Vulnerability Scanner

Vulnerability Scanner

CVE research, system package auditing, and container image vulnerability scanning. Uses web search for CVE lookups and local tools for package/image analysis.

Quick Start

Quick CVE Check for a Specific Software

1. Identify the software and version
2. Web search: "[software name] [version] CVE site:nvd.nist.gov OR site:github.com/advisories"
3. Assess: Is the target version affected?
4. Report: Severity, affected versions, fix version, remediation steps

---

CVE Web Search Workflow

Step 1: Identify Software Versions

Gather current versions of monitored software:

# Docker
docker --version
docker compose version

# System packages (Arch Linux)
pacman -Q 

# Pi-hole (via SSH or API)
# Check ../workspace-devops/MEMORY.md for known version

# Gitea (via web UI or API)
curl -s http://:3000/api/v1/version

Step 2: Search for CVEs

Use web search with targeted queries:

| Software | Search Query | |---|---| | Pi-hole | "Pi-hole" CVE 2025 2026 vulnerability | | Gitea | "Gitea" CVE 2025 2026 security advisory | | Docker | "Docker Engine" CVE 29.2 vulnerability | | Ollama | "Ollama" CVE vulnerability security | | OpenClaw | "OpenClaw" CVE vulnerability security |

Useful sources:

• NVD: site:nvd.nist.gov
• GitHub Advisories: site:github.com/advisories
• MITRE: site:cve.mitre.org
• Vendor security pages (e.g., blog.gitea.com/security)

Step 3: Assess Impact

For each CVE found:

| Field | Description | |---|---| | CVE ID | e.g., CVE-2026-XXXXX | | CVSS Score | 0.0 - 10.0 | | Severity | Critical / High / Medium / Low | | Affected versions | Which versions are vulnerable | | Target version | What is running | | Exploitability | Is there a public exploit? | | Impact | What can an attacker do? | | Fix version | Which version patches this? | | Mitigation | Workaround if upgrade isn't immediate |

Step 4: Report

Update MEMORY.md:

• Add to Known Vulnerabilities table if affected
• Update CVE Watch List with last check date
• Log in Audit History

---

System Package Audit (Arch Linux)

Using arch-audit

# Install if not present
sudo pacman -S arch-audit

# Check for vulnerable packages
arch-audit

# Show only critical/high
arch-audit --upgradable

# JSON output for parsing
arch-audit --format json

Manual Package Check

# List all installed packages with versions
pacman -Q

# Check for orphaned packages (potential attack surface)
pacman -Qdt

# Check for packages not in official repos
pacman -Qm

# Check for outdated packages
checkupdates

Evaluate Findings

| Severity | Action | |---|---| | Critical CVE with public exploit | Update immediately: sudo pacman -Syu | | High CVE, no public exploit | Plan update within 24h | | Medium CVE | Include in next maintenance window | | Low CVE | Document, update when convenient |

---

Docker Image Scanning

Using Trivy (Recommended)

# Install trivy
sudo pacman -S trivy  # Arch
# or
docker run --rm aquasec/trivy image 

# Scan a specific image
trivy image :

# Scan with severity filter
trivy image --severity CRITICAL,HIGH :

# Scan all running container images
docker ps --format '{{.Image}}' | sort -u | while read img; do
    echo "=== Scanning: $img ==="
    trivy image --severity CRITICAL,HIGH "$img"
done

# JSON output
trivy image --format json --output scan-results.json 

Using Grype (Alternative)

# Install grype
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

# Scan an image
grype :

# Only critical and high
grype : --only-fixed --fail-on critical

Evaluate Image Findings

For each vulnerable image:

1. Check if the vulnerability is in a dependency we actually use
2. Check if a fixed version of the base image exists
3. If fixable: update the image and redeploy
4. If not fixable: assess risk and document as accepted risk

---

Scan Report Format

When delivering vulnerability scan results:

# Vulnerability Scan Report

**Date:** YYYY-MM-DD
**Scope:** [What was scanned]
**Scanner:** [web search / arch-audit / trivy / grype]

## Summary

| Severity | Count |
|---|---|
| Critical | X |
| High | X |
| Medium | X |
| Low | X |

## Critical Findings

### CVE-YYYY-XXXXX: [Brief Description]

- **Severity:** Critical (CVSS 9.8)
- **Affected:** [software] [version]
- **Our version:** [version]
- **Status:** Vulnerable / Not affected / Patched
- **Fix:** Upgrade to [version]
- **Reference:** [NVD link]

## Recommendations

1. [Prioritized list of actions]

## Next Scan

Scheduled: [date or trigger condition]

---

CVE Watch List Management

Maintain the watch list in MEMORY.md:

1. Add new software when it's deployed to the infrastructure
2. Update versions when software is upgraded
3. Record check dates after each CVE lookup
4. Remove software when it's decommissioned

Recommended Check Frequency

| Software | Frequency | Reason | |---|---|---| | Internet-facing services | Weekly | Highest exposure | | LAN services (Gitea, Pi-hole) | Bi-weekly | Lower exposure but valuable targets | | Docker Engine | Monthly | Core infrastructure | | System packages | Monthly | arch-audit covers this | | Development dependencies | Per-release | cargo audit, npm audit |

---

Zero skill — Vulnerability scanning and CVE monitoring

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: Firstp1ck
• Source: Firstp1ck/pi-coding-agent-forge
• License: MIT

Install and usage instructions live in the source repository linked above.