360 Secure SkillHub
360 安全技能中心

Cve Alerts

通过可配置的 CVE 源、监视列表、抑制规则和严重级别阈值筛选漏洞，保存新增匹配、重建静态看板，并按即时、每日摘要或仅看板三种策略发送告警；扫描可重复执行且只对新增匹配告警。声明引用的脚本与参考文档未包含在文件中。

markjr
markjr
热度 8.83
最近更新 2026-07-11 23:41:20
分类：安全依赖：代码执行 / 读写文件 / 第三方 API应用场景：自动化脚本 / 工作流 / 日程安排 / 邮件起草 ...

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add cve-alerts
Metadata
name
cve-alerts
description
Monitor CVE feeds for security vulnerabilities matching your tech stack. Use when setting up vulnerability monitoring, configuring CVE alerts, adding/removing watch keywords, suppressing false positives, or managing alert policies. Supports RSS/JSON feeds, configurable watchlists, suppression rules, severity thresholds, and multiple alert modes (immediate email, daily digest, dashboard only).

CVE Alerts

Monitor security vulnerability feeds for products, packages, and services you care about.

Requirements

Before using this skill, ensure:

  1. External feed access — agent can fetch RSS/JSON from CVE sources
  2. Local state storage — writable directory for seen items, suppressions, config
  3. Email/Telegram capability — SMTP credentials and/or Telegram bot for alerts (optional if dashboard-only)
  4. Scheduler — systemd timer, cron, or OpenClaw scheduler for periodic scans

Quick Start

  1. Create config directory and watchlist:
mkdir -p ~/.config/cve-alerts
  1. Create ~/.config/cve-alerts/config.json:
{
  "feeds": ["https://cvefeed.io/rssfeed/severity/high.xml"],
  "watchlist": ["node.js", "express", "nginx", "postgresql"],
  "alertEmail": "security@example.com",
  "alertPolicy": "immediate",
  "dataDir": "~/.local/share/cve-alerts"
}

  1. Run scanner: node scripts/cve-scanner.mjs

  2. Set up timer for hourly scans (see references/deployment.md)

Operator Controls

Watchlist Management

Add items to config.json watchlist array:

  • Product names: "postgresql", "nginx"
  • Package names: "lodash", "express"
  • Vendor names: "apache", "microsoft"
  • Internal names: "mycompany-auth", "internal-api"

Watchlist supports case-insensitive partial matching.

Suppression Rules

Create ~/.config/cve-alerts/suppressions.json:

{
  "cves": ["CVE-2024-12345"],
  "keywords": ["android", "ios"],
  "patterns": [".*mobile.*"],
  "temporary": [
    {"cve": "CVE-2024-99999", "expires": "2026-06-01"}
  ]
}
  • cves — specific CVE IDs to ignore
  • keywords — terms that trigger false positives
  • patterns — regex patterns to exclude
  • temporary — suppressions with expiry dates

Alert Policies

Set alertPolicy in config:

  • "immediate" — email on each new match
  • "digest" — daily summary email
  • "dashboard" — no email, dashboard only

Severity Filtering

Set minSeverity in config:

  • "critical" — CVSS 9.0+
  • "high" — CVSS 7.0+ (default)
  • "medium" — CVSS 4.0+
  • "low" — all severities

Files

  • scripts/cve-scanner.mjs — main scanner (run directly or via timer)
  • scripts/generate-dashboard.mjs — rebuild static dashboard HTML
  • references/config-schema.md — full configuration reference
  • references/deployment.md — systemd timer and nginx setup

Workflow

Fetch feed → Filter by severity → Match watchlist → Apply suppressions → 
Save new matches → Update dashboard → Send alerts (per policy)

Scanner is idempotent — safe to run repeatedly, only alerts on net-new matches.