CtrlK
BlogDocsLog inGet started
Tessl Logo

arn-code-batch-cve-scan

This skill should be used when the user says "scan for CVEs", "CVE scan", "check for vulnerabilities", "find vulnerabilities", "check security advisories", "dependabot triage", "dependabot scan", "scan dependencies for security issues", "audit dependencies", "vulnerability triage", "security scan", "run security audit", "arness CVE scan", "arn-code-batch-cve-scan", "run a scheduled CVE scan", "produce a CVE proposal", "finalize a CVE proposal", or wants Arness to discover, triage, and ticket security advisories across project dependencies. Supports three modes (interactive, proposal, finalize) so the workflow is safe to schedule unattended via Claude Code Routines and tool-agnostic enough to drive headlessly via claude -p or any LLM-running CLI. Dual-source discovery (GitHub Dependabot plus locally-detected scanners), per-CVE triage via arn-code-cve-analyst, project-native waiver capture, and pre-triage parent plus per-group sub-issue ticketing on GitHub or Jira. Reads from the configured Security branch.

75

Quality

92%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a well-structured instruction-only sequencer that delegates procedural detail to one-level-deep references and provides concrete commands, exact output strings, and explicit validation checkpoints across a clearly sequenced multi-step workflow. Minor conciseness and actionability deductions stem from light cross-step repetition and intentional procedural delegation rather than any real defect.

DimensionReasoningScore

Conciseness

The body is dense, procedural, and free of concept padding (no explanation of what a CVE is), but it repeats some contract info across steps ('Skip in finalize' restated several times, modes re-summarized) and the ASCII pipeline plus scheduling section add minor length that could be trimmed.

4 / 5

Actionability

As an intentional instruction-only sequencer it gives concrete commands ('git ls-remote --exit-code', 'git symbolic-ref --short refs/remotes/origin/HEAD', 'sha256sum || shasum -a 256'), exact user-facing message strings, and explicit STOP conditions, with most procedure deliberately offloaded to references — minor gaps come from that delegation rather than vagueness.

4 / 5

Workflow Clarity

Steps 0–11 are explicitly sequenced with mode-aware branches, validation checkpoints (stale-db gate, branch-existence validation, idempotency diff check), explicit STOP conditions, and a single-consent feedback gate in finalize — strong error-recovery structure for a batch operation.

5 / 5

Progressive Disclosure

Acts as a pure sequencer: the body names each step and points to one-level-deep references (all 11 referenced files verified to exist) via clearly signaled full paths, with a pipeline diagram providing navigation context — ideal overview-to-detail structure.

5 / 5

Total

18

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is exemplary: it explicitly pairs a concrete 'what' with an exhaustive 'when' trigger list and names multiple specific capabilities without vague fluff. It is written in third-person declarative voice with no over-claims, hitting the top anchor on every dimension.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'discover, triage, and ticket security advisories', 'Dual-source discovery (GitHub Dependabot plus locally-detected scanners)', 'per-CVE triage via arn-code-cve-analyst', 'project-native waiver capture', and 'pre-triage parent plus per-group sub-issue ticketing on GitHub or Jira' — giving comprehensive coverage of capabilities.

5 / 5

Completeness

Explicitly answers both 'what' (discover/triage/ticket advisories across dependencies with dual-source discovery, triage, waivers, and ticketing) and 'when' (a long 'should be used when the user says...' trigger list) with concrete trigger phrases.

5 / 5

Trigger Term Quality

Comprehensive natural trigger phrases including synonyms and variations users would actually say — 'scan for CVEs', 'CVE scan', 'check for vulnerabilities', 'find vulnerabilities', 'dependabot triage', 'dependabot scan', 'audit dependencies', 'vulnerability triage', 'security scan', and 'run security audit'.

5 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (batch CVE scanning across project dependencies with a three-mode workflow) with CVE-specific triggers and a distinct skill name, giving minimal conflict risk with other skills.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository
AppsVortex/arness
Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.