Analyze Cve

What it does

When your agent uses it

• The user gives a CVE ID (CVE-YYYY-NNNNN)
• A Jira ticket (--jira=)
• A JQL query (--jql=) for Go CVE triage
• Wants call-graph proof that a vulnerable function is reachable

Example prompts

• “analyze CVE”
• “CVE impact”
• “is this repo affected by CVE”
• “/analyze-cve”

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

1. 1Autonomous Mode — the full AUTO_APPROVE decision table (what's gated vs. what always hard-fails)
2. 2Security — Credential Handling — rules that apply to every command this skill runs
3. 3Runtime Configuration — AI_HELPERS_WORKSPACE, FORK_ORG
4. 4Implementation — Phase 0 (setup) through Phase 6 (PR creation), including the Repo Guard and each sub-skill's input/output contract
5. 5Return Value — the report format this skill produces

What it can do on your machine

Read from SKILL.md and the folder at commit a627176. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • go
  • claude
  • brew
  • apt-get
  • gh

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Hosts in commands or code, which the agent is likely to contact:

  • github.com

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Analyze Cve loads about 2k tokens when it runs, and up to ~12k if it reads all its reference files. Until then it costs about 206 tokens; SKILL.md has 736 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~206

When it runs · the whole SKILL.md, loaded when a task matches

~2k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~12k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteRuns commands with sudoSKILL.md:101

  generation (`brew install graphviz` or `sudo apt-get install graphviz`)

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from openshift-eng/ai-helpers at commit a627176, republished under its Apache-2.0 licence (© openshift-eng). 736 words, ~2,006 tokens.

name

analyze-cve

description

Full Go CVE analysis workflow. Given a CVE identifier -- supplied directly, or resolved from a Jira ticket or JQL batch -- resolves and clones the affected repository, gathers vulnerability intelligence, analyzes codebase impact with govulncheck and call-graph reachability, generates a risk report, and optionally applies a fix and opens a GitHub pull request. Use when the user gives a CVE ID (CVE-YYYY-NNNNN), a Jira ticket (--jira=), or a JQL query (--jql=) for Go CVE triage; wants call-graph proof that a vulnerable function is reachable; or wants an automated fix and PR for a Go dependency vulnerability. Triggers on: 'analyze CVE', 'CVE impact', 'is this repo affected by CVE', 'Go vulnerability analysis', 'triage this Jira CVE ticket', 'fix this CVE and open a PR', or a bare CVE-YYYY-NNNNN identifier.

/compliance:analyze-cve <CVE-ID> [--repo=<url-or-component>] [--algo=vta|rta|cha|static] [--auto-approve=yes|no]
/compliance:analyze-cve --jira=<PROJ-NNN> [--repo=...] [--algo=...] [--auto-approve=yes|no]
/compliance:analyze-cve --jql="<JQL query>" [--repo=...] [--algo=...] [--auto-approve=yes|no]

# Install all required Go tools
go install golang.org/x/vuln/cmd/govulncheck@latest
go install golang.org/x/tools/cmd/callgraph@latest
go install golang.org/x/tools/cmd/digraph@latest

# git is also required (Phase 0.7 repository cloning) — install via your OS package manager

© openshift-eng, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file (references) in plugins/compliance/skills/analyze-cve of openshift-eng/ai-helpers.

• SKILL.md
• references/implementation.md

Open the folder on GitHubat commit a627176