菜单
Use this skill to verify that a CVE fix actually resolved the vulnerability by scanning the compiled binary or updated manifests. Catches transitive dep overrides, replace directives, and lockfile conflicts. Writes result to autofix-output/cve-verify-result.json.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | cve-verify |
| description | Use this skill to verify that a CVE fix actually resolved the vulnerability by scanning the compiled binary or updated manifests. Catches transitive dep overrides, replace directives, and lockfile conflicts. Writes result to autofix-output/cve-verify-result.json. |
| allowed-tools | Bash Read Write |
| context | fork |
| model | sonnet |
After a fix is applied by /cve-fix-apply, verify the CVE is actually resolved
by scanning the compiled output. Source-level scans can give false negatives
when transitive dependencies override the fixed version at build time.
Run scripts/verify.sh which builds the binary (Go) or regenerates lockfiles
(Node.js) and re-scans for the CVE:
bash scripts/verify.sh "${REPO_DIR}" "${CVE_ID}" "${LANG}" "${TARGET_GO_VERSION:-}" "${BUILD_LOCATION:-.}"
The script:
govulncheck -mode binary (gold standard).
Falls back to source scan if build fails.npm auditpip-auditautofix-output/cve-verify-result.jsonRead autofix-output/cve-verify-result.json and evaluate the verdict field.
| Verdict | Meaning |
|---|---|
fixed | CVE no longer detected — safe to create PR |
still_present | CVE still detected after fix — do NOT create PR |
scan_failed | Verification scan could not run — manual review needed |
Use judgment for edge cases:
still_present: the fix was insufficient. This can happen with transitive
dependency conflicts, Go replace directives overriding the fix, or lockfile
conflicts. Do NOT create a PR — add a Jira comment explaining the fix was
attempted but CVE persists, manual investigation is required.scan_failed: check the scan_output_summary for the root cause. If the
build failed due to the fix itself (e.g., incompatible version), the fix
approach may need to change.The orchestrator reads verdict:
fixed → push branch, create PRstill_present → do NOT create PR, add Jira comment explaining fix was insufficientscan_failed → skip with documentation, manual review neededstill_present verdict means do NOT create a PR — post a Jira comment instead explaining the fix was attempted but the CVE persistsCheck an ODH module operator repository for contract violations against the platform onboarding guide. Validates PlatformObject status, CRD structure, Helm chart content, webhook ownership, metadata conventions, and reconciler chain ordering. Use during code review or after scaffolding a new module.
Read existing in-tree ODH operator component code and produce a step-by-step extraction checklist for migrating it to a standalone module. Analyzes controller logic, webhooks, RBAC, embedded manifests, and DSC field mappings. Use when extracting a component from the monolithic operator into its own module repo.
Given a component name, generate a complete standalone ODH module operator repository. Produces Go module, CRD types implementing PlatformObject, controller skeleton with reconciler builder pattern, Helm chart, Makefile, CI config, singleton webhook, and AGENTS.md. Use when starting a new module from scratch.
Generate AIPCC Commits style commit messages or summarize existing commits
Hello world plugin implementation
Generate comprehensive sprint summaries by analyzing JIRA sprint data, including issue breakdown, progress metrics, and team performance insights.