Orbit Cve Check

---
name: orbit-cve-check
description: Live CVE feed correlation + plugin ownership-transfer detection — fetches NVD, Patchstack, and WPScan public feeds AT RUNTIME (not from cron). Cross-references against the plugin's PHP signatures. Reports pattern matches with the live feed timestamp. Use when the user says "CVE check", "live security feed", "is my plugin affected by today's CVEs", "ownership transfer", or as part of /orbit-do-it.
---

# 🪐 orbit-cve-check — Live CVE feed correlation

> **Runtime-evergreen.** Every invocation fetches the current security feeds. The plugin's findings cite the exact feed timestamp.

---

## Runtime — fetch live before auditing (DO THIS FIRST)

When this skill is invoked:

1. **Fetch in parallel** (5 sources, parallel WebFetch):
   - https://services.nvd.nist.gov/rest/json/cves/2.0/?resultsPerPage=100&pubStartDate=<7-days-ago>&keywordSearch=wordpress → NVD WordPress CVEs, last 7 days
   - https://patchstack.com/database/?type=wordpress → Patchstack public DB, current
   - https://wpscan.com/wordpresses → WPScan public feed
   - https://www.cve.org/CVERecord/SearchResults?query=wordpress → MITRE CVE search
   - https://github.com/advisories?query=type%3Areviewed+ecosystem%3Acomposer+wordpress → GitHub Advisory DB

2. **Normalise** — extract from each feed:
   - CVE ID
   - Affected pattern (regex on PHP code)
   - Severity (CVSS score)
   - First-disclosed date
   - Public PoC URL (if any)
   - Affected plugin name (where matched)

3. **De-duplicate** across sources — same CVE often appears in multiple feeds.

4. **Cross-reference** the plugin's source code against every pattern.

5. **Report** with citation — `Per NVD CVE-2026-XXXXX (fetched 2026-04-30 14:32 UTC, severity 9.8): pattern matched at includes/class-search.php:142.`

If any feed fetch fails, log + continue with the rest. If ALL fail, fall back to embedded patterns + warn user that audit is degraded.

---

## What gets matched

The fetched feeds return CVE patterns Orbit converts into PHP-source regex matchers:

| Class | Example pattern |
|---|---|
| SQL injection | `\$wpdb->query\s*\(\s*['"][^'"]*\$_(?:GET|POST|REQUEST)` |
| Reflected XSS | `echo\s+\$_(?:GET|POST|REQUEST)` |
| Missing nonce on state-changing | `add_action\s*\(\s*['"]wp_ajax_` without `check_ajax_referer` in same function |
| Auth bypass | `permission_callback['"]?\s*=>\s*['"]__return_true` for write endpoints |
| Path traversal | `file_get_contents\s*\(\s*\$_(?:GET|POST)` |
| Object injection | `unserialize\s*\(\s*\$_(?:GET|POST|COOKIE)` |
| SSRF | `wp_remote_get\s*\(\s*\$_(?:GET|POST)` |
| Arbitrary upload | `move_uploaded_file` without `wp_check_filetype` |

Pattern catalog grows as new CVE classes appear in the feeds — the skill discovers new patterns dynamically rather than hardcoding the list.

---

## Ownership-transfer detection

Pattern unique to Orbit (first-in-ecosystem). Detects the April 2026 attack class:

1. Fetch wordpress.org plugin owner field (current)
2. Compare against the plugin's last commit author + plugin header `Author:`
3. Look for git-history events:
   - Sudden author change with no transition commit
   - Code-style shift (Allman → K&R, `_` → camelCase)
   - Newly-introduced obfuscated code (eval, base64_decode chains)
   - New external domains in network calls
   - License header removed/changed

Risk score 0-10. ≥ 5 = recommend pinning previous version + manual review.

---

## Output

```markdown
# CVE Check — my-plugin · 2026-04-30 14:32 UTC

## Sources fetched (parallel)
- NVD: 23 new WP CVEs in last 7 days
- Patchstack: 47 in last 30 days
- WPScan: 12 newly indexed
- GitHub Advisory: 8 new
- MITRE: cross-referenced

After de-dup: 67 unique CVE patterns checked.

## Matches in your code: 1 Critical, 0 High, 2 Medium

### Critical: SQL injection match
**CVE:** CVE-2026-XXXXX (CVSS 9.8) — disclosed 2026-04-28
**Source:** Per NVD (fetched 2026-04-30 14:32 UTC)
**Pattern:** $wpdb->query without prepare on $_POST input
**Found:** includes/class-search.php:142
**Public PoC:** https://wpscan.com/vulnerability/...
**Action:** patch within 24h. See $wpdb->prepare() pattern.

[Medium 1, Medium 2 ...]

## Ownership transfer audit
- ✓ wordpress.org owner unchanged
- ✓ Author URL unchanged
- ✓ No code-style shift in last 90 days
- ✓ No obfuscated code introduced
- Risk score: 0/10 ✓
```

---

## Schedule (recommended)

```cron
# Daily at 9am — full feed pull + audit, mail summary
0 9 * * * cd ~/plugins/my-plugin && \
  claude "/orbit-cve-check" | mail -s "Daily CVE check — my-plugin" me@example.com
```

Runtime-evergreen means daily runs always reflect the current feeds; no manual list-update.

---

## Pair with

- `/orbit-wp-security` — proactive (find vulns by code review)
- `/orbit-broken-access-control` — top class (57% per Patchstack)
- `/orbit-vdp` — disclose responsibly when vuln found
- `/orbit-premium-audit` — premium plugins are 76% exploitable

---

## Smoke test

Input: a WP plugin with one obvious `$wpdb->query("SELECT * FROM x WHERE id = $_GET[id]")`.
Expected:
- ≥ 1 Critical SQLi match
- Cites a CVE pattern from the live NVD/Patchstack/WPScan fetch with today's timestamp
- 0 ownership-transfer alerts (test plugin has no transfer history)

---

## Embedded fallback patterns (offline mode)

Pattern catalog kept embedded for the 8 classes listed in the table above. Under offline mode the skill warns the user that the audit reflects only the embedded catalog, not today's feeds.

## Sources & Evergreen References

### Live sources (fetched on every run)
- [NVD JSON API](https://nvd.nist.gov/developers/vulnerabilities) — official US gov feed
- [Patchstack DB](https://patchstack.com/database/) — WP-specific
- [WPScan public feed](https://wpscan.com/wordpresses) — community-curated
- [GitHub Advisory DB](https://github.com/advisories) — cross-ecosystem
- [MITRE CVE](https://www.cve.org/) — root CVE registry

### Last reviewed
2026-04-30 — runtime-evergreen, every invocation re-fetches