CVE Triager

What this skill does

Reads a project's lockfile, fetches advisories from the GitHub Advisory Database, and triages each CVE by reachability — does the application actually call into the vulnerable function or path? Output is a prioritized list grouped by reachable / unreachable.

Inputs

• lockfile_path: package-lock.json, yarn.lock, or similar.
• repo_dir: source root for the import-graph analysis.
• language: node (others supported as the ecosystem matures).
• GITHUB_TOKEN env var for advisory queries.

Steps

1. Run npm audit --json > /tmp/audit.json to seed the CVE list with package + version + advisory ID.
2. For each advisory, fetch the GitHub Advisory record: gh api graphql -f query='{ securityAdvisory(ghsaId:"GHSA-...") { references { url } vulnerabilities { firstPatchedVersion { identifier } package { ecosystem name } } } }'.
3. From the advisory references, fetch the upstream patch commit (often a GitHub PR or commit URL). Identify the affected exported function names by git show <commit> --stat and git diff extraction.
4. Build the application's import graph: for Node, run madge --json src plus madge --json for any binaries.
5. Determine if the application imports the affected package (direct dep). If only a transitive dep, walk the dep graph: npm ls <pkg> to confirm a path.
6. Determine reachability: does the code import any module path that contains the affected function names? Use rg -nN '<funcname>\b' node_modules/<pkg>/dist/* to inspect the package's exports surface, then rg -nN '<funcname>\b' src/ to see if userland calls it.
7. Classify each CVE: reachable (function imported and called), import-only (imported, not called), unreachable (transitive dep never imported).
8. Re-rank by (reachable, CVSS) desc.
9. Suggest fixes: bump to firstPatchedVersion, switch to a maintained fork, or add a workaround for the reachable function.
10. Emit a markdown report.

Output

cve-triage.md with three sections (Reachable, Import-only, Unreachable), each row showing CVE ID, package@version, fix version, CVSS, reachability evidence (sample file:line). Plus cve-triage.json for tracking. Exit 1 if any reachable critical CVE remains.

Verification

For three reachable findings, manually trace the call site to confirm the path is real (not dead code). For two unreachable findings, run npm ls <pkg> and confirm the dependency exists only behind dev-only or peer-only paths. After applying a fix bump, rerun the triager and confirm the CVE drops out of the lockfile.

Edge cases

• Bundled dependencies (esbuild / webpack outputs): import-graph tools may miss them; treat bundled-included as reachable conservatively.
• CVEs without a clear patched version (still open): list under a no-fix-available heading and propose mitigations.
• Mono-package with multiple lockfiles: triage each separately; aggregate at the end.
• Reachability heuristic missing dynamic imports (require(name) with computed name): tag those packages as unverifiable-reachability.