Cve Alerts

Monitor CVE feeds for security vulnerabilities matching your tech stack. Use when setting up vulnerability monitoring, configuring CVE alerts, adding/removing watch keywords, suppressing false positives, or managing alert policies. Supports RSS/JSON feeds, configurable watchlists, suppression rules, severity thresholds, and multiple alert modes (immediate email, daily digest, dashboard only).

Monitor security vulnerability feeds for products, packages, and services you care about.

Requirements

Before using this skill, ensure:

1. External feed access — agent can fetch RSS/JSON from CVE sources
2. Local state storage — writable directory for seen items, suppressions, config
3. Email/Telegram capability — SMTP credentials and/or Telegram bot for alerts (optional if dashboard-only)
4. Scheduler — systemd timer, cron, or OpenClaw scheduler for periodic scans

Quick Start

1. Create config directory and watchlist:

bash

mkdir -p ~/.config/cve-alerts

2. Create ~/.config/cve-alerts/config.json:

json

{
  "feeds": ["https://cvefeed.io/rssfeed/severity/high.xml"],
  "watchlist": ["node.js", "express", "nginx", "postgresql"],
  "alertEmail": "[e-mail]",
  "alertPolicy": "immediate",
  "dataDir": "~/.local/share/cve-alerts"
}

3. Run scanner: node scripts/cve-scanner.mjs

4. Set up timer for hourly scans (see references/deployment.md)

Operator Controls

Watchlist Management

Add items to config.json watchlist array:

• Product names: "postgresql", "nginx"
• Package names: "lodash", "express"
• Vendor names: "apache", "microsoft"
• Internal names: "mycompany-auth", "internal-api"

Watchlist supports case-insensitive partial matching.

Suppression Rules

Create ~/.config/cve-alerts/suppressions.json:

json

{
  "cves": ["CVE-2024-12345"],
  "keywords": ["android", "ios"],
  "patterns": [".*mobile.*"],
  "temporary": [
    {"cve": "CVE-2024-99999", "expires": "2026-06-01"}
  ]
}

• cves — specific CVE IDs to ignore
• keywords — terms that trigger false positives
• patterns — regex patterns to exclude
• temporary — suppressions with expiry dates

Alert Policies

Set alertPolicy in config:

• "immediate" — email on each new match
• "digest" — daily summary email
• "dashboard" — no email, dashboard only

Severity Filtering

Set minSeverity in config:

• "critical" — CVSS 9.0+
• "high" — CVSS 7.0+ (default)
• "medium" — CVSS 4.0+
• "low" — all severities

Files

• scripts/cve-scanner.mjs — main scanner (run directly or via timer)
• scripts/generate-dashboard.mjs — rebuild static dashboard HTML
• references/config-schema.md — full configuration reference
• references/deployment.md — systemd timer and nginx setup

Workflow

text

Fetch feed → Filter by severity → Match watchlist → Apply suppressions → 
Save new matches → Update dashboard → Send alerts (per policy)

Scanner is idempotent — safe to run repeatedly, only alerts on net-new matches.