2. I have not yet tested the functionality but I wonder what is the difference between skontar cvss calculator and ctxis cvss calclulator (the output seems to be pretty much the same so it seems to me like reinventing a wheel although I need to do some testing.
3. The asserts in skontar cvss are good however I would expect bit more informative. For example when raising test_exceptions there are only CVSS2MalformedError (and CVSS3MalformedError retrospectivelly). I would explain bit more detail. I know that the code is really short and can be easilly debugged but still I would prefer pinpointing the assert more accuratelly.