Skip to main content

AI Agent Skills

CVD Portal publishes Agent Skills so AI agents can work with the platform without being told how each time. A skill is a folder with a SKILL.md file holding a name, a description, and instructions. Agents load the description at startup and read the full instructions only when a task matches.

Discovery​

Skills are advertised at the well-known discovery path, per the Agent Skills Discovery RFC v0.2.0:

https://cvdportal.com/.well-known/agent-skills/index.json

The index lists each skill with its URL and a SHA-256 digest of the artifact. Agents that verify digests can confirm they loaded the file we published:

curl -s https://cvdportal.com/.well-known/agent-skills/cvd-portal-api/SKILL.md | shasum -a 256

Any agent client that supports the open Agent Skills format can consume these, including Claude Code, Gemini CLI, Cursor, GitHub Copilot, OpenCode, and Goose. Point your client at the discovery URL, or download a SKILL.md into the client's skills directory.

Published skills​

cvd-portal-disclosure​

For reporting a vulnerability to a manufacturer. Covers finding a vendor's portal through their security.txt, filing a report, filing the same finding across up to 20 vendors in one call, tracking the report afterwards, and reading a vendor's published CRA Article 14 posture.

Every endpoint it uses is public. No API key is involved.

cvd-portal-api​

For manufacturers operating their own portal. Covers the v1 REST API: compliance status, filing and exporting vulnerability records, Article 14 deadline checks, SBOM and SARIF upload, and webhook registration. Includes the scope required by each endpoint, so an agent can tell a permissions problem from a plan problem.

Requires an Enterprise-plan API key.

Authentication​

Generate a key under Settings → Developer, then expose it to your agent as an environment variable:

export CVDPORTAL_API_KEY=...

The skill instructs the agent to read it from the environment and attach it as a Bearer token against https://cvdportal.com/api/v1/.... Keys are stored as SHA-256 hashes, so a lost key is replaced rather than recovered.

Authentication discovery​

An agent that arrives without being told how to authenticate reads the Auth.md document:

https://cvdportal.com/auth.md

The document names both agent audiences, states which surfaces need no credential, and gives the scopes, expiry and rate limits that apply to a key. It also records that CVD Portal runs no OAuth authorization server, so an agent does not wait for /.well-known/oauth-protected-resource. Bearer API keys are the whole credential model.

Key creation stays with a human. Only a signed-in administrator on the Enterprise plan can mint a key, so no registration endpoint is advertised and an agent cannot self-provision.

Security and privacy​

Both skills carry explicit handling rules:

  • No credentials in output. Agents are told never to write an API key into a file, a log, or a chat message, and not to echo one back if the user pastes it.
  • PII stays out of summaries. Reporter email addresses and IP addresses are omitted when summarising submissions or audit entries, unless the user asked for a specific record. The audit log is append-only, so anything surfaced cannot be unlogged.
  • Confirmation before filing. A disclosure is a permanent record on the vendor's side and is not retractable through the API, so the disclosure skill requires user approval before submitting, and again before any batch that reaches multiple organisations.
  • No overstated claims. The API prepares Article 14 filing packages; it does not transmit them to ENISA or a national CSIRT. The skill tells agents to report deadlines from the endpoint rather than computing them, and never to describe a filing as made to an authority.
  • Markdown for Agents covers reading public CVD Portal content as markdown.
  • API Overview is the developer guide the skills reference.
  • auth.md is the machine-readable authentication discovery document.