Cve Triage

---
name: cve-triage
description: CVE triage workflow for vulnerability analysis, reproduction assessment, and patch verification
scope: core
user-invocable: false
---

# CVE Triage Skill

A structured workflow for triaging CVE reports against a codebase. Coordinates security analysis, reproduction assessment, and patch verification.

## Triage Phases

### Phase 1: CVE Intake

- Parse CVE identifier and advisory details
- Identify affected component, version range, and CWE classification
- Determine if codebase uses the affected component

### Phase 2: Impact Assessment

- Locate affected code paths via grep/CodeQL
- Assess exploitability in the project's specific context
- Determine severity (CRITICAL/HIGH/MEDIUM/LOW/NONE)
- Check if existing mitigations reduce impact

### Phase 3: Reproduction Analysis

- Design minimal reproduction scenario
- Identify prerequisites (configuration, network access, authentication)
- Assess if reproduction is feasible in test environment

### Phase 4: Remediation

- Identify available patches or versions
- Assess upgrade compatibility and breaking changes
- Propose mitigation if patch unavailable
- Generate remediation plan with effort estimate

## Output Format

```markdown
## CVE Triage Report: {CVE-ID}

### Summary
| Field | Value |
|-------|-------|
| CVE | {CVE-ID} |
| CWE | {CWE-ID}: {description} |
| CVSS | {score} ({severity}) |
| Affected | {component} {version range} |
| Project Impact | {CRITICAL/HIGH/MEDIUM/LOW/NONE} |

### Analysis
{Detailed analysis of how CVE affects this codebase}

### Remediation
| Option | Effort | Risk |
|--------|--------|------|
| {option 1} | {effort} | {risk} |

### Action Items
- [ ] {item 1}
- [ ] {item 2}
```

## Integration

- Uses sec-codeql-expert for code analysis when available
- Results feed into security documentation
- Can be triggered as part of /research security analysis

## Agent Selection

| Phase | Agent | Model |
|-------|-------|-------|
| CVE Intake | Explore | haiku |
| Impact Assessment | sec-codeql-expert | sonnet |
| Reproduction | sec-codeql-expert | sonnet |
| Remediation | appropriate-expert | sonnet |

## Workflow

```
1. Receive CVE identifier or advisory
2. Phase 1: Parse and classify the vulnerability
3. Phase 2: Search codebase for affected components
4. Phase 3: Evaluate reproduction feasibility
5. Phase 4: Propose remediation with effort/risk tradeoffs
6. Generate triage report in standard format
```