# Cve Scan

> >-

- **Type:** Skill
- **Install:** `agentstack add skill-opendatahub-io-ai-helpers-cve-scan`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [opendatahub-io](https://agentstack.voostack.com/s/opendatahub-io)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [opendatahub-io](https://github.com/opendatahub-io)
- **Source:** https://github.com/opendatahub-io/ai-helpers/tree/main/helpers/skills/cve-scan
- **Website:** https://opendatahub-io.github.io/ai-helpers/

## Install

```sh
agentstack add skill-opendatahub-io-ai-helpers-cve-scan
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Skill: CVE Scan

Scan a cloned repository to determine whether a specific CVE is present as an
unfixed vulnerability. Uses language-appropriate scanning tools with
version-matched toolchains for accurate results.

## Step 1: Run the scan script

Run `scripts/scan.sh` which handles language detection, version-matched
toolchain selection, vulnerability scanning, package version checks, and
base image detection:

```bash
bash scripts/scan.sh "${REPO_DIR}" "${CVE_ID}" "${PACKAGE}" "${BUILD_LOCATION:-.}"
```

The script:
- Detects project language from manifest files (go.mod, package.json, requirements.txt)
- For Go: extracts the target Go version from go.mod and runs govulncheck with
  `GOTOOLCHAIN` set to that exact version, preventing false negatives from a
  newer local toolchain. Falls back to local toolchain if download fails.
- For Node.js: runs `npm audit --json`
- For Python: runs `pip-audit -r requirements.txt`
- If the CVE is not found in the scan, checks package manifests directly
- If the package is not in any manifest, checks Dockerfile base images
- Writes structured result to `autofix-output/cve-scan-result.json`

## Step 2: Interpret the scan result

Read `autofix-output/cve-scan-result.json` and evaluate the `verdict` field.

| Verdict | Meaning |
|---------|---------|
| `present` | CVE confirmed in scan — fix needed |
| `present_by_version` | Package in manifest at vulnerable version — fix needed |
| `absent` | Not in scan, not in manifests — VEX justification possible |
| `in_base_image` | Package not in app code, found in Dockerfile base image |
| `informational` | Go: module present but vulnerable symbol not called |
| `scan_failed` | Scanner could not run — manual review needed |

Use judgment to validate the verdict:
- If `present_by_version`: compare the manifest version against the CVE's
  affected version range to confirm it is actually vulnerable
- If `in_base_image`: determine whether a newer base image tag is available
  using `skopeo list-tags`, or whether the base image team needs to act
- If `scan_failed`: check the `scan_output_summary` for the root cause and
  decide whether to retry or skip

## Caller contract

The orchestrator (`jira-autofix-cve-resolve`) reads `autofix-output/cve-scan-result.json`
and routes based on `verdict`:
- `present` / `present_by_version` → invoke `/cve-fix-apply`
- `absent` / `informational` → invoke `/cve-vex-assess`
- `in_base_image` → check for newer base image tag, create PR or document
- `scan_failed` → skip with documentation

## Gotchas

- govulncheck is not installed in all environments; the script falls back to version-based detection when it is unavailable
- GOTOOLCHAIN requires a full patch version (e.g., `go1.25.0`, not `go1.25`); omitting the patch segment causes the download to fail silently
- Exit code 3 from govulncheck means "vulnerabilities found" (a successful scan), not a failure — do not treat it as an error

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [opendatahub-io](https://github.com/opendatahub-io)
- **Source:** [opendatahub-io/ai-helpers](https://github.com/opendatahub-io/ai-helpers)
- **License:** Apache-2.0
- **Homepage:** https://opendatahub-io.github.io/ai-helpers/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-opendatahub-io-ai-helpers-cve-scan
- Seller: https://agentstack.voostack.com/s/opendatahub-io
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.