cra-vulnerability-obligations
Use when a user asks what the EU Cyber Resilience Act (CRA) means for their product, whether and when they must report a vulnerability or incident, or what a specific CVE triggers legally. Maps a product with digital elements to CRA scope, product classification, Annex I vulnerability-handling duties, and Article 14 reporting obligations — every legal claim cited from official regulation text fetched live through the Ansvar Gateway MCP connector, joined with live CVE / CISA-KEV / EPSS vulnerability intelligence from the same connector.
npx skills add lawve-ai/awesome-legal-skills --skill cra-vulnerability-obligations-ansvar-ai --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# CRA Vulnerability & Reporting Obligations Given a product and, optionally, a concrete vulnerability, produce a cited obligations assessment under the EU Cyber Resilience Act (Regulation (EU) 2024/2847): whether the product is in scope, its classification, the standing vulnerability-handling duties for the user's role, which reporting duties fire and on what timeline, and which neighbouring regimes (NIS2, GDPR, DORA) may be engaged at the entity level. Vulnerability facts (known exploitation, exploit-prediction score, public exploits) come from live CVE intelligence. Legal conclusions come only from fetched official text. ## Requirements - The **Ansvar Gateway** MCP connector must be connected: `https://gateway.ansvar.eu/mcp` (OAuth 2.1 with Dynamic Client Registration; free plan signup at https://ansvar.eu). Works in Claude, ChatGPT, Copilot, and any MCP-capable agent. - Tools this skill uses: `search`, `get_provision`, `get_cve_details`, `check_kev_status`, `get_epss_score`, `search_cve`, `get_exploits`, `get_my_capabilities`. All of them are available on every plan, including Free (Free has lower quotas and scopes each search to one jurisdiction or framework per call). - If the
- Requirements
- Ground rules (non-negotiable)
- Workflow
- Step 1 — Intake
- Step 2 — Scope and classification
- Step 3 — Standing duties, branched by role
- Step 4 — Vulnerability facts (when a CVE is on the table)
- Step 5 — Reporting duties and deadlines
- Step 6 — Neighbouring regimes (entity-level screen)
- Step 7 — Output
- Verified call shapes
- Plan notes
What does the cra-vulnerability-obligations skill do?
Use when a user asks what the EU Cyber Resilience Act (CRA) means for their product, whether and when they must report a vulnerability or incident, or what a specific CVE triggers legally. Maps a product with digital elements to CRA scope, product classification, Annex I vulnerability-handling duties, and Article 14 reporting obligations — every legal claim cited from official regulation text fetched live through the Ansvar Gateway MCP connector, joined with live CVE / CISA-KEV / EPSS vulnerability intelligence from the same connector.
How do I install it?
Run `npx skills add lawve-ai/awesome-legal-skills --skill cra-vulnerability-obligations-ansvar-ai --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From lawve-ai/awesome-legal-skills, a repository with 618 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.