cveq — CVE triage in one command

Run one command, get a CVE triage report in 5s: official CVSS score, summary, curated GitHub PoCs, and markdown saved to Obsidian. Zero dependencies, zero API keys, pure speed for your terminal.

Comment

Inspiration

What it does

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for cveq — CVE triage in one command

cveq — CVE Triage in One Command

Inspiration

I'm a cybersecurity student who plays CTFs and HackTheBox. Every time I study a CVE, the same ritual begins: NVD's slow page, a GitHub PoC hunt, vendor advisories — 15–20 minutes of tab-hopping per vulnerability.

My second pain: even when I did research a CVE properly, the findings died in browser tabs and scattered folders.

cveq was born from those two annoyances: triage in one command, and a research log that actually gets kept.

What It Does

  • cveq <CVE-ID> → A complete terminal report in under 5 seconds:
    • Plain official summary
    • Color-coded CVSS severity badge
    • Affected products & official references
    • Top-5 GitHub PoC repositories ranked by stars
  • cveq <ID> --save → Logs the lookup into ~/.cveq/journal.md, an Obsidian-friendly markdown research journal.
  • cveq journal → Reviews the last 20 investigations formatted as a clean table.
  • Graceful everywhere: Invalid IDs, unknown CVEs, network timeouts, and GitHub rate limits produce friendly messages and correct exit codes — never a raw stack trace.

How We Built It

Entirely with the Devpost Learn Skill Pack in Antigravity CLI, following the plan-first workflow:

  1. run 1-start interviewed me.
  2. 2-scope, 3-prd, and 4-spec produced the planning documents committed in devpost/ — before a single line of code was written.

Key Engineering Decisions:

  • Zero external runtime dependencies: Built using native Node.js fetch, parseArgs, and hand-rolled ANSI escapes. A security tool with zero supply-chain attack surface.
  • CVE.org as single data source: One response schema, authoritative records, and no API keys required; concurrent GitHub PoC search run via Promise.all.
  • Failure modes specified before the happy path: Built-in partial success on rate limits, tolerant markdown parsing, and 8-second abort timeouts.

The build was executed as 4 vertical slices, each verified with the native node:test suite and a hands-on terminal battery before committing.

Challenges We Ran Into

  • Agent session drop: My agent session died mid-build due to a server connection drop. The planning docs, checklist, and git history let a fresh session resume with zero lost context — plan-first proved to be a reliable save file, not ceremony.
  • Windows ANSI colors: Escape codes can render as garbage on some terminal emulators. We specified TTY detection and NO_COLOR support in the spec before hitting the bug live.
  • CVE JSON 5.0 metric containers: CVSS scores hide across different record containers (CNA vs. ADP). The spec pinned a clean fallback hierarchy defaulting to "NOT SCORED" rather than guessing.

Accomplishments That We're Proud Of

  • Shipped in ~1 day: A complete, robust CLI tool with 20/20 unit tests green, built from an empty folder to final submission.
  • Zero dependencies, zero API keys, zero configuration: Install and it just works across Windows, macOS, and Linux.
  • Contract-enforced failure handling: The fake-CVE test, rate-limit fallback, and timeout paths all yield clean user-facing messages and explicit exit codes — verified live, not assumed.
  • Resilient agent workflow: The planning documents survived a mid-build crash and carried the full context into a fresh session without rework.

What We Learned

The flipped interaction — being interviewed instead of prompt engineering — kept the scope tight enough to actually ship. Writing failure modes first eliminated the rework loops common with AI-generated code. When sessions drop, structured artifacts carry the context forward. Plan-first is now my default workflow when building with agents.

What's Next for cveq

Features currently parked in scope.md's "Later" backlog:

  • [ ] EPSS scores integration
  • [ ] NVD enrichment
  • [ ] Machine-readable output (--json)
  • [ ] Optional AI plain-English summary layer

Built With

Share this project:

Updates

Submission history