resolve-cve
Triage a CVE: assess impact against this repo's dependencies, then bump, document not-affected, or plan a code fix. Use when the user mentions a CVE, Jira vulnerability issue, or security advisory for a dependency.
ソース情報
- リポジトリ
- openshift/lightspeed-agentic-sandbox
- ソースの最終更新活動
- 2026年5月19日 11:24
- 検出された SKILL.md の言語
- 英語
- スター
- 5
- フォーク
- 23
インストール方法
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
ソースファイルを確認
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
SKILL.md を表示中
SKILL.md
ソースの指示 · 読み取り専用プレビュー- name
- resolve-cve
- description
- Triage a CVE: assess impact against this repo's dependencies, then bump, document not-affected, or plan a code fix. Use when the user mentions a CVE, Jira vulnerability issue, or security advisory for a dependency.
# resolve-cve
Use this skill for **lightspeed-agentic-sandbox**. Workflow matches the
Lightspeed Service skill, but Jira filters and verification targets are adjusted.
## Finding issues (Jira)
If the user gives a Jira key or URL, use that issue directly.
If they ask what to triage, search your org's vulnerability backlog. **Do not**
assume the same `summary ~` filter as `lightspeed-service-api-rhel9`. For this
Konflux component, issues may reference:
- Component name: `lightspeed-agentic-sandbox` (see `.tekton/*.yaml`)
- Repository: `openshift/lightspeed-agentic-sandbox`
Build a JQL filter with your project admin's pattern, e.g.:
```
project = <PROJECT> AND type = Vulnerability AND statusCategory = "To Do"
AND (summary ~ "lightspeed-agentic-sandbox" OR summary ~ "openshift/lightspeed-agentic-sandbox")
ORDER BY priority DESC
```
If no project access, ask the user for the Jira key or paste the flaw text.
## Step 1: Read the issue
Parse CVE ID, affected package, version range, and fix reference from the
issue body (same approach as the upstream skill).
## Step 2: Assess impact
1. Search `pyproject.toml` and `uv.lock` for the package (case-insensitive).
2. Compare installed version to the advisory range.
3. Check whether vulnerable APIs are used in `src/lightspeed_agentic/`.
4. Trace transitive deps in `uv.lock` if needed.
## Step 3: Present assessment
Use the same verdict template as the upstream skill (**NOT AFFECTED** /
**bump** / **code change**). **Stop for user acknowledgment** before resolving.
## Step 4: Resolve
- **Not affected:** Jira comment + transition per team policy (same structure
as upstream skill).
- **Dependency bump:** follow **deps-update** with `uv lock --upgrade-package
{package}`, then `make requirements`, `make verify`, `make test`.
- **Code fix:** rare; minimal change + tests; run `make verify && make test`.
Commit message examples:
```
fix: resolve CVE-YYYY-NNNNN — bump {package} to {version}
```
## Constraints
- User acknowledgment before acting on the verdict.
- Prefer targeted `--upgrade-package` over full `--upgrade` for CVE PRs.
- Run `make verify` and `make test` before declaring done.
GitHubで見る