Cra Vulnerability Obligations

Use when a user asks what the EU Cyber Resilience Act (CRA) means for their product, whether and when they must report a vulnerability or incident, or what a specific CVE triggers legally. Maps a product with digital elements to CRA scope, product classification, Annex I vulnerability-handling duties, and Article 14 reporting obligations — every legal claim cited from official regulation text fetched live through the Ansvar Gateway MCP connector, joined with live CVE / CISA-KEV / EPSS vulnerability intelligence from the same connector.

Security

Install

skills CLI (Claude Code, Cursor, Codex and more)

npx skills add Ansvar-Systems/cra-vulnerability-obligations-skill --skill cra-vulnerability-obligations

Manual install

git clone --depth 1 https://github.com/Ansvar-Systems/cra-vulnerability-obligations-skill.git /tmp/cra-vulnerability-obligations-skill
mkdir -p ~/.claude/skills
cp -r /tmp/cra-vulnerability-obligations-skill/. ~/.claude/skills/cra-vulnerability-obligations

Personal skills live in ~/.claude/skills. Use .claude/skills in a project folder to share a skill with your team.

From the SKILL.md

# CRA Vulnerability & Reporting Obligations

Given a product and, optionally, a concrete vulnerability, produce a cited
obligations assessment under the EU Cyber Resilience Act (Regulation (EU)
2024/2847): whether the product is in scope, its classification, the standing
vulnerability-handling duties for the user's role, which reporting duties
fire and on what timeline, and which neighbouring regimes (NIS2, GDPR, DORA)
may be engaged at the entity level. Vulnerability facts (known exploitation,
exploit-prediction score, public exploits) come from live CVE intelligence.
Legal conclusions come only from fetched official text.

## Requirements

- The **Ansvar Gateway** MCP connector must be connected:
  `https://gateway.ansvar.eu/mcp` (OAuth 2.1 with Dynamic Client Registration;
  free plan signup at https://ansvar.eu). Works in Claude, ChatGPT, Copilot,
  and any MCP-capable agent.
- Tools this skill uses: `search`, `get_provision`, `get_cve_details`,
  `check_kev_status`, `get_epss_score`, `search_cve`, `get_exploits`,
  `get_my_capabilities`. All of them are available on every plan, including
  Free (Free has lower quotas and scopes each search to one jurisdiction or
  framework per call).
- If these tools are not available, stop and tell the user to connect the
  gateway. Do not answer from model knowledge.

## Ground rules (non-negotiable)

1. **Answer only from tool results.** If the fetched rows do not contain the

Read the full skill on GitHub

Details

Skill name: cra-vulnerability-obligations
Repository: Ansvar-Systems/cra-vulnerability-obligations-skill
Repo updated: 19 July 2026
Listed in: karanb192/awesome-claude-skills

FAQ

What does the Cra Vulnerability Obligations skill do?

How do I install the Cra Vulnerability Obligations skill?

skills CLI (Claude Code, Cursor, Codex and more): npx skills add Ansvar-Systems/cra-vulnerability-obligations-skill --skill cra-vulnerability-obligations. Skills go in ~/.claude/skills (personal) or .claude/skills (project), and Claude loads them automatically when a task matches the description.

Related skills

Requirement Zero

Chisanan232/requirement-zero

Challenge whether a requirement deserves to exist before planning or implementing it. Use when a request asks to build, add, or design something and its necessity or scope has not been established — new features, abstractions, plugin systems, dashboards, configurability, migrations, or "we should probably support X". Reaches an explicit verdict: DELETE, REDUCE, DEFER, BUILD, or BUILD HARD. Do not use for already-validated work, bug fixes, or explicit safety, security, legal, or compliance requirements.

SecurityIn 1 list

Awesome Bug Bounty

YangTech-gh/Awesome-Bug-Bounty

Use when doing bug bounty hunting, vulnerability research, security report writing/analysis, payload or WAF-bypass selection, business logic / IDOR / race / API testing, recon methodology, tool choice (Burp vs Caido vs ZAP, AI pentest agents, MCP security testing, headless browsers), or looking up writeups/programs — e.g. "find XSS payload", "business logic checklist", "SSRF bypass", "HackerOne top reports", "bug bounty methodology", "which tools to install". Merges curated knowledge with source-repo fallbacks; authorized testing only.

SecurityIn 1 list

Analyzing Dependencies

jeremylongshore/claude-code-plugins-plus-skills

This skill analyzes project dependencies for security vulnerabilities, outdated packages, and license compliance issues. It helps identify potential risks in your project's dependencies using the dependency-checker plugin. Use this skill when you need to check dependencies for vulnerabilities, identify outdated packages that need updates, or ensure license compatibility. Trigger phrases include "check dependencies", "dependency check", "find vulnerabilities", "scan for outdated packages", "/depcheck", and "license compliance". This skill supports npm, pip, composer, gem, and go modules project

Security

Regulatory Threat Model

Ansvar-Systems/regulatory-threat-model-skill

Use when an application or system — including one built quickly with AI coding agents — needs a security review with regulatory grounding: a STRIDE threat model, a LINDDUN privacy threat model, a dependency exposure screen against live CVE / CISA-KEV / EPSS data, or a selected, non-exhaustive screen of which EU security obligations (GDPR, NIS2, Cyber Resilience Act, AI Act) may apply and which need determination. Orchestrates the server-enforced threat-modeling workflows of the Ansvar Gateway MCP connector and grounds every regulatory statement in officially published text fetched at answer ti

SecurityIn 1 list

Analyzing Security Headers

jeremylongshore/claude-code-plugins-plus-skills

This skill analyzes HTTP security headers of a given domain to identify potential vulnerabilities and misconfigurations. It provides a detailed report with a grade, score, and recommendations for improvement. Use this skill when the user asks to "analyze security headers", "check HTTP security", "scan for security vulnerabilities", or requests a "security audit" of a website. It will automatically activate when security-related keywords are used in conjunction with domain names or URLs.

Security

Incident Reporting Navigator

Ansvar-Systems/incident-reporting-navigator-skill

Use when a security incident, data breach, or actively exploited vulnerability raises the question "who must we notify, where, and by when?" Screens one incident across the EU reporting regimes — NIS2, GDPR, DORA, and the Cyber Resilience Act — determines which duties fire for each involved entity's roles, resolves the receiving authority per regime and member state from served national law, and produces a deadline table in which every duty, authority, and deadline is cited from official publisher text fetched live through the Ansvar Gateway MCP connector. Never answers from model memory.

SecurityIn 1 list

Browse the most popular Claude skills, all security skills, or write your own with the skills generator.