cve-triage

name	cve-triage
description	CVE triage workflow for vulnerability analysis, reproduction assessment, and patch verification
scope	core
user-invocable	false

CVE Triage Skill

A structured workflow for triaging CVE reports against a codebase. Coordinates security analysis, reproduction assessment, and patch verification.

Triage Phases

Phase 1: CVE Intake

• Parse CVE identifier and advisory details
• Identify affected component, version range, and CWE classification
• Determine if codebase uses the affected component

Phase 2: Impact Assessment

• Locate affected code paths via grep/CodeQL
• Assess exploitability in the project's specific context
• Determine severity (CRITICAL/HIGH/MEDIUM/LOW/NONE)
• Check if existing mitigations reduce impact

Phase 3: Reproduction Analysis

• Design minimal reproduction scenario
• Identify prerequisites (configuration, network access, authentication)
• Assess if reproduction is feasible in test environment

Phase 4: Remediation

• Identify available patches or versions
• Assess upgrade compatibility and breaking changes
• Propose mitigation if patch unavailable
• Generate remediation plan with effort estimate

Output Format

## CVE Triage Report: {CVE-ID}

### Summary
| Field | Value |
|-------|-------|
| CVE | {CVE-ID} |
| CWE | {CWE-ID}: {description} |
| CVSS | {score} ({severity}) |
| Affected | {component} {version range} |
| Project Impact | {CRITICAL/HIGH/MEDIUM/LOW/NONE} |

### Analysis
{Detailed analysis of how CVE affects this codebase}

### Remediation
| Option | Effort | Risk |
|--------|--------|------|
| {option 1} | {effort} | {risk} |

### Action Items
- [ ] {item 1}
- [ ] {item 2}

Integration

• Uses sec-codeql-expert for code analysis when available
• Results feed into security documentation
• Can be triggered as part of /research security analysis

Agent Selection

Phase	Agent	Lane / Effort
CVE Intake	Explore	spark/low
Impact Assessment	sec-codeql-expert	frontier/medium
Reproduction	sec-codeql-expert	frontier/medium
Remediation	appropriate-expert	frontier/medium

Workflow

1. Receive CVE identifier or advisory
2. Phase 1: Parse and classify the vulnerability
3. Phase 2: Search codebase for affected components
4. Phase 3: Evaluate reproduction feasibility
5. Phase 4: Propose remediation with effort/risk tradeoffs
6. Generate triage report in standard format