vulnerability-check

name	vulnerability-check
description	CB - Scan dependencies for known vulnerabilities (OSV, GitHub, CISA KEV, NCSC)
user-invocable	true

You are a vulnerability scanning assistant. Check project dependencies for known security vulnerabilities using the scripts in .claude/helpers/vulnerability-check/.

Arguments: $ARGUMENTS

Available Scripts

All scripts output JSON. Run them with uv run --project .claude/helpers/vulnerability-check python .claude/helpers/vulnerability-check/<script> [args].

Script	Purpose	Usage
query_osv.py	Query OSV.dev	query_osv.py <package> <ecosystem> [version]
query_github.py	GitHub Advisory DB	query_github.py --keyword TEXT --ecosystem TEXT --severity TEXT --cve TEXT --limit N
query_ncsc.py	NCSC.nl advisories	query_ncsc.py --severity N (0=unknown,1=low,2=high) --keyword TEXT --limit N
query_cisa.py	CISA KEV catalog	query_cisa.py --keyword TEXT --cve TEXT --vendor TEXT --product TEXT --limit N
scan_deps.py	Scan dependency file	scan_deps.py <file_path> [--max-per-pkg N]
native_audit.py	Run ecosystem-native audit tool	native_audit.py <file_path>

Ecosystems: npm, PyPI, Go, crates.io, Maven, RubyGems

Instructions

If arguments look like a CVE ID (e.g. CVE-2024-1234):

1. Run query_cisa.py --cve <CVE> to check if actively exploited
2. Run query_github.py --cve <CVE> for advisory details
3. Present consolidated findings

If arguments look like a package name (e.g. "lodash", "requests"):

1. Run query_osv.py <package> <ecosystem> — guess ecosystem from name, default to npm
2. Run query_github.py --keyword <package> for additional context
3. Present all findings

If arguments are a file path:

1. Run native_audit.py <path> first
   • If "status": "skipped" — note tool unavailable, continue
   • If "status": "completed" — collect vulnerabilities
2. Run scan_deps.py <path>
3. Present combined results, noting source (native tool vs OSV)

If NO arguments — full project scan:

1. Find dependency files: package.json, requirements.txt, pyproject.toml, go.mod, Cargo.toml, Gemfile.lock, pom.xml
2. For each file, run native audit first: native_audit.py <file_path>
   • If "status": "skipped" — note tool unavailable, continue
   • If "status": "completed" — collect vulnerabilities
3. Run scan_deps.py on each file (existing OSV scan)
4. Cross-reference all CVE IDs from steps 2+3 against CISA KEV: query_cisa.py --cve <CVE>
5. Present consolidated summary, noting source (native tool vs OSV)

Output Format

## Vulnerability Scan Results

**Files scanned**: [list]
**Total dependencies**: [count]
**Vulnerable packages**: [count]

### Critical / Actively Exploited
[CISA KEV matches — immediate attention needed]

### Findings by Package
[Package-by-package breakdown: severity, CVE IDs, fix versions]

### Native Audit Results
[Per-tool status: completed (with vuln count) or skipped (with install hint)]
- npm audit: ✅ 3 vulnerabilities found / ⏭️ skipped (npm not installed)
- pip-audit: ✅ 0 vulnerabilities / ⏭️ skipped (install: pip install pip-audit)

### Recommendations
[Prioritized upgrade actions]

Record Completion

After presenting the report, record this health check so the team session knows when it was last run:

1. Get the current HEAD commit hash: run git rev-parse HEAD
2. Get the current health_checks document via MCP: get_document(type="health_checks")
   • If it doesn't exist yet, start with an empty JSON object {}
3. Update the vulnerability_check key with the current commit, timestamp, and a one-line summary of findings
4. Save via MCP: update_document(type="health_checks", content=<updated JSON>)