (`report.md`) with metadata, root cause analysis, risk assessment, and remediation guidance.

## NVD Data to Collect

| Field | Source | Usage |
|-------|--------|-------|
| CVE ID | NVD | Primary identifier |
| CVSS Score + Vector (v4.0 primary; v3.1/v3.0/v2.0 fallback) | NVD | Risk scoring |
| CWE ID(s) | NVD | Vulnerability classification |
| CPE Matches | NVD | Affected products and versions |
| Advisory URLs | NVD references | Research sources |
| Patch Links | NVD references / vendor | Remediation guidance |
| Description | NVD | Vulnerability summary |
| Published / Modified dates | NVD | Timeline |

## Output

```
{OUTPUT_DIR}/
  artifacts/cve-pocs/CVE-XXXX-XXXXX/
    poc.py              # Standalone Python PoC script
  reports/cve-pocs/CVE-XXXX-XXXXX/
    report.md           # Detailed vulnerability report
```

## Invocation

```
/cve-poc-generator CVE-2024-XXXXX
```

The skill accepts a single CVE ID as argument. Multiple CVEs should be processed with separate invocations.

## Rules

The rest: https://github.com/transilienceai/communitytools/blob/HEAD/skills/cve-poc-generator/SKILL.md