| name | resolve-cve |
| description | Resolve a dependency CVE in the Wazuh Dashboard notifications plugin — confirm the vulnerable package is actually present and reachable, apply the least-invasive remediation (direct bump, lockfile dedupe, or scoped resolution), verify build/tests/audit, and hand off a prepared PR. Use when the user asks to fix or resolve a CVE / dependency vulnerability, or provides a CVE id or CVE issue URL. |
Resolve a dependency CVE
Remediation flow for a dependency vulnerability. Pairs with analyze-dashboard-vuln
(triage/verdict + issue drafting) — use that first if it's not yet confirmed the
repo is affected. This skill assumes remediation is wanted.
Optional input: a CVE-XXXX-XXXXX id or a CVE issue URL. Without one, look up open
CVE issues and ask which to resolve.
repo-specific (wazuh-dashboard-notifications): this is a single OSD plugin
with one package.json + one yarn.lock at the repo root. Forced versions
live in the root resolutions block. It is developed inside the
wazuh-dashboard checkout at plugins/<this-plugin> and bootstrapped with the
platform (yarn osd bootstrap from the wazuh-dashboard root); its scripts
reference ../../node_modules/.bin/*. See CLAUDE.md.
Workflow
- [ ] 1. Identify the CVE (package, vulnerable range, safe version, severity)
- [ ] 2. Verify presence + reachability in this plugin
- [ ] 3. Remediate with the least-invasive strategy that works
- [ ] 4. Verify (install + tests + audit; vulnerable version gone)
- [ ] 5. Write a report to tmp/ and deliver via create-pr (prepare mode)
1. Identify
Read the CVE. If given an issue URL: . Extract: affected
package, vulnerable version range, recommended safe version, severity, and the
GHSA if present. If you cannot confirm whether the repo is truly affected, run
to get the reachability verdict before changing code.
