kesekit-fix

name	kesekit-fix
description	Auto-fix security vulnerabilities found in CII, AI, robot, space, and supply chain systems. Generates hardening scripts and SBOM-based vulnerability remediation. Use when "fix vulnerabilities", "apply hardening", "server hardening", "AI security fix", "robot security fix", "space security fix", "satellite hardening", "GSaaS hardening", "supply chain fix", "SBOM fix", "공급망 수정", "취약점 조치".

KESE Vulnerability Auto-Fix

Generate and apply fixes based on vulnerability assessment results. Auto-selects guideline.

Guideline Selection

#	Guideline	Description
1	CII Hardening	Platform-specific hardening scripts
2	AI Security Fixes	AI system security hardening
3	Robot Security Fixes	Robot system hardening (IEC 62443, CRA, RED)
4	Space Security Fixes	Space system hardening (CMMC, K-RMF, NIS2, NIST IR 8401)
5	Secure Coding Fixes	Auto-fix vulnerable code patterns (JS/Python, 46 CWE)
6	Zero Trust Fixes	Zero Trust gap remediation (8 elements, 4 maturity levels, ~396 items)
7	SW Supply Chain Fixes	SBOM generation, vulnerability scanning, remediation (29 items)

Zero Trust, ZTA, ZTNA, 제로트러스트, 마이크로세그멘테이션, microsegmentation, SDP, SASE, PEP/PDP, never trust always verify → Zero Trust SBOM, supply chain, 공급망, C-SCRM, SCA, CycloneDX, SPDX, npm audit, pip-audit → SW Supply Chain

CII Branch

Load reference from templates/cii/ → generate hardening scripts saved to scripts/kese-hardening/. Check commands available in scripts/cii/ directory.

AI Security Branch

Load from references/ai-security/ for overview and guidance, and templates/ai-security/ for assessment checklists → generate security hardening code for AI pipelines, model security, API protection, LLM guardrails.

Robot Security Branch

Load from templates/robot-security/ → generate robot security remediation guidance for secure development, supply chain controls, IEC 62443 controls, cyber resilience planning, and wireless security.

Space Security Branch

Load from references/space-security/ for overview and supply chain guidance, and templates/space-security/ for assessment checklists → generate space system hardening guidance. Fix scripts in scripts/space-security/access-control-fix.md, scripts/space-security/system-security-fix.md, scripts/space-security/operations-fix.md.

Secure Coding Branch

Load from references/secure-coding/pseudocode.md for UNSAFE→SAFE pattern pairs. Use templates/secure-coding/javascript.md or templates/secure-coding/python.md for framework-specific fixes. Each item provides the exact code transformation (UNSAFE → SAFE) to apply.

---

Zero Trust Branch

Load from references/zero-trust/ for maturity model and architecture, and templates/zero-trust/ for element-specific checklists. Generate remediation guidance based on gap analysis between current and target maturity levels. If OT/ICS detected, also load templates/zero-trust/ot-environment.md and references/zero-trust/ot-guide.md.

Topic	Reference File
Overview	templates/zero-trust/overview.md
Identity & Device	templates/zero-trust/identity-device.md
Network & System	templates/zero-trust/network-system.md
Application & Data	templates/zero-trust/app-data.md
Visibility & Automation	templates/zero-trust/visibility-automation.md
OT/ICS Environment	templates/zero-trust/ot-environment.md
ZT Architecture Reference	references/zero-trust/overview.md
Maturity Model Details	references/zero-trust/maturity-model.md
OT Deployment Guide	references/zero-trust/ot-guide.md

8 core elements, ~396 items across 4 maturity levels. Standards: KISA ZT Guideline 2.0, NIST SP 800-207, CISA ZT Maturity Model.

---

SW Supply Chain Branch

Load from references/supply-chain/overview.md for C-SCRM/SBOM context. Use scripts/supply-chain/sbom-generate.md for SBOM generation commands (Syft, CycloneDX, language-specific tools). Use scripts/supply-chain/sbom-vuln-scan.md for vulnerability scanning (Grype, npm audit, pip-audit, govulncheck) and license compliance checks. Reference templates/supply-chain/sbom-checklist.md for the 29-item remediation checklist.

Fix workflow: Generate SBOM → Scan vulnerabilities → Prioritize by CVSS → Apply patches → Verify → Update SBOM.

---

Notes

• Always backup before applying fixes
• Test in non-production first
• Document all changes for compliance audit