How this started
A customer asked for an OWASP AIVSS-SSVC calculator. Previously, when we built the CVSS, DREAD, and MITRE ATT&CK calculators, we had to manually type custom code. But in this brave new world of Claude Code, I wanted to see if I (not a developer) could build a functional calculator without involving the product team until it was ready for review.
TL;DR: it worked, and I created a Claude Code skill so you can start from my lessons learned instead of learning them the hard way.
I started by cloning all the existing calculators (CVSS, DREAD, and MITRE ATT&CK) into one folder, along with Dradis CE. With Claude, we walked through a version of the Create a Custom Upload Add-on process, but for a custom calculator.
Note: all generated calculators can be installed on Dradis Pro as well; it’s just endlessly easier to do development work on a lightweight/local CE instance.
The dradis-calculator_aivss-ssvc add-on is public, and it is now part of the open-source Dradis CE and will ship in the next version of Dradis Pro.
The code that shipped isn’t the same code I handed to my product team. In fact, the code review on that calculator collected twenty comments. Most of them were about Dradis conventions that every calculator add-on must follow. Those lessons were worth keeping for the next calculator.
I asked Claude to turn those lessons into a reusable skill. We then put the skill through our own product review and added the feedback. The result is the new /dradis-core:calculator skill, now available in dradis/dradis-claude.
What is this?
A new skill in the dradis-core plugin for Claude Code. It sits beside the methodology, html-theme, and kit skills. If you are new to Dradis skills, the Dradis skills for Claude Code post explains the basics.
You give the skill one reference to a scoring model. This can be a reference calculator, a JavaScript library, or a published specification. The skill then produces:
-
A dradis-calculator_* add-on that works on the Tools page and on each issue. The add-on is checked against the source you provided.
-
Instructions to install and test that add-on on a Dradis CE instance.
The add-ons work in both Dradis CE and Dradis Pro. The skill doesn’t need a copy of the Dradis source code, and it doesn’t change it.
The skill works from stated defaults instead of asking you a list of questions. It stops to ask only in a few specific cases, listed below.
How it works
The skill treats a calculator as a port, not a new design. Someone else owns the scoring model. The add-on is correct only if it produces the same numbers and results as the source for every input.
The skill follows five steps:
-
Classify the source. This decides whether to copy the owner’s code into the add-on or rewrite the logic. For example, the Dradis CVSS calculator uses FIRST’s own code. This step also decides how strongly the result can be verified.
-
Classify the model’s shape. This decides the user interface. Supported shapes are discrete metrics, numeric scales, taxonomies, lookup tables, and models with several versions.
-
Design the output fields. Kits and report templates read calculator fields by name, so the skill treats them as a public interface.
-
Build the add-on. Copy the standard files from the AIVSS-SSVC calculator, updating the names and version. This keeps new add-ons consistent with the existing ones.
-
Verify, lint, and hand over. The skill checks the port in a test harness and lints it with the Dradis CE .rubocop.yml rules. It then writes the install and test steps for Dradis CE.
The verification level depends on what the source provides:
| Level | What the source provides | How the port is checked |
|---|---|---|
| 1 | A reference implementation you can run | A differential test against the reference |
| 2 | Published test vectors | The published vectors |
| 3 | Neither | Test cases derived by hand |
The final report states the skill level reached. It also lists the lint result, the defaults it used, and the Dradis CE install and test steps. The test steps include one known case with its expected score.
The report also states clearly that the add-on has not run inside Dradis yet. That final check is yours, using the steps it provides.
When the skill stops to ask
The skill stops and asks you only in these cases:
-
The calculator name does not convert cleanly to a Ruby module name and back.
-
The source code license isn’t clear enough to copy into the add-on.
-
The source is ambiguous.
-
The model is out of scope.
Two kinds of models are out of scope: decision trees and models with no published source.
Getting started
1. Install or update the dradis-core plugin
If you have not installed it yet, follow the steps in the Dradis skills for Claude Code post. If you already have it, make sure it’s up to date. Then check that /dradis-core:calculator appears in your list of skills.
2. Run the skill
Give it a link to the scoring model and a name for the calculator:
/dradis-core:calculator <link to the scoring model> <calculator-name>
For example, to build a calculator for the OWASP Risk Rating Methodology:
/dradis-core:calculator owasp-risk-rating
The skill creates a dradis-calculator_<name>/ folder beside your current directory.
3. Install and test the add-on
Follow the Dradis CE steps in the skill’s report. You add the gem to Gemfile.plugins, run the checks, and then test the calculator on the Tools page and on an issue. Use the known case in the report to confirm that both places give the expected score.
Questions and feedback
What calculator(s) should we work on next? Have you built your own custom calculator for Dradis?
Questions, ideas, and feedback are welcome below.