Deepsec Documentation Guide
vercel-labs/deepsec
Points the agent at deepsec's own docs to answer questions about initializing, configuring, resuming, scanning with and extending the vulnerability scanner.
Analyze CVE reachability against downstream repository forks at version-specific release branches
Install Analyze Cve Repos
$ npx skills add openshift-eng/ai-helpers --skill analyze-cve-repos -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install openshift-eng/ai-helpers analyze-cve-repos --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/openshift-eng/ai-helpers.git skills-src && mkdir -p .claude/skills && cp -r skills-src/plugins/node-cve/skills/analyze-cve-repos .claude/skills/analyze-cve-repos && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "analyze-cve-repos" agent skill from https://github.com/openshift-eng/ai-helpers/tree/main/plugins/node-cve/skills/analyze-cve-repos into .claude/skills/analyze-cve-repos/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "analyze-cve-repos", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/openshift-eng/ai-helpers/tree/main/plugins/node-cve/skills/analyze-cve-reposType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add openshift-eng/ai-helpers --skill analyze-cve-repos -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install openshift-eng/ai-helpers analyze-cve-repos --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/openshift-eng/ai-helpers.git skills-src && mkdir -p .agents/skills && cp -r skills-src/plugins/node-cve/skills/analyze-cve-repos .agents/skills/analyze-cve-repos && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "analyze-cve-repos" agent skill from https://github.com/openshift-eng/ai-helpers/tree/main/plugins/node-cve/skills/analyze-cve-repos into .agents/skills/analyze-cve-repos/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "analyze-cve-repos", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add openshift-eng/ai-helpers --skill analyze-cve-repos -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install openshift-eng/ai-helpers analyze-cve-repos --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/openshift-eng/ai-helpers.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/plugins/node-cve/skills/analyze-cve-repos .cursor/skills/analyze-cve-repos && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "analyze-cve-repos" agent skill from https://github.com/openshift-eng/ai-helpers/tree/main/plugins/node-cve/skills/analyze-cve-repos into .cursor/skills/analyze-cve-repos/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "analyze-cve-repos", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/openshift-eng/ai-helpers.git --path plugins/node-cve/skills/analyze-cve-repos--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add openshift-eng/ai-helpers --skill analyze-cve-repos -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install openshift-eng/ai-helpers analyze-cve-repos --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/openshift-eng/ai-helpers.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/plugins/node-cve/skills/analyze-cve-repos .gemini/skills/analyze-cve-repos && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "analyze-cve-repos" agent skill from https://github.com/openshift-eng/ai-helpers/tree/main/plugins/node-cve/skills/analyze-cve-repos into .gemini/skills/analyze-cve-repos/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "analyze-cve-repos", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install openshift-eng/ai-helpers analyze-cve-reposInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add openshift-eng/ai-helpers --skill analyze-cve-repos -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/openshift-eng/ai-helpers.git skills-src && mkdir -p .github/skills && cp -r skills-src/plugins/node-cve/skills/analyze-cve-repos .github/skills/analyze-cve-repos && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "analyze-cve-repos" agent skill from https://github.com/openshift-eng/ai-helpers/tree/main/plugins/node-cve/skills/analyze-cve-repos into .github/skills/analyze-cve-repos/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "analyze-cve-repos", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add openshift-eng/ai-helpers --skill analyze-cve-repos -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install openshift-eng/ai-helpers analyze-cve-repos --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/openshift-eng/ai-helpers.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/plugins/node-cve/skills/analyze-cve-repos .opencode/skills/analyze-cve-repos && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "analyze-cve-repos" agent skill from https://github.com/openshift-eng/ai-helpers/tree/main/plugins/node-cve/skills/analyze-cve-repos into .opencode/skills/analyze-cve-repos/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "analyze-cve-repos", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
analyze-cve-repos- GitHub stars
- 120
- Token cost
- ~2k tokens
- SKILL.md length
- 897 words
- Files
- 1
- Skills in repo
- 118
- Repo updated
- First seen
- Licence
- Apache-2.0
At a glance
Analyze CVE reachability against downstream repository forks at version-specific release branches
- Works in 7 steps: Map component to downstream repository… → Verify repository and branch → Gather CVE intelligence → …
- Tasks that involve Vulnerability scanning
- SKILL.md covers When to Use, Prerequisites, Implementation Steps and Return Value, plus 1 more section
- Reaches github.com
What it does
Analyze Cve Repos is an agent skill from openshift-eng/ai-helpers. Analyze CVE reachability against downstream repository forks at version-specific release branches
Its SKILL.md is about 2k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in Security, covering Vulnerability scanning. The repository describes itself as: Developer productivity tools for Claude Code & other AI assistants. The licence is Apache-2.0.
When your agent uses it
- Tasks that involve Vulnerability scanning
Example prompts
- “/analyze-cve-repos”
Workflow steps
7 steps, taken from the step headings in SKILL.md.
What it can do on your machine
Read from SKILL.md and the folder at commit a627176. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are bash and json).
From the folder's file list and the shell code blocks in SKILL.md.
Network
Hosts in commands or code, which the agent is likely to contact:
github.com
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Analyze Cve Repos loads about 2k tokens when it runs. Until then it costs about 29 tokens; SKILL.md has 897 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from openshift-eng/ai-helpers at commit a627176, republished under its Apache-2.0 licence (© openshift-eng). 897 words, ~2,043 tokens.
Download SKILL.mdSave it as
.claude/skills/analyze-cve-repos/SKILL.md (or your agent's skills folder).- name
- analyze-cve-repos
- description
- Analyze CVE reachability against downstream repository forks at version-specific release branches
When to Use
Use this skill when Phase 2 of the node-cve:triage command needs to determine whether a CVE's vulnerable code path is actually reachable in a Node team repository. Each CVE is analyzed against the release branch corresponding to the auto-detected latest OCP version (one agent per CVE). Analysis targets downstream forks only; if the downstream fork or branch is not found, the CVE is classified as Uncertain.
Prerequisites
- Repository already cloned to
.work/node-cve/repos/<repo-name>-<branch>/(the triage command clones all repos at the correct branch before spawning parallel analysis agents) - Network access to GitHub (for CVE data)
Implementation Steps
Step 1: Map component to downstream repository and branch
Analysis must target the release branch corresponding to the affected OpenShift version. The main branch may have newer dependencies or Go versions that mask vulnerabilities present in shipped releases. Analysis must target downstream forks only. If the downstream fork or branch does not exist, classify as Uncertain with note "downstream fork/branch not found" and skip analysis.
Component to repository mapping: Read the component-to-repo table and pscomponent: label mappings from the node-team shared components reference.
Version mapping: Read from the node-team shared version map. For OCP 4.Y, the formula is K8s/CRI-O minor = Y + 13. Use the formula and branch naming conventions to derive the correct release branch for each repo.
If the component does not map to a known repo, classify as Uncertain and skip analysis. If the downstream fork or release branch does not exist, classify as Uncertain with note "downstream fork/branch not found" and skip analysis.
Step 2: Verify repository and branch
The repository should already be cloned at the correct branch to .work/node-cve/repos/<repo-name>-<branch>/ by the triage command before this skill runs. Verify the directory exists and the checked-out branch matches the expected release branch. If the repo directory does not exist, classify as Uncertain and skip analysis.
Step 3: Gather CVE intelligence
Fetch vulnerability details to understand what to look for in the source code:
- Extract the CVE ID from the Jira issue summary.
- Search for vulnerability details from public sources:
- Search the web for the CVE ID to find advisories, affected packages, vulnerable functions, and fixed versions
- Check the Jira issue description and comments for additional context (affected package, vulnerable API, attack vector)
- Build a vulnerability profile:
- Affected package/library: the specific dependency or stdlib package (e.g.,
golang.org/x/net/html,crypto/x509,capnproto.org/go/capnp) - Vulnerable functions/methods: specific API surface that triggers the vulnerability (e.g.,
html.Parse,x509.ParseCertificate) - Attack vector: how the vulnerability is exploited (e.g., malicious input, crafted certificate, oversized allocation)
- Fixed version: version where the fix was applied
- Affected package/library: the specific dependency or stdlib package (e.g.,
If vulnerability details cannot be determined, classify as Uncertain with note "insufficient CVE details available".
Step 4: Check dependency presence
For Go repos, check if the vulnerable package is a dependency:
cd .work/node-cve/repos/<repo-name>-<branch>
grep -r "<affected-package>" go.mod go.sum vendor/modules.txt 2>/dev/nullFor Rust repos (conmon-rs), check Cargo.toml and Cargo.lock.
For C repos (conmon), check for the affected library in build files, vendored code, or linked libraries.
If the affected package is not present in the dependency tree, classify as Unaffected with high confidence. Continue to next CVE.
Show full SKILL.md (410 more words)Show less
Step 5: Analyze source code for reachability
This is the core analysis step. Read the repository source code to determine if the vulnerable code path is actually exercised.
Find imports/usage of the affected package:
bash grep -rn "import.*<affected-package>" .work/node-cve/repos/<repo-name>-<branch>/ --include="*.go" --include="*.rs" --include="*.c" --include="*.h" grep -rn "<vulnerable-function>" .work/node-cve/repos/<repo-name>-<branch>/ --include="*.go" --include="*.rs" --include="*.c" --include="*.h"Read the files that use the affected package. For each call site:
- Is the vulnerable function called directly?
- Is it called through a wrapper or interface?
- What data flows into the vulnerable function? Is it attacker-controlled (network input, user-supplied files, untrusted certificates) or internal/trusted?
Trace the call path from entry points (main, HTTP handlers, gRPC servers, CLI commands) to the vulnerable function. Determine if the path is reachable in normal operation.
Check for mitigating controls:
- Input validation or sanitization before the vulnerable function
- Size limits, timeouts, or rate limiting that prevent exploitation
- Feature flags or configuration that disable the vulnerable code path
- Network policies or authentication that restrict access to the attack vector
Assess exploitability in context:
- Is the vulnerable function exposed to untrusted input?
- Does the deployment context (OpenShift node, privileged container) increase or decrease risk?
- Are there compensating controls at the platform level?
Step 6: Classify result
Based on the source code analysis:
| Finding | Classification | Confidence |
|---|---|---|
| Vulnerable function called with attacker-controlled input, no mitigations | Reachable | High |
| Vulnerable function called, but input is partially validated | Reachable | Medium |
| Vulnerable function called, but only with trusted/internal data | Present but not exploitable | High |
| Package imported but vulnerable function not called | Present but not reachable | High |
| Package not in dependency tree | Unaffected | High |
| Repo too large to fully analyze, or CVE details insufficient | Uncertain | Low |
Step 7: Build evidence summary
Write a concise analysis for the report:
- Which files import/use the affected package (with file paths and line numbers)
- Whether the vulnerable function is called and from where
- The call path from entry point to vulnerable function (if reachable)
- What input reaches the vulnerable function and whether it's attacker-controlled
- Any mitigating controls found
- Recommended action (update dependency, apply patch, accept risk, investigate further)
Save the analysis to .work/node-cve/triage-$(date +%Y-%m-%d)/<CVE-ID>-<branch>-analysis.md.
Return Value
{
"skill": "analyze-cve-repos",
"cve_id": "CVE-2026-32281",
"repo": "https://github.com/openshift/cri-o",
"branch": "release-1.32",
"ocp_version": "4.19",
"classification": "REACHABLE",
"confidence": "HIGH",
"evidence": {
"affected_package": "crypto/x509",
"vulnerable_function": "x509.ParseCertificate",
"call_sites": [
"pkg/server/tls.go:42 - called from TLS handshake path",
"pkg/server/auth.go:118 - called during client cert validation"
],
"call_path": "main -> server.New -> setupTLS -> x509.ParseCertificate",
"input_source": "network (client TLS certificates, attacker-controlled)",
"mitigations": "none found",
"fixed_version": "go1.22.5"
},
"remediation_hint": "Update Go runtime to 1.22.5+. Vulnerable function processes untrusted client certificates during TLS handshake."
}Error Handling
- Clone failure: log warning, classify CVE as Uncertain, continue to next CVE
- CVE details unavailable: classify as Uncertain with note "could not determine affected package/function"
- Repo too large to fully trace call paths: focus on direct imports and obvious call sites, note incomplete analysis in evidence
- Permission errors: ensure the work directory is writable
© openshift-eng, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in plugins/node-cve/skills/analyze-cve-repos of openshift-eng/ai-helpers.
Open the folder on GitHubat commit a627176
Compare with similar skills
Analyze Cve Repos next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Analyze Cve Repos this skillopenshift-eng/ai-helpers | 120 | — | ~2k | Automated safety check: Pass | Apache-2.0 | |
| Deepsec Documentation Guidevercel-labs/deepsec | 8.1k | — | ~956 | Automated safety check: Pass | Apache-2.0 | |
| Shiro Attack CLISummerSec/ShiroAttack2 | 2.6k | — | ~945 | Automated safety check: Pass | MIT | |
| Cve Remediationrundeck/rundeck | 6.3k | — | ~2.9k | Automated safety check: Pass | Apache-2.0 | |
| Native Dependency Updatemono/SkiaSharp | 5.6k | — | ~4.1k | Automated safety check: Pass | MIT | |
| Forensifyalexgreensh/repo-forensics | 190 | — | ~2.5k | Automated safety check: Notes | Custom licence |
Similar skills
- Official
Shiro Attack CLI
SummerSec/ShiroAttack2
当用户要求利用、检测或测试 Apache Shiro rememberMe 反序列化漏洞 (Shiro-550, CVE-2016-4437) 时使用。触发词包括 "Shiro"、"rememberMe"、"shiro attack"、"CVE-2016-4437"、"Shiro-550"、"爆破 Shiro key"、"利用 Shiro"、"Shiro…
Cve Remediation
rundeck/rundeck
Verify if a CVE affects the project and remediate it. An agent skill from rundeck/rundeck.
Native Dependency Update
mono/SkiaSharp
Update native dependencies (libpng, libexpat, zlib, libwebp, harfbuzz, freetype, libjpeg-turbo, etc.) in SkiaSharp's Skia fork.
Forensify
alexgreensh/repo-forensics
Cross-agent self-inspection of your AI-agent stack. An agent skill from alexgreensh/repo-forensics.
Write Cve Rule
evdenis/cvehound
Write, debug, or validate a CVEhound detection rule (.cocci or .grep) for a Linux kernel CVE.
More from openshift-eng/ai-helpers
All 118 skills in this repoInvestigate CI Reliability
openshift-eng/ai-helpers
Find and independently validate actionable reliability defects across OpenShift release jobs and presubmits, then export portable issue handoffs.
Address Review PR
openshift-eng/ai-helpers
Fetch and address all PR review comments — categorize by priority, make code changes, post replies, and push.
Categorize Activity Types
openshift-eng/ai-helpers
Categorize Jira issues into Red Hat Sankey Activity Type categories using MCP Jira tools.
Has Review Work
openshift-eng/ai-helpers
Decide whether a GitHub PR has unanswered authorized review comments or new required CI failures worth a follow-up agent.
Must Gather Analyzer
openshift-eng/ai-helpers
Analyze OpenShift must-gather diagnostic data including cluster operators, pods, nodes, and network components.
Payload Autodl JSON
openshift-eng/ai-helpers
Schema for the autodl JSON data file produced by payload-analysis for database ingestion — you must use this skill whenever generating the autodl JSON file
Related
Categories
Questions about Analyze Cve Repos
What does Analyze Cve Repos do?
Analyze CVE reachability against downstream repository forks at version-specific release branches. Analyze Cve Repos is an agent skill from openshift-eng/ai-helpers.
When should I use Analyze Cve Repos?
Analyze Cve Repos fits situations like: tasks that involve Vulnerability scanning.
How do I install Analyze Cve Repos in Claude Code?
Run `npx skills add openshift-eng/ai-helpers --skill analyze-cve-repos -a claude-code`. Or copy the skill folder (plugins/node-cve/skills/analyze-cve-repos in openshift-eng/ai-helpers) into .claude/skills/analyze-cve-repos in your project. Claude Code loads it when a task matches its description.
How do I install Analyze Cve Repos in Codex?
Run `npx skills add openshift-eng/ai-helpers --skill analyze-cve-repos -a codex`. Or copy the skill folder (plugins/node-cve/skills/analyze-cve-repos in openshift-eng/ai-helpers) into .agents/skills/analyze-cve-repos in your project. Codex loads it when a task matches its description.
Can I use Analyze Cve Repos in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add openshift-eng/ai-helpers --skill analyze-cve-repos -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/analyze-cve-repos, .gemini/skills/analyze-cve-repos, .github/skills/analyze-cve-repos and .opencode/skills/analyze-cve-repos in your project.
What does Analyze Cve Repos need to run?
SKILL.md names no scripts, command-line tools or credentials: Analyze Cve Repos is instructions for the agent only.
Does Analyze Cve Repos access the network?
SKILL.md names 1 domain. In commands or code: github.com; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.
Is Analyze Cve Repos safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Analyze Cve Repos use?
Analyze Cve Repos is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Analyze Cve Repos use?
About 2k tokens (SKILL.md is roughly 8.2k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Analyze Cve Repos?
Skills that share tags, products or a category with Analyze Cve Repos: Deepsec Documentation Guide (vercel-labs/deepsec, 8.1k stars), Shiro Attack CLI (SummerSec/ShiroAttack2, 2.6k stars), Cve Remediation (rundeck/rundeck, 6.3k stars) and Native Dependency Update (mono/SkiaSharp, 5.6k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Analyze Cve Repos?
openshift-eng (a GitHub organization) maintains it in openshift-eng/ai-helpers, which has 120 GitHub stars. The repository holds 118 skills in this directory. The repository was last updated on October 6, 2026.
Source: openshift-eng/ai-helpers on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.