# Vulnerability Scanner

> Agents should invoke this skill when checking CVEs or known vulnerabilities in installed packages, dependencies, Docker images, OS packages, exposed services, or software versions. Produces severity-rated scan reports.

- **Type:** Skill
- **Install:** `agentstack add skill-firstp1ck-pi-coding-agent-forge-vulnerability-scanner`
- **Verified:** Pending review
- **Seller:** [Firstp1ck](https://agentstack.voostack.com/s/firstp1ck)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Firstp1ck](https://github.com/Firstp1ck)
- **Source:** https://github.com/Firstp1ck/pi-coding-agent-forge/tree/main/pi-skill-vulnerability-scanner/skills/vulnerability-scanner

## Install

```sh
agentstack add skill-firstp1ck-pi-coding-agent-forge-vulnerability-scanner
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Vulnerability Scanner

CVE research, system package auditing, and container image vulnerability scanning. Uses web search for CVE lookups and local tools for package/image analysis.

## Quick Start

### Quick CVE Check for a Specific Software

1. Identify the software and version
2. Web search: `"[software name] [version] CVE site:nvd.nist.gov OR site:github.com/advisories"`
3. Assess: Is the target version affected?
4. Report: Severity, affected versions, fix version, remediation steps

---

## CVE Web Search Workflow

### Step 1: Identify Software Versions

Gather current versions of monitored software:

```bash
# Docker
docker --version
docker compose version

# System packages (Arch Linux)
pacman -Q 

# Pi-hole (via SSH or API)
# Check ../workspace-devops/MEMORY.md for known version

# Gitea (via web UI or API)
curl -s http://:3000/api/v1/version
```

### Step 2: Search for CVEs

Use web search with targeted queries:

| Software | Search Query |
|---|---|
| Pi-hole | `"Pi-hole" CVE 2025 2026 vulnerability` |
| Gitea | `"Gitea" CVE 2025 2026 security advisory` |
| Docker | `"Docker Engine" CVE 29.2 vulnerability` |
| Ollama | `"Ollama" CVE vulnerability security` |
| OpenClaw | `"OpenClaw" CVE vulnerability security` |

**Useful sources:**
- NVD: `site:nvd.nist.gov`
- GitHub Advisories: `site:github.com/advisories`
- MITRE: `site:cve.mitre.org`
- Vendor security pages (e.g., `blog.gitea.com/security`)

### Step 3: Assess Impact

For each CVE found:

| Field | Description |
|---|---|
| CVE ID | e.g., CVE-2026-XXXXX |
| CVSS Score | 0.0 - 10.0 |
| Severity | Critical / High / Medium / Low |
| Affected versions | Which versions are vulnerable |
| Target version | What is running |
| Exploitability | Is there a public exploit? |
| Impact | What can an attacker do? |
| Fix version | Which version patches this? |
| Mitigation | Workaround if upgrade isn't immediate |

### Step 4: Report

Update `MEMORY.md`:
- Add to Known Vulnerabilities table if affected
- Update CVE Watch List with last check date
- Log in Audit History

---

## System Package Audit (Arch Linux)

### Using arch-audit

```bash
# Install if not present
sudo pacman -S arch-audit

# Check for vulnerable packages
arch-audit

# Show only critical/high
arch-audit --upgradable

# JSON output for parsing
arch-audit --format json
```

### Manual Package Check

```bash
# List all installed packages with versions
pacman -Q

# Check for orphaned packages (potential attack surface)
pacman -Qdt

# Check for packages not in official repos
pacman -Qm

# Check for outdated packages
checkupdates
```

### Evaluate Findings

| Severity | Action |
|---|---|
| Critical CVE with public exploit | Update immediately: `sudo pacman -Syu` |
| High CVE, no public exploit | Plan update within 24h |
| Medium CVE | Include in next maintenance window |
| Low CVE | Document, update when convenient |

---

## Docker Image Scanning

### Using Trivy (Recommended)

```bash
# Install trivy
sudo pacman -S trivy  # Arch
# or
docker run --rm aquasec/trivy image 

# Scan a specific image
trivy image :

# Scan with severity filter
trivy image --severity CRITICAL,HIGH :

# Scan all running container images
docker ps --format '{{.Image}}' | sort -u | while read img; do
    echo "=== Scanning: $img ==="
    trivy image --severity CRITICAL,HIGH "$img"
done

# JSON output
trivy image --format json --output scan-results.json 
```

### Using Grype (Alternative)

```bash
# Install grype
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

# Scan an image
grype :

# Only critical and high
grype : --only-fixed --fail-on critical
```

### Evaluate Image Findings

For each vulnerable image:

1. Check if the vulnerability is in a dependency we actually use
2. Check if a fixed version of the base image exists
3. If fixable: update the image and redeploy
4. If not fixable: assess risk and document as accepted risk

---

## Scan Report Format

When delivering vulnerability scan results:

```markdown
# Vulnerability Scan Report

**Date:** YYYY-MM-DD
**Scope:** [What was scanned]
**Scanner:** [web search / arch-audit / trivy / grype]

## Summary

| Severity | Count |
|---|---|
| Critical | X |
| High | X |
| Medium | X |
| Low | X |

## Critical Findings

### CVE-YYYY-XXXXX: [Brief Description]

- **Severity:** Critical (CVSS 9.8)
- **Affected:** [software] [version]
- **Our version:** [version]
- **Status:** Vulnerable / Not affected / Patched
- **Fix:** Upgrade to [version]
- **Reference:** [NVD link]

## Recommendations

1. [Prioritized list of actions]

## Next Scan

Scheduled: [date or trigger condition]
```

---

## CVE Watch List Management

Maintain the watch list in `MEMORY.md`:

1. **Add new software** when it's deployed to the infrastructure
2. **Update versions** when software is upgraded
3. **Record check dates** after each CVE lookup
4. **Remove software** when it's decommissioned

### Recommended Check Frequency

| Software | Frequency | Reason |
|---|---|---|
| Internet-facing services | Weekly | Highest exposure |
| LAN services (Gitea, Pi-hole) | Bi-weekly | Lower exposure but valuable targets |
| Docker Engine | Monthly | Core infrastructure |
| System packages | Monthly | `arch-audit` covers this |
| Development dependencies | Per-release | `cargo audit`, `npm audit` |

---

_Zero skill — Vulnerability scanning and CVE monitoring_

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Firstp1ck](https://github.com/Firstp1ck)
- **Source:** [Firstp1ck/pi-coding-agent-forge](https://github.com/Firstp1ck/pi-coding-agent-forge)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-firstp1ck-pi-coding-agent-forge-vulnerability-scanner
- Seller: https://agentstack.voostack.com/s/firstp1ck
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.