Inspiration

As a computer science doctoral student and software security engineer, I study how AI can support vulnerability analysis and threat intelligence. A recurring frustration is that understanding a single CVE means jumping between sources: NVD for the description and CVSS score, the same record for weakness (CWE) classifications, and FIRST for exploit likelihood (EPSS). Each source has its own quirks, and it's easy to misread which data came from where.

I joined this hackathon to learn how to build software with an AI coding agent the right way, planning first and building in small slices, while creating a tool that supports my broader research on connecting CVEs, CWEs, and MITRE ATT&CK techniques.

What it does

CVE Insight is a command-line tool that turns one CVE ID into a single, readable vulnerability report. Run python cve_insight.py CVE-2021-44228 and it shows:

The CVE description, publish date, and last update from the NIST National Vulnerability Database
The headline CVSS score and severity, plus every other CVSS assessment on record
The CWE weaknesses linked to the CVE, with who assigned each one
The EPSS score: the predicted probability the vulnerability will be exploited

It's built for security analysts and researchers who want a fast, trustworthy first look at a vulnerability. Its core principle is transparency: every data point shows its source, and missing data is labeled, never guessed or filled in.

How we built it

I started with an empty folder and used Claude Code with the Devpost Learn Skill Pack. The skills interviewed me about the idea, helped me narrow the scope to something I could finish, and produced a scope document, PRD, and technical spec before I wrote any code. We then built it in small slices: NVD lookup, CVSS selection, CWE handling, EPSS lookup, and finally report output.

It's written in Python with a small module per job (NVD, CVSS, CWE, EPSS, report formatting), uses only free public APIs, and needs no API keys.

Challenges we ran into

Scope: my original idea included AI-inferred ATT&CK mappings. The planning process showed that wasn't realistic in one sitting, so I focused on getting the data foundation right first.
Choosing which CVSS score to headline when a CVE has several versions and sources. I settled on clear rules: newest version wins, and NVD's primary assessment beats secondary ones.
Representing missing data honestly. "No record exists," "record exists, but the field is empty," and "the source couldn't be reached" are different situations, and the tool reports each one distinctly.
NVD rate limits for unauthenticated requests, handled with a timeout and a single retry.

Accomplishments that we're proud of

A working tool that goes from an empty folder to a complete report in one evening
Every piece of data is traced to its source, with nothing invented
Clear exit codes and error handling, so it's ready to plug into larger research pipelines
A planning trail (scope, PRD, spec) that documents every decision

What we learned

The biggest lesson was to plan before building. Letting the AI interview me and write a scope, PRD, and spec first kept it from drifting or repeating mistakes, and building in small, tested slices made every step easy to check. I also learned that being explicit about data provenance matters as much as the data itself, which is directly relevant to my research on AI-assisted threat intelligence.

What's next for CVE Insight

Mapping CWEs to MITRE ATT&CK techniques, labeling each link as "Documented" (from MITRE/CAPEC data) or "AI-inferred" with its reasoning
Showing CWE names alongside IDs
Looking up multiple CVEs at once, with caching to respect API rate limits
A simple web interface for analysts who don't use the terminal