# Cve Verify

> >-

- **Type:** Skill
- **Install:** `agentstack add skill-opendatahub-io-ai-helpers-cve-verify`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [opendatahub-io](https://agentstack.voostack.com/s/opendatahub-io)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [opendatahub-io](https://github.com/opendatahub-io)
- **Source:** https://github.com/opendatahub-io/ai-helpers/tree/main/helpers/skills/cve-verify
- **Website:** https://opendatahub-io.github.io/ai-helpers/

## Install

```sh
agentstack add skill-opendatahub-io-ai-helpers-cve-verify
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Skill: CVE Verify

After a fix is applied by `/cve-fix-apply`, verify the CVE is actually resolved
by scanning the compiled output. Source-level scans can give false negatives
when transitive dependencies override the fixed version at build time.

## Step 1: Run the verify script

Run `scripts/verify.sh` which builds the binary (Go) or regenerates lockfiles
(Node.js) and re-scans for the CVE:

```bash
bash scripts/verify.sh "${REPO_DIR}" "${CVE_ID}" "${LANG}" "${TARGET_GO_VERSION:-}" "${BUILD_LOCATION:-.}"
```

The script:
- For Go: builds the binary and runs `govulncheck -mode binary` (gold standard).
  Falls back to source scan if build fails.
- For Node.js: regenerates lockfile and runs `npm audit`
- For Python: re-runs `pip-audit`
- Writes structured result to `autofix-output/cve-verify-result.json`

## Step 2: Interpret the result

Read `autofix-output/cve-verify-result.json` and evaluate the `verdict` field.

| Verdict | Meaning |
|---------|---------|
| `fixed` | CVE no longer detected — safe to create PR |
| `still_present` | CVE still detected after fix — do NOT create PR |
| `scan_failed` | Verification scan could not run — manual review needed |

Use judgment for edge cases:
- If `still_present`: the fix was insufficient. This can happen with transitive
  dependency conflicts, Go replace directives overriding the fix, or lockfile
  conflicts. Do NOT create a PR — add a Jira comment explaining the fix was
  attempted but CVE persists, manual investigation is required.
- If `scan_failed`: check the `scan_output_summary` for the root cause. If the
  build failed due to the fix itself (e.g., incompatible version), the fix
  approach may need to change.

## Caller contract

The orchestrator reads `verdict`:
- `fixed` → push branch, create PR
- `still_present` → do NOT create PR, add Jira comment explaining fix was insufficient
- `scan_failed` → skip with documentation, manual review needed

## Gotchas

- Binary scan is the gold standard for Go; source scan can miss transitive dependency overrides that re-introduce the vulnerable version at build time
- A `still_present` verdict means do NOT create a PR — post a Jira comment instead explaining the fix was attempted but the CVE persists
- SCAN_TIMEOUT defaults to 300s; set it higher for repos with many main packages or slow build times

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [opendatahub-io](https://github.com/opendatahub-io)
- **Source:** [opendatahub-io/ai-helpers](https://github.com/opendatahub-io/ai-helpers)
- **License:** Apache-2.0
- **Homepage:** https://opendatahub-io.github.io/ai-helpers/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-opendatahub-io-ai-helpers-cve-verify
- Seller: https://agentstack.voostack.com/s/opendatahub-io
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.