Automate technology stack vulnerability tracking with NVD/NIST integration, EPSS exploit scoring, and CISA KEV tracking for daily prioritized remediation.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install cve-tracker
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install cve-tracker using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is CVE Tracker?
CVE Tracker is a continuous, automated security intelligence agent designed to actively monitor technology stacks for newly disclosed security vulnerabilities. As one of the security-focused Openclaw Skills, this agent helps development and operations teams identify system threats before they can be exploited by attackers. It works by checking your custom software inventory against the NVD/NIST database and enriching findings through a local CVE-MCP endpoint.
Rather than overwhelming administrators with noisy alerts, the skill translates raw CVE disclosures into high-priority remediation plans. It leverages advanced scoring metrics, including the CISA Known Exploited Vulnerabilities (KEV) catalog and Exploit Prediction Scoring System (EPSS) percentages, to prioritize patches that represent active, real-world threats to your specific environment.
CVE Tracker Use Cases
- Continuous Security Auditing: Establish a baseline of known vulnerabilities across your production systems during host onboarding or routine compliance assessments.
- Automated Patch Management: Generate daily sorted digests highlighting which of your installed package versions are subject to newly published critical CVEs.
- Threat Intelligence Prioritization: Filter security alerts by active-exploitation markers (CISA KEV) and probability ratings (EPSS) to optimize limited engineering resources.
- Incident Blast-Radius Assessment: Instantly check your tech stack's exposure when high-profile vulnerability announcements (such as novel supply chain compromises) drop.
How CVE Tracker Works
- Inventory Definition: The agent reads a centralized JSON schema detailing software products, exact version numbers, and monitored watchlists.
- Vulnerability Fetching: It polls the NVD API 2.0 to capture recent CVE disclosures corresponding to the active window.
- Threat Intelligence Enrichment: The skill queries a local CVE-MCP microservice to extract advanced telemetry, including exploit availability, CVSS severity, CISA KEV catalog registration, and EPSS scores.
- Risk Ranking: Findings are parsed and prioritized, placing active exploits and critical CVSS vulnerabilities at the top of the queue.
- Briefing Output: An organized Markdown report or structured alert is delivered to human operators or downstream security systems for fast triage.
CVE Tracker Setup
Ensure that your target host has curl and jq installed, security stack inventory file access, and a running CVE-MCP endpoint.
Step 1: Create Your Tech Stack Inventory
Save your system inventory to a JSON file monitored by the agent:
cat > /tmp/tech-stack.json << 'EOF'
{
"stack_name": "production-infrastructure",
"last_updated": "2026-07-04",
"products": [
{"name": "nginx", "version": "1.24.0", "category": "web-server"},
{"name": "postgresql", "version": "15.3", "category": "database"},
{"name": "redis", "version": "7.0.11", "category": "cache"}
],
"watchlist": [
"nginx", "postgresql"
],
"ignore_cve": []
}
EOF
Step 2: Run an On-Demand Bulk Scan
Scan the defined inventory against CVE-MCP and print prioritized metrics:
curl -s -X POST "http://localhost:8765/cve-mcp/search" \
-H "Content-Type: application/json" \
-d '{"product": "nginx", "version": "1.24.0"}' | jq '.'
Step 3: Schedule Daily Monitoring
Configure the automated daily script to generate Markdown digests of new threats within your Cron configuration:
DAILY_DIGEST_SCRIPT="$HOME/App/domains/argus/clawhub-skills/cve-tracker/daily-digest.sh"
chmod +x "$DAILY_DIGEST_SCRIPT"
CVE Tracker Data Schema & Taxonomy
Technology Stack Schema
| Attribute | Type | Description |
|---|---|---|
stack_name |
String | A descriptive label for the target infrastructure. |
products |
Array of Objects | Specific components containing name, version, and category. |
watchlist |
Array of Strings | Critical products requiring high-priority tracking. |
ignore_cve |
Array of Strings | Specific CVE IDs excluded from alerts. |
Reports & Outputs Taxonomy
- CVE ID: Standardized identifier (e.g., CVE-2024-3094).
- CVSS Score: Numeric severity value (0.0 to 10.0).
- EPSS Score: Exploit probability score (decimal 0.0 to 1.0).
- CISA KEV Status: Boolean flag pointing to active exploitation in the wild.
- Exploit Maturity: Verification of public exploit script availability.
CVE Tracker Advanced Features
- EPSS Trend Analysis: Analyzes exploitation probability shifts over time to proactively schedule patch cycles.
- CISA KEV Filtering: Instantly filters alerts to highlight vulnerabilities actively targeted by threat actors.
- Custom Webhook Alerts: Push immediate warnings to Slack, Discord, or generic endpoints when CVSS scores surpass your
ALERT_THRESHOLD_CVSS. - Multi-Agent Orchestration: Seamlessly coordinates with tools like vulnerability scanners for active verification or incident response execution.
SKILL.md
Loading
Related Openclaw Skills
StillOS Notary
A secure, Ed25519-signed claim verification tool that resolves facts against live external state like GitHub, blockchains, and financial markets.
DataEcho
Deploy files, static sites, and containerized server-side apps to live URLs straight from your AI coding agent, powered by secure Drives for persistent memory.
LYGO Second Brain
A local, LLM-powered second brain and wiki that combines Obsidian markdown vaults with Ollama inference, semantic search, and multi-model consensus.
Incident Responder
A playbook-driven incident response framework providing structured security workflows, evidence collection, and BlackArch forensic tool integration.
BTC Sovereign Tracker
A secure, watch-only Bitcoin self-custody tracker designed to monitor COLDCARD Q vault health, mempool fees, UTXOs, and on-chain metrics.
ZK-Bankir Monitor
A secure, read-only monitoring skill designed to track ZK-Bankir sovereign banking treasuries, verify SHA-256 hash-chains, and audit multi-asset balances.
Featured*
