--- name: analyze-cve description: | Full Go CVE analysis workflow. Given a CVE identifier -- supplied directly, or resolved from a Jira ticket or JQL batch -- resolves and clones the affected repository, gathers vulnerability intelligence, analyzes codebase impact with govulncheck and call-graph reachability, generates a risk report, and optionally applies a fix and opens a GitHub pull request. Use when the user gives a CVE ID (CVE-YYYY-NNNNN), a Jira ticket (--jira=), or a JQL query (--jql=) for Go CVE triage; wants call-graph proof that a vulnerable function is reachable; or wants an automated fix and PR for a Go dependency vulnerability. Triggers on: 'analyze CVE', 'CVE impact', 'is this repo affected by CVE', 'Go vulnerability analysis', 'triage this Jira CVE ticket', 'fix this CVE and open a PR', or a bare CVE-YYYY-NNNNN identifier. --- # analyze-cve Performs comprehensive security vulnerability analysis for Go projects. Given a CVE identifier — supplied directly, or resolved from a Jira ticket — it resolves and clones the affected repository, gathers vulnerability intelligence, analyzes the codebase for impact, generates a risk report, optionally applies fixes, and optionally opens a GitHub pull request after a verified fix. Explicit invocation uses the following argument syntax: ``` /compliance:analyze-cve [--repo=] [--algo=vta|rta|cha|static] [--auto-approve=yes|no] /compliance:analyze-cve --jira= [--repo=...] [--algo=...] [--auto-approve=yes|no] /compliance:analyze-cve --jql="" [--repo=...] [--algo=...] [--auto-approve=yes|no] ``` Repository resolution works in four ways, in priority order: (1) an explicit `--repo=` (full URL or short image/component name), (2) in direct-CVE mode only, exactly one pre-cloned repository already present in this workspace's `repos/` directory when `--repo=` was not passed — in Jira/JQL mode that sole candidate is instead validated against the ticket's resolved image/branch before reuse, never assumed, (3) an image name extracted from a Jira ticket's summary/labels/custom fields when `--jira=`/`--jql=` was used, or (4) an interactive prompt for the repository URL or image name. See [Phase 0.7](references/implementation.md#phase-07-repository-resolution-and-cloning) in the implementation reference for the full resolution and cloning logic. Designed for both interactive use and headless execution (e.g. `claude --print "/compliance:analyze-cve --jira=OCPBUGS-12345 --auto-approve=yes"`) for scheduled/periodic runs. ## Arguments Exactly one of the following input modes is required: - **``** — Direct CVE identifier (format: `CVE-YYYY-NNNNN`, case-insensitive). Use when you already know the CVE. - **`--jira=PROJ-NNN`** — Jira ticket key (e.g. `--jira=OCPBUGS-12345`). This skill fetches the ticket and extracts the CVE ID, affected image name, and enrichment context (CVSS, CWE, priority, workarounds) from it. - **`--jql="..."`** — JQL query (e.g. `--jql="project = OCPBUGS AND labels = needs-cve-analysis"`). Fetches a batch of matching issues, filters out any already labeled `ai-cve-analyzed`, and processes exactly **one** of the remainder per run (see [Phase 0.3](references/implementation.md#phase-03-jql-resolution-only-when---jql-is-provided)). Re-running the same JQL periodically works through the queue over multiple invocations. Optional flags: - **`--repo=`**: Repository to analyze. Accepts: - A full GitHub URL: `--repo=https://github.com/openshift/cert-manager-operator` - A short image/component name: `--repo=cert-manager-operator-rhel9` (resolved via the [image-repo-mapping](../image-repo-mapping/SKILL.md) skill) - If omitted, Phase 0.7 checks for exactly one pre-cloned repo in this workspace first, then resolves from the Jira ticket's image name (if `--jira`/`--jql` was used), then prompts the user. - **`--algo`** (default: `vta`): Call graph construction algorithm. - `vta` — Most precise, fewest false positives (recommended) - `rta` — Good balance of precision and speed - `cha` — Fast, less precise - `static` — Fastest, least precise - **`--auto-approve=yes|no`** (default: `no`): Run end-to-end without interactive approval prompts. See [Autonomous Mode](references/implementation.md#autonomous-mode---auto-approveyesno) in the implementation reference. Intended for scheduled/headless runs. ## Running This Skill Read and follow [`references/implementation.md`](references/implementation.md) for the full phase-by-phase procedure once the arguments above are parsed — do not paraphrase or improvise it. It covers, in order: 1. **Autonomous Mode** — the full `AUTO_APPROVE` decision table (what's gated vs. what always hard-fails) 2. **Security — Credential Handling** — rules that apply to every command this skill runs 3. **Runtime Configuration** — `AI_HELPERS_WORKSPACE`, `FORK_ORG` 4. **Implementation** — Phase 0 (setup) through Phase 6 (PR creation), including the Repo Guard and each sub-skill's input/output contract 5. **Return Value** — the report format this skill produces ## Examples 1. **Basic CVE analysis against an explicit repo**: ``` /compliance:analyze-cve CVE-2024-45338 --repo=https://github.com/openshift/cert-manager-operator ``` 2. **With specific algorithm**: ``` /compliance:analyze-cve CVE-2024-45338 --repo=https://github.com/openshift/cert-manager-operator --algo=rta ``` 3. **Starting from a Jira ticket (repo/branch resolved automatically from the ticket's image name)**: ``` /compliance:analyze-cve --jira=OCPBUGS-12345 ``` 4. **Unattended run from a JQL queue, applying fixes and opening a PR without prompts**: ```bash claude --print "/compliance:analyze-cve --jql=\"project = OCPBUGS AND labels = needs-cve-analysis ORDER BY created ASC\" --auto-approve=yes" ``` ## Prerequisites All tools below are **required**. This skill exits with an error if any are missing. ```bash # Install all required Go tools go install golang.org/x/vuln/cmd/govulncheck@latest go install golang.org/x/tools/cmd/callgraph@latest go install golang.org/x/tools/cmd/digraph@latest # git is also required (Phase 0.7 repository cloning) — install via your OS package manager ``` **Optional**: - `graphviz` for visual call graph generation (`brew install graphviz` or `sudo apt-get install graphviz`) - `gh` (GitHub CLI, authenticated via `gh auth login`) for Phase 6 pull-request creation. Missing `gh` does **not** fail Phase 0 — analysis and local fixes still run; Phase 6 is skipped until it's available. - An Atlassian MCP server (e.g. the `jira` plugin's bundled Rovo MCP) or `jira-cli` for `--jira=`/`--jql=` input modes and posting reports back to Jira **Internet access** is recommended for CVE data fetching but not required if you can provide CVE details manually. ## Notes - Focuses on Go-specific vulnerabilities. - Resolves and clones the target repository automatically — via `--repo=`, Jira image-name mapping, or reusing a repo already cloned into `.work/compliance/analyze-cve/repos/` by a previous run — see [Phase 0.7](references/implementation.md#phase-07-repository-resolution-and-cloning). All analysis and fix-application phases run against that cloned `REPO_DIR`, not the directory this skill happened to be invoked from. - Falls back to user-provided information if internet access fails. - Does NOT make changes, commits, or pull requests without explicit approval — either interactive, or given once upfront via `--auto-approve=yes` (see [Autonomous Mode](references/implementation.md#autonomous-mode---auto-approveyesno)). - Reports are saved locally (`.work/compliance/analyze-cve/`, gitignored) and not committed to git — see [Runtime Configuration](references/implementation.md#runtime-configuration) to relocate this base directory. - Never process or disclose embargoed CVEs — if a Jira ticket's Embargo Status is `True`, this skill stops immediately and outputs nothing about the ticket.