skills.rest
irrit-us
irrit-usOFFICIAL
Explore all skills by this author →
GitHub

gh-advisory

Query GitHub Security Advisories via the gh CLI for CVE and dependency vulnerability data.

Updated May 17, 2026
Search Tags:#vulnerability#github#gh cli#dependency audit#cve#ghsa#security advisory
One-click install
npx skills add https://github.com/irrit-us/agent_misc --skill gh-advisory-irrit-us
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: gh-advisory
Source: https://github.com/irrit-us/agent_misc/tree/main/skills/gh-advisory
Command: npx skills add https://github.com/irrit-us/agent_misc --skill gh-advisory-irrit-us

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security teams and developers need a fast, scriptable way to look up known vulnerabilities, CVEs, and GHSAs without leaving the terminal or manually browsing the GitHub Advisory Database website. ## Core Features & Use Cases - Advisory Search & Filtering: List and filter advisories by severity, ecosystem, CWE, type, state, and date range using the GitHub REST API. - Detailed Advisory Lookup: Retrieve full advisory details including CVSS scores, CWE mappings, affected version ranges, and patched versions for any GHSA or CVE. - Dependency Auditing: Check packages across ecosystems (npm, pip, go, maven, and more) for known vulnerabilities and track newly published advisories over time. - Use Case: Before upgrading a dependency, run a query to check whether the target version of a package like django has any open high-severity advisories, then review the patched version and CVSS score to plan remediation. ## Quick Start Ask the agent to check whether the package django on PyPI has any high-severity GitHub Security Advisories and show their CVSS scores.

Frequently Asked Questions about gh-advisory

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I look up a CVE in the GitHub Advisory Database?▼

Use the gh CLI with the cve_id query parameter: gh api '/advisories?cve_id=CVE-2024-3094'. This returns the matching GHSA entry with its severity and summary, which you can expand into full detail with a follow-up advisory lookup.

How to check a package for known vulnerabilities with gh CLI?▼

Query the advisories endpoint filtered by ecosystem, then use jq select() to match the package name, since the API has no server-side package-name filter. For example, filter ecosystem=pip results for django to list its advisories with severity and CVSS score.

What filters does the GitHub advisories API support?▼

The API supports severity, ecosystem, type (reviewed/unreviewed), state, cwe_ids, cve_id, identifiers, published and updated date ranges, sort, direction, and per_page up to 100. Filters can be combined in a single query for multi-condition searches.

Does the GitHub advisories API require authentication?▼

Yes, the gh CLI must be installed and authenticated via gh auth login before querying the /advisories endpoint. Repository-specific advisories additionally require admin permissions on the target repository.

What are the limitations of the GitHub Advisory Database API?▼

Results are capped at 100 per page with cursor-based pagination via Link headers. There is no server-side exact package-name filter, and state=withdrawn does not reliably return only withdrawn advisories, so verify the withdrawn_at field directly.

Related Skills

Explore More Software Engineering Skills→
ashtonianashtonian
2

dependency-audit

Audit software dependencies across Go, Node.js, Python, Rust, and containers.

Community
Intermediate
sdcorejssdcorejs
2

sdcorejs-dep-update

Run safe npm/yarn/pnpm dependency upgrades with lockfile diff checks.

Community
Advanced
rohunjrohunj
232

sca-trivy

Scan container images, dependencies, and IaC for CVEs using Trivy.

Community
Advanced
TcuzzoTcuzzo
1

sec-scan-dependencies

Scan project dependencies for known vulnerabilities across multiple databases and generate remediation guidance.

Community
Intermediate