Menu
Audit and remediate security vulnerabilities in a frontend package (JS deps + Dockerfile OS packages) using yarn audit, trivy, and grype.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | fix-ui-cves |
| description | Audit and remediate security vulnerabilities in a frontend package (JS deps + Dockerfile OS packages) using yarn audit, trivy, and grype. |
All scripts are at .claude/skills/fix-ui-cves/scripts/.
Before starting, create a todo list with these items:
Mark each item complete as you finish it.
>=safe-version for resolutions unless a peer dep cap is needed.yarn.lock or package-lock.json directly. All changes must go through package.json (deps, devDeps, or resolutions) followed by $PKG_MANAGER install to regenerate the lockfile.apk add --upgrade / apt-get install --upgrade for specific packages only if no updated image tag resolves the CVE. Never use blanket apk upgrade.# Output: "<UI_DIR> yarn|npm" — abort if output is "0"
bash .claude/skills/fix-ui-cves/scripts/find-ui-dir.sh
Capture UI_DIR and PKG_MANAGER from the output.
# Output: 1=ok, 0=wrong version and could not switch — abort if 0
bash .claude/skills/fix-ui-cves/scripts/ensure-node.sh
# Installs/updates trivy and grype, updates grype DB. Output: 1|0 — abort if 0
bash .claude/skills/fix-ui-cves/scripts/ensure-scanners.sh
# Runs yarn/npm audit, trivy, and grype in parallel. Returns labeled findings from all three.
bash .claude/skills/fix-ui-cves/scripts/scan.sh <UI_DIR> <PKG_MANAGER>
Consolidate the findings into a deduplicated list of vulnerable packages + CVE IDs. If none → report clean and stop.
For each CVE, try in order:
a. Direct upgrade — bump in package.json deps/devDeps, run $PKG_MANAGER install.
b. Resolution — if transitive, add to resolutions:
"resolutions": { "pkg": ">=safe-version" }
Check peer dep ranges first — if any dep caps the major, add a <next-major cap. Run $PKG_MANAGER install and watch for new peer dep warnings.
bash .claude/skills/fix-ui-cves/scripts/scan.sh <UI_DIR> <PKG_MANAGER>
If issues remain, repeat step 4 with a different approach.
# Output: one Dockerfile path per line, or "0" if none found.
bash .claude/skills/fix-ui-cves/scripts/find-ui-dockerfile.sh
For each Dockerfile found, scan its base image:
# Scans the runtime base image for OS package CVEs using trivy and grype in parallel.
bash .claude/skills/fix-ui-cves/scripts/scan-dockerfile.sh <DOCKERFILE>
Consolidate OS CVE findings per Dockerfile. If none → skip to step 9.
For each CVE, identify the vulnerable OS package and fix in order of preference:
a. Update base image tag — check if a newer patch tag of the base image exists that includes the fix (e.g., nginx:1.27.3-alpine → nginx:1.27.4-alpine). Use docker pull or check the registry to confirm the tag exists, then update the FROM line. Re-scan after updating to verify the CVE is resolved before moving on.
b. Upgrade specific package — if no updated image tag resolves the CVE, add or update an apk add --upgrade (Alpine) or apt-get install --upgrade (Debian/Ubuntu) line in the runtime stage, after the FROM:
RUN apk add --no-cache --upgrade <vulnerable-package>
Prefer upgrading only the affected package rather than a blanket apk upgrade.
Package not installed? Enterprise scanners (Wiz, Snyk) often flag CVEs for packages available in the Alpine package index even if the package is not explicitly installed in the image — they attribute vulnerabilities to the OS layer, not just installed packages. If a CVE references a package that apk info <pkg> shows is not installed, still add the apk add --no-cache --upgrade <pkg> line. This pins the package to a safe version so it is fixed if ever pulled in as a transitive dependency, and satisfies scanners that inspect the Alpine package index.
Rules:
FROM line that is NOT AS builder or similar build-only alias).bash .claude/skills/fix-ui-cves/scripts/scan-dockerfile.sh <DOCKERFILE>
If the CVE still appears, verify the upgraded package version satisfies the fix version and retry step 7.
Re-run both the JS and Dockerfile scans one final time:
bash .claude/skills/fix-ui-cves/scripts/scan.sh <UI_DIR> <PKG_MANAGER>
bash .claude/skills/fix-ui-cves/scripts/scan-dockerfile.sh <DOCKERFILE> # if Dockerfiles exist
Evaluate the results:
[FAILED] scan did not pass — <CVE IDs and packages still vulnerable> and stop (do not proceed to PR).After upgrading a suite package (storybook, eslint, babel, jest), check sibling packages for mismatched peer deps. Upgrade siblings to match, or update import paths if the suite consolidated APIs into the root package.
For each resolution added: remove it, run $PKG_MANAGER install, check the lockfile. If the safe version still resolves naturally, leave it removed — otherwise restore.
# Output: 1=passed, 0=failed
bash .claude/skills/fix-ui-cves/scripts/build.sh <UI_DIR> <PKG_MANAGER>
# Output: 1=passed, 0=failed
bash .claude/skills/fix-ui-cves/scripts/verify.sh <UI_DIR> <PKG_MANAGER>
Starts whichever of start or dev exists in package.json, waits 20s to confirm the process doesn't crash, then kills it. If neither script exists, the check is skipped.
List: direct upgrades, resolutions added/removed, peer dep changes, Dockerfile OS package changes, scanner results. Include any CVEs skipped due to no fix being available.