cve-impact

**CRITICAL**: Use for ALL CVE discovery and listing. DO NOT call get_cves directly. Use when: "show critical CVEs", "CVEs on hostname X", "remediatable vulnerabilities", "impact of CVE-X", risk assessment. NOT for remediation (use `/remediation`). System-level: FIRST reply = pagination prompt (Step -1). Parsing: references/01-cve-response-parser.py.

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./rh-sre/skills/cve-impact/SKILL.md

Quality

Content

50%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is well-structured with strong HITL gating and concrete tool/parser guidance, but it is over-long due to verbatim duplication, contains internal workflow contradictions, and depends on multiple docs/ reference paths that are absent from the actual bundle. Tightening the redundancy and fixing or removing the broken references would lift it materially.

Suggestions

Remove the duplicated HITL pagination prompt and the repeated MCP-validation block: keep each in one canonical location and cross-reference it, and consolidate the three tool inventories (Prerequisites, Dependencies, Tools Reference) into a single table.

Resolve the broken docs/ links (docs/references/cvss-scoring.md, docs/insights/insights-api.md, docs/insights/fleet-management.md, docs/references/skill-invocation.md, docs/references/lightspeed-mcp-tool-failures.md): either move these files into the references/ bundle and update paths, or replace the mandatory 'Read docs/X' consultation steps with inline guidance.

Reconcile the workflow ordering — state once whether HITL is 'Step -1' or 'Step 1' and make account-level routing consistent — and either flesh out Steps 6-7 with concrete checkpoints or move them into the flow files.

Dimension	Reasoning	Score
Conciseness	At ~420 lines the body is mostly efficient per section but padded by substantial duplication — the system-level HITL pagination prompt is reproduced verbatim twice, the Lightspeed MCP validation procedure is explained in both Prerequisites and Step 0, and the tool inventory appears three times (Prerequisites, Dependencies, Tools Reference) — placing it at the level-2 'mostly efficient but could be tightened' anchor rather than the lean level-3.	2 / 3
Actionability	It offers concrete, copy-paste-ready guidance (parser invocation commands with FILTER_REMEDIATABLE=1/OUTPUT=report flags, exact HITL prompts, specific tool parameters), but several 'Document Consultation' steps point to docs/cvss-scoring.md, docs/insights/insights-api.md, and docs/insights/fleet-management.md that do not exist in the bundle, and Steps 6-7 are near-empty one-liners, so guidance is incomplete per the level-2 anchor.	2 / 3
Workflow Clarity	The main path has a clear sequence with explicit HITL gates, a mandatory MCP validation prerequisite, and stated anti-patterns, but it carries contradictions (Step -1 vs 'Step 1 HITL FIRST' both claim to be the first action; account-level is routed to Step 0 in one place and Step 1 elsewhere) and Steps 6-7 lack checkpoints, fitting the level-2 'steps listed but validation gaps; checkpoints missing or implicit' anchor despite the otherwise strong sequencing.	2 / 3
Progressive Disclosure	The references/ tree (parser script, parsing guide, output templates, examples, error handling, and three flow files) is a well-signaled one-level-deep split, but the body still inlines large output-format templates that belong in references/03-output-templates.md and, critically, relies on roughly eight docs/... links (docs/references/cvss-scoring.md, docs/insights/*, docs/references/skill-invocation.md, docs/references/lightspeed-mcp-tool-failures.md) that have no corresponding files in the bundle, matching the level-2 'references present but not clearly signaled / content that should be separate is inline' anchor.	2 / 3
	Total	8 / 12 Passed

Description

90%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is strong overall: it gives explicit natural-language triggers, answers both 'what' and 'when', and draws a clear boundary against the remediation skill. Its only weakness is that concrete capabilities are delivered via CRITICAL/procedural framing rather than a crisp action list.

Dimension	Reasoning	Score
Specificity	Names the domain and several concrete actions (CVE discovery/listing, pagination, response parsing) but expresses them through CRITICAL/procedural framing rather than a clean enumeration of multiple specific actions, so it falls short of the level-3 'lists multiple specific concrete actions' anchor.	2 / 3
Completeness	It states what the skill does ("Use for ALL CVE discovery and listing") and an explicit 'Use when' clause with concrete triggers, satisfying the level-3 anchor that requires both 'what' AND 'when' with explicit triggers.	3 / 3
Trigger Term Quality	Phrases like "show critical CVEs", "CVEs on hostname X", "remediatable vulnerabilities", and "impact of CVE-X" are exactly what a user would naturally say, matching the level-3 'good coverage of natural terms users would say' anchor.	3 / 3
Distinctiveness Conflict Risk	The explicit "NOT for remediation (use /remediation)" boundary plus narrow CVE-impact triggers give it a clear niche unlikely to fire for the wrong skill, matching the level-3 'clear niche with distinct triggers' anchor.	3 / 3
	Total	11 / 12 Passed

Validation

81%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning
relative_links	Relative link issues: 14 missing, 17 deeper-than-1-level	Warning
referenced_paths_exist	Referenced path issues: 3 deeper-than-1-level	Warning

	Total	13 / 16 Passed

Repository: RHEcosystemAppEng/agentic-collections
Path: rh-sre/skills/cve-impact/SKILL.md
Commit: e47237b

Reviewed: 7 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.