scagogogo/cvss-skills

GitHub: scagogogo/cvss-skills

一个专业的 CVSS v3.0/v3.1 漏洞评分工具包，支持通过 Go SDK、CLI、MCP 及 Claude Code Skills 多种方式解析、计算、验证和比较漏洞向量。

Stars: 0 | Forks: 0

# CVSS Skills **专业的 CVSS v3.0 / v3.1 工具包 — 解析、评分、验证、比较和构建漏洞向量** [![CI](https://static.pigsec.cn/wp-content/uploads/repos/cas/ad/ad5834178f7599af9fdda11629d49cae07f2997beec49821b2920eff5bfd50e7.svg)](https://github.com/scagogogo/cvss-skills/actions/workflows/ci.yml) [![Release](https://static.pigsec.cn/wp-content/uploads/repos/cas/42/42ba98a60a0bb3b0ad908f024db145f9c5b831eb7df822f56ac578ee7d7215b3.svg)](https://github.com/scagogogo/cvss-skills/actions/workflows/release.yml) [![Go Report Card](https://goreportcard.com/badge/github.com/scagogogo/cvss-skills)](https://goreportcard.com/report/github.com/scagogogo/cvss-skills) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) [![GitHub Release](https://img.shields.io/github/v/release/scagogogo/cvss-skills)](https://github.com/scagogogo/cvss-skills/releases/latest) **🌐 网站**: [scagogogo.github.io/cvss-skills](https://scagogogo.github.io/cvss-skills/) — 完整文档、教程、API 参考 **语言**: English | [简体中文](README_zh.md)

## 🤖 概述 **CVSS Skills** 是一个单一的、经过充分测试的通用漏洞评分系统 (CVSS) v3.0 / v3.1 工具包。它解决了以编程方式处理 CVSS 向量时的痛点：易错的解析、特定版本的评分公式、手动比较以及分散的验证。它通过 **4 种集成方式** 提供： ``` flowchart LR subgraph Methods["Integration Methods"] direction TB S["🤖 Skills
Claude Code"] SDK["📦 Go SDK
go get"] CLI["💻 CLI
pre-built"] MCP["🔌 MCP Server
AI agents"] end S -->|natural language| U(["User"]) SDK -->|library| A(["App"]) CLI -->|scripts| B(["Batch"]) MCP -->|protocol| C(["Agent"]) classDef m fill:#e6f4ff,stroke:#1677ff,color:#003a8c classDef u fill:#f6ffed,stroke:#52c41a,color:#135200 class S,SDK,CLI,MCP m class U,A,B,C u ``` | | 集成方式 | 最适用场景 | 安装 | |---|---|---|---| | 🤖 | **Skills** (Claude Code) | 交互式分析、自然语言 | `claude mcp add --scope user cvss-skills -- https://github.com/scagogogo/cvss-skills` | | 📦 | **Go SDK** | 使用 Go 构建安全工具 | `go get github.com/scagogogo/cvss-skills@latest` | | 💻 | **CLI** | 脚本编写、批处理 | 见[预编译二进制文件](#-pre-built-binaries) | | 🔌 | **MCP** | AI 智能体集成 | 将此仓库添加为 MCP server | **仓库信息** | | | |---|---| | 模块路径 | `github.com/scagogogo/cvss-skills` | | 语言 | Go (≥ 1.18) | | 许可证 | MIT | | CLI 二进制文件名 | `cvss` | | CLI 入口点 | `cmd/cvss-cli/` | | 发布产物 | 通过 [GoReleaser](.goreleaser.yml) 提供 30+ 个包 (6 种 OS × 多架构) | | 最新版本 | [![GitHub Release](https://img.shields.io/github/v/release/scagogogo/cvss-skills)](https://github.com/scagogogo/cvss-skills/releases/latest) | | 网站 | | ## 🏛️ 架构所有的集成方式都是基于同一个经过充分测试的 Go 核心的轻量级封装——没有任何地方重新实现评分逻辑： ``` flowchart TB subgraph Surfaces["Integration Surfaces"] direction LR Skills["🤖 Claude Code Skills"] MCP["🔌 MCP Server"] CLI["💻 CLI (cvss)"] SDK["📦 Go SDK"] end subgraph Core["Core Packages"] direction LR Parser["pkg/parser"] CVSS["pkg/cvss"] Vector["pkg/vector"] end Skills --> CLI MCP --> CLI CLI --> Parser SDK --> Parser --> Vector --> CVSS --> Result(["Score · Severity · JSON"]) ``` 标准流水线——从原始向量字符串到分数和严重性： ``` flowchart LR A["CVSS:3.1/AV:N/..."] --> B{Parse} B -->|error| E1["error
(invalid magic head,
malformed vector, …)"] B -->|ok| C["Cvss3x struct"] C --> D{Validate} D -->|missing metric| E2["ValidationErrors"] D -->|complete| F["Calculator"] F --> G["Overall score
(base / temporal /
environmental, as present)"] G --> H["GetSeverity()"] H --> K(["9.8 · Critical"]) ``` ## ✨ 功能图谱 ``` mindmap root((CVSS Skills)) Parsing v3.0 / v3.1 vectors Relaxed parsing ParseAndScore Builder API FromMap Scoring Base / Temporal / Environmental Severity ratings Per-metric breakdown Validation Structural checks ValidationErrors IsComplete MissingMetrics Comparison Diff Merge Equal / SameSeverity Distance Euclidean Manhattan Hamming Jaccard Serialization JSON Text CSV I/O Batch Advanced Sensitivity analysis Score range Version-aware Presets Mock generators ``` | 分类 | 功能 | |----------|----------| | **解析** | 解析 v3.0/v3.1 向量，宽松解析（无需 `CVSS:` 前缀），`ParseAndScore` 一行代码，Builder API，`FromMap` | | **评分** | Base / Temporal / Environmental 分数，严重性评级，每个指标的分数明细 | | **验证** | 结构化验证，带有逐指标报告的 `ValidationErrors`，`IsComplete()`，`MissingMetrics()` | | **比较** | Diff（逐指标比较），Merge，Equal / SameSeverity 检查 | | **距离** | 欧几里得距离、曼哈顿距离、汉明距离、杰卡德相似度——支持环境感知变体 | | **序列化** | JSON marshal/unmarshal，文本 marshal/unmarshal，CSV I/O，批处理 | | **高级功能** | 敏感度分析，部分向量的分数范围，版本感知评分，预设，模拟数据生成器 | ## 🚀 快速开始 ### 1. Skills (Claude Code) — 一条命令 ``` claude mcp add --scope user cvss-skills -- https://github.com/scagogogo/cvss-skills ``` 这将在 Claude Code 中启用 **9 项 CVSS 技能**——每一项都是位于 `.claude/skills/` 下的 Markdown 指令文件，用于告诉 Claude 运行哪个 `cvss` CLI 命令：`cvss-parse`、`cvss-score`、`cvss-validate`、`cvss-construct`、`cvss-compare`、`cvss-metrics`、`cvss-serialize`、`cvss-advanced`、`cvss-install`。使用自然语言提问（“为这个向量评分：……”），Claude 会自动选择正确的技能。

手动安装

将其添加到您项目的 `.claude/settings.json` 或 `~/.claude/settings.json` 中： ``` { "mcpServers": { "cvss-skills": { "type": "github", "url": "https://github.com/scagogogo/cvss-skills" } } } ```

### 2. Go SDK — 全功能库 ``` go get github.com/scagogogo/cvss-skills@latest ``` ``` package main import ( "fmt" "log" "github.com/scagogogo/cvss-skills/pkg/parser" ) func main() { // One-step parse and score cv, score, severity, err := parser.ParseAndScore( "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", ) if err != nil { log.Fatal(err) } fmt.Printf("Score: %.1f (%s)\n", score, severity) // Score: 9.8 (Critical) _ = cv } ``` ### 3. CLI — 预编译二进制文件或 `go install` ``` # 安装预编译二进制文件（自动检测 OS/arch，解析最新版本） os=$(uname -s | tr '[:upper:]' '[:lower:]'); arch=$(uname -m) case "$arch" in arm64) arch=aarch64 ;; amd64) arch=x86_64 ;; esac ver=$(curl -sL https://api.github.com/repos/scagogogo/cvss-skills/releases/latest | sed -nE 's/.*"tag_name":\s*"v?([^"]+)".*/\1/p') curl -sL "https://github.com/scagogogo/cvss-skills/releases/download/v${ver}/cvss-skills_${ver}_${os}_${arch}.tar.gz" | tar xz sudo mv cvss /usr/local/bin/ # 或使用 Go 安装 go install github.com/scagogogo/cvss-skills/cmd/cvss-cli@latest # 使用 cvss score "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" # 输出：9.8 (Critical) ``` ### 4. MCP — AI 智能体集成从任何兼容 MCP 的客户端将此仓库作为 MCP server 连接，即可通过标准的 Model Context Protocol 使用 CVSS 工具。 ## 📦 预编译二进制文件每个[发布版本](https://github.com/scagogogo/cvss-skills/releases/latest)都通过 GitHub Actions 提供 GoReleaser 构建的 **30+ 个包**。压缩包命名： ``` cvss-skills___[v]. ``` **URL 模板**（替换 ``，例如 `0.1.0`）： ``` https://github.com/scagogogo/cvss-skills/releases/download/v/cvss-skills___. ``` | OS | 架构 | |---|---| | **linux** | `x86_64`, `aarch64`, `i386`, `armv5`, `armv6`, `armv7`, `ppc64le`, `s390x`, `riscv64`, `mips64le` | | **darwin** | `x86_64`, `aarch64` | | **windows** | `x86_64`, `aarch64`, `i386` (`.zip`) | | **freebsd** | `x86_64`, `aarch64`, `i386`, `armv5`, `armv6`, `armv7` | | **netbsd** | `x86_64`, `aarch64`, `i386`, `armv5`, `armv6`, `armv7` | | **openbsd** | `x86_64`, `aarch64`, `i386`, `armv5`, `armv6`, `armv7` | 每个发布版本还提供 `checksums.txt` (SHA256)。完整的矩阵和验证步骤：请参见[下载页面](https://scagogogo.github.io/cvss-skills/downloads/)。

从源码构建

``` git clone https://github.com/scagogogo/cvss-skills.git cd cvss-skills go build -o cvss ./cmd/cvss-cli/ # 或：make build ```

## 🧮 CVSS 向量结构 CVSS 向量最多包含 **3 层**指标： ``` flowchart LR Prefix["CVSS:3.1
version prefix"] --> Base subgraph Base["Base — required (8 metrics)"] direction LR AV["AV
Attack Vector"] AC["AC
Complexity"] PR["PR
Privileges"] UI["UI
User Inter."] S["S
Scope"] C["C
Confidential."] I["I
Integrity"] A["A
Availability"] end subgraph Temporal["Temporal — optional"] direction LR E["E
Exploit"] RL["RL
Remediation"] RC["RC
Report Conf."] end subgraph Env["Environmental — optional"] direction LR CR["CR/IR/AR
Requirements"] M["MAV…MA
Modified base"] end Base --> Temporal --> Env classDef base fill:#e6f4ff,stroke:#1677ff,color:#003a8c classDef temp fill:#fffbe6,stroke:#faad14,color:#874d00 classDef env fill:#f9f0ff,stroke:#722ed1,color:#391085 class AV,AC,PR,UI,S,C,I,A base class E,RL,RC temp class CR,M env ``` | 层级 | 指标 | 是否必填 | |-------|---------|----------| | **Base** | AV, AC, PR, UI, S, C, I, A | 是 (全部 8 项) | | **Temporal** | E, RL, RC | 否 | | **Environmental** | CR, IR, AR, MAV, MAC, MPR, MUI, MS, MC, MI, MA | 否 | ## 🎚️ 严重性等级 | 评级 | 分数范围 | 颜色 | |--------|------------|-------| | None | 0.0 | 灰色 | | Low | 0.1 – 3.9 | 绿色 | | Medium | 4.0 – 6.9 | 黄色 | | High | 7.0 – 8.9 | 橙色 | | Critical | 9.0 – 10.0 | 红色 | ``` flowchart LR Score(["Base Score 0.0–10.0"]) --> D{Band?} D -->|"= 0.0"| N["None"] D -->|"0.1–3.9"| L["Low"] D -->|"4.0–6.9"| M["Medium"] D -->|"7.0–8.9"| H["High"] D -->|"9.0–10.0"| Cr["Critical"] classDef none fill:#f0f0f0,stroke:#8c8c8c,color:#262626 classDef low fill:#f6ffed,stroke:#52c41a,color:#135200 classDef med fill:#fffbe6,stroke:#faad14,color:#874d00 classDef high fill:#fff7e6,stroke:#fa8c16,color:#873800 classDef crit fill:#fff1f0,stroke:#ff4d4f,color:#a8071a class N none class L low class M med class H high class Cr crit ``` ## 📚 Go SDK 示例 ### 解析和计算 ``` cvssVector, err := parser.ParseString("CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H") if err != nil { log.Fatalf("Parse failed: %v", err) } calculator := cvss.NewCalculator(cvssVector) score, _ := calculator.Calculate() fmt.Printf("CVSS Score: %.1f\n", score) // 9.8 fmt.Printf("Severity: %s\n", cvss.GetSeverity(score)) // Critical ``` ### Builder API ``` cv := cvss.NewBuilder().Version(3, 1). AV('N').AC('L').PR('N').UI('N').S('U'). C('H').I('H').A('H').MustBuild() score, _ := cvss.NewCalculator(cv).Calculate() fmt.Printf("Score: %.1f\n", score) // 9.8 ``` ### 结构化验证 ``` err := cv.Validate() if ve, ok := err.(cvss.ValidationErrors); ok { fmt.Printf("Missing: %v\n", ve.MissingMetrics()) } ``` ### Diff 和 Merge ``` diffs := cv1.Diff(cv2) for _, d := range diffs { fmt.Printf("%s: %s vs %s\n", d.Metric, d.V1, d.V2) } merged := cv1.Merge(cv2WithTemporal) ``` ### 距离计算 ``` dc := cvss.NewDistanceCalculator(cv1, cv2) fmt.Printf("Euclidean: %.2f\n", dc.EuclideanDistance()) fmt.Printf("Manhattan: %.2f\n", dc.ManhattanDistance()) fmt.Printf("Jaccard: %.2f\n", dc.JaccardSimilarity()) ``` ### 分数明细 ``` calc := cvss.NewCalculator(cv) breakdown, _ := calc.GetScoreBreakdown() for _, m := range breakdown.AllMetrics() { fmt.Printf("%s:%s = %.2f\n", m.ShortName, m.Value, m.Score) } ``` ### 便捷方法 ``` cv.IsComplete() // true if all 8 base metrics set cv.Is31() // true if CVSS v3.1 cv.HasTemporalMetrics() // true if temporal metrics present cv.HasEnvironmentalMetrics() // true if environmental metrics present cv.MissingMetrics() // list of missing metric names cv.Clone() // deep copy cv.BaseOnly() // clone without temporal/environmental cv.Equal(other) // exact metric comparison cv.EqualScore(other) // score-based comparison cv.SameSeverity(other) // severity-based comparison ``` ## 💻 CLI 命令 30+ 个命令。全部支持 `--format json` 进行结构化输出。运行 `cvss --help` 获取完整列表。 | 命令 | 描述 | 示例 | |---------|-------------|---------| | `cvss score` | 计算 CVSS 分数 | `cvss score "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"` | | `cvss parse` | 解析向量字符串 | `cvss parse "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"` | | `cvss validate` | 验证向量字符串 | `cvss validate "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"` | | `cvss build` | 从指标标志构建 | `cvss build --AV N --AC L --PR N --UI N --S U --C H --I H --A H` | | `cvss describe` | 人类可读的描述 | `cvss describe "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"` | | `cvss diff` | 比较两个向量 | `cvss diff "CVSS:3.1/..." "CVSS:3.1/..."` | | `cvss merge` | 合并两个向量 | `cvss merge "CVSS:3.1/..." "CVSS:3.1/..."` | | `cvss distance` | 计算距离指标 | `cvss distance "CVSS:3.1/..." "CVSS:3.1/..."` | | `cvss analyze` | 影响/敏感度分析 | `cvss analyze "CVSS:3.1/..."` | | `cvss range` | 部分向量的分数范围 | `cvss range "CVSS:3.1/AV:N"` | | `cvss preset` | 生成预设向量 | `cvss preset critical` | | `cvss random` | 生成随机向量 | `cvss random --cvss-version 3.1` | | `cvss json` | JSON 序列化 | `cvss json "CVSS:3.1/..."` | | `cvss csv` | CSV 读/写 (子命令) | `cvss csv read input.csv` | | `cvss batch` | 批量评分/验证 (子命令) | `cvss batch score vectors.txt` | | `cvss severity` | 根据分数得出严重性评级 | `cvss severity 9.8` | | `cvss sort` | 按分数对向量排序 | `cvss sort vectors.txt` | | `cvss canonicalize` | 规范化向量格式 | `cvss canonicalize "CVSS:3.1/..."` | | `cvss convert` | 在版本之间转换 | `cvss convert "CVSS:3.0/..." --to 3.1` | | `cvss enumerate` | 列出指标的有效值 | `cvss enumerate --metric AV` | | `cvss equal` | 比较两个向量 | `cvss equal "CVSS:3.1/..." "CVSS:3.1/..."` | | `cvss get` | 获取单个指标的值 | `cvss get "CVSS:3.1/..." AV` | | `cvss groups` | 按组显示指标 | `cvss groups "CVSS:3.1/..."` | | `cvss map` | 将向量输出为 key=value | `cvss map "CVSS:3.1/..."` | | `cvss modify` | 修改指标 (通过标志) | `cvss modify "CVSS:3.1/..." --AV L` | | `cvss base-only` | 去除 Temporal/Env 指标 (`strip` 别名) | `cvss base-only "CVSS:3.1/..."` | | `cvss subs` | 显示 Impact/Exploitability 子分数 | `cvss subs "CVSS:3.1/..."` | ## 📖 文档网站: **** - [集成方式](https://scagogogo.github.io/cvss-skills/integration/) — 比较 4 种使用 CVSS Skills 的方式 - [CLI 参考](https://scagogogo.github.io/cvss-skills/cli/) — 全部 30+ 个命令 - [下载](https://scagogogo.github.io/cvss-skills/downloads/) — 预编译二文件矩阵 - [API 参考](https://scagogogo.github.io/cvss-skills/docs/api/) — 完整的 Go SDK API 文档 - [示例和教程](https://scagogogo.github.io/cvss-skills/docs/examples/) — 实际用法 - [快速入门指南](https://scagogogo.github.io/cvss-skills/docs/api/getting-started) — 5 分钟入门 - [中文文档](https://scagogogo.github.io/cvss-skills/zh/) — 简体中文 ## 许可证 MIT 许可证 — 详见 [LICENSE](LICENSE) 文件。 ## 致谢 - [CVSS v3.1 规范](https://www.first.org/cvss/v3.1/specification-document) - [CVSS v3.0 规范](https://www.first.org/cvss/v3.0/specification-document)

标签：CVSS, EVTX分析, Go, GPT, MCP, Ruby工具, 安全合规, 文档结构分析, 日志审计, 漏洞管理, 网络代理