baekenough/cve-triage

CVE Triage Skill

A structured workflow for triaging CVE reports against a codebase. Coordinates security analysis, reproduction assessment, and patch verification.

Triage Phases

Phase 1: CVE Intake

• Parse CVE identifier and advisory details
• Identify affected component, version range, and CWE classification
• Determine if codebase uses the affected component

Phase 2: Impact Assessment

• Locate affected code paths via grep/CodeQL
• Assess exploitability in the project's specific context
• Determine severity (CRITICAL/HIGH/MEDIUM/LOW/NONE)
• Check if existing mitigations reduce impact

Phase 3: Reproduction Analysis

• Design minimal reproduction scenario
• Identify prerequisites (configuration, network access, authentication)
• Assess if reproduction is feasible in test environment

Phase 4: Remediation

• Identify available patches or versions
• Assess upgrade compatibility and breaking changes
• Propose mitigation if patch unavailable
• Generate remediation plan with effort estimate

Output Format

## CVE Triage Report: {CVE-ID}

### Summary
| Field | Value |
|-------|-------|
| CVE | {CVE-ID} |
| CWE | {CWE-ID}: {description} |
| CVSS | {score} ({severity}) |
| Affected | {component} {version range} |
| Project Impact | {CRITICAL/HIGH/MEDIUM/LOW/NONE} |

### Analysis
{Detailed analysis of how CVE affects this codebase}

### Remediation
| Option | Effort | Risk |
|--------|--------|------|
| {option 1} | {effort} | {risk} |

### Action Items
- [ ] {item 1}
- [ ] {item 2}

Integration

• Uses sec-codeql-expert for code analysis when available
• Results feed into security documentation
• Can be triggered as part of /research security analysis

Agent Selection

| Phase | Agent | Model | |-------|-------|-------| | CVE Intake | Explore | haiku | | Impact Assessment | sec-codeql-expert | sonnet | | Reproduction | sec-codeql-expert | sonnet | | Remediation | appropriate-expert | sonnet |

Workflow

1. Receive CVE identifier or advisory
2. Phase 1: Parse and classify the vulnerability
3. Phase 2: Search codebase for affected components
4. Phase 3: Evaluate reproduction feasibility
5. Phase 4: Propose remediation with effort/risk tradeoffs
6. Generate triage report in standard format