Vex — Agent Skill by Microsoft

From the author

OpenVEX v0.2.0 specification reference plus VEX management playbooks - Brought to you by microsoft/hve-core.

— the description by Microsoft

Install

Get the skill from its source (we cannot redistribute it):
https://github.com/microsoft/hve-core/tree/f425e943bf228052a23e6bc4810b5faef030314f/.github/skills/security/vex

Documentation by Microsoft

The licence of this skill does not allow us to copy its documentation. Read it at the source

Files

SECURITY.md(opens on GitHub)Not mirrored: opens on GitHub18.8 KiB
SKILL.md(opens on GitHub)Not mirrored: opens on GitHub7.5 KiB
assets/pr-body-scaffold.yml(opens on GitHub)Not mirrored: opens on GitHub1.8 KiB
pyproject.toml(opens on GitHub)Not mirrored: opens on GitHub653 B
references/cve-data-sources.md(opens on GitHub)Not mirrored: opens on GitHub9.9 KiB
references/openvex-schema.md(opens on GitHub)Not mirrored: opens on GitHub11.1 KiB
references/vex-generation.md(opens on GitHub)Not mirrored: opens on GitHub7.4 KiB
references/vex-status-logic.md(opens on GitHub)Not mirrored: opens on GitHub7.0 KiB
scripts/vex_gate.py(opens on GitHub)ScriptNot mirrored: opens on GitHub4.7 KiB
tests/corpus/0_empty(opens on GitHub)Not mirrored: opens on GitHub0 B
tests/corpus/1_finding_table(opens on GitHub)Not mirrored: opens on GitHub146 B
tests/corpus/2_terminal_statement(opens on GitHub)Not mirrored: opens on GitHub40 B
tests/corpus/3_evaluate_mixed(opens on GitHub)Not mirrored: opens on GitHub71 B
tests/corpus/4_json_like_payload(opens on GitHub)Not mirrored: opens on GitHub182 B
tests/fuzz_harness.py(opens on GitHub)ScriptNot mirrored: opens on GitHub2.7 KiB
tests/test_vex_gate.py(opens on GitHub)ScriptNot mirrored: opens on GitHub8.1 KiB
uv.lock(opens on GitHub)Not mirrored: opens on GitHub51.6 KiB

Requirements and compatibility

Written for: GitHub Copilot, Claude Code

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Claude Code frontmatter, Needs Python

Security

What our scanner noticed· Low risk

Scripts that your agent may run

This skill includes scripts that your agent may run. Read them before you use it.

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Security Audit
CloudflareOfficial
A structured, source-first security audit and vulnerability research framework for codebases and services.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskHas scriptsGitHub stars of the source repository65.3k
Sast Configuration
Seth Hobson· Community
Configure and optimize Static Application Security Testing (SAST) tools like Semgrep, SonarQube, and CodeQL for automated vulnerability detection.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k
Firmware Analyst
Seth Hobson· Community
An expert firmware analyst providing structured guidance for embedded systems security, reverse engineering, and vulnerability research.
SecurityClaude Code
MITLow riskGitHub stars of the source repository42.3k
Policy Enforcer
Seth Hobson· Community
Expert guide for authoring and auditing Cedar authorization policies to secure Claude Code agent tool interactions.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Backend Development Security Auditor
Seth Hobson· Community
A specialized security auditor for identifying vulnerabilities in backend code and architecture during feature development.
SecurityClaude Code
MITGitHub stars of the source repository42.3k
Memory Forensics
Seth Hobson· Community
Master memory forensics and incident response using the Volatility framework and industry-standard acquisition tools.
SecurityClaude CodeClaude appsOpenAI Codex+14 more
MITLow riskGitHub stars of the source repository42.3k