kagenti CVE Awareness
Detect CVEs in project dependencies and source code, audit documentation for CVE leaks, and ensure responsible disclosure before any public communication.
IMPORTANT
Accidental public CVE disclosure enables exploitation before patches exist, violates responsible disclosure agreements, and causes legal and reputational harm. Never include CVE IDs, vulnerability descriptions, or exploit details in any public output (PRs, issues, comments, commit messages) until the CVE has been reported through proper channels.
Router
flowchart TD
START(["/cve"]) --> WHAT{"What is needed?"}
WHAT -->|"Scan / Check deps / Review"| SCAN["cve:scan"]:::cve
WHAT -->|"CVE found, need plan"| BRAINSTORM["cve:brainstorm"]:::block
WHAT -->|"No specific request"| SCAN
classDef cve fill:#D32F2F,stroke:#333,color:white
classDef block fill:#B71C1C,stroke:#333,color:white
When /cve is invoked, determine the entry point:
- "Scan for CVEs" / "Check dependencies" / "Security review" →
cve:scan - CVE was found, need response plan →
cve:brainstorm - No specific request →
cve:scan(default: scan first)
What cve:scan Covers
| Phase | Scanner | Focus |
|---|---|---|
| 1 | Dependency inventory | All manifests: pyproject.toml, package.json, go.mod, Dockerfiles, Helm charts |
| 2 | Trivy (if available) | Filesystem + container image scanning |
| 3 | LLM + WebSearch | Known CVEs against NVD/Snyk/GitHub Advisories |
| 4 | Code security review | Auth, injection, secrets, containers, CI/CD, network patterns |
| 5 | Documentation audit | CVE references in .md files that could leak publicly |
| 6 | Combined report | SUMMARY.md in .cves/ (gitignored) |
When This Runs Automatically
These skills are invoked as mandatory gates in other workflows:
| Workflow | Gate Location | Skill |
|---|---|---|
tdd:ci |
Phase 3.5 (after local checks, before push) | cve:scan |
tdd:hypershift |
Pre-deploy (before cluster deployment) | cve:scan |
tdd:kind |
Pre-deploy (before cluster deployment) | cve:scan |
rca:* |
Phase 5 addendum (before documenting findings) | cve:scan |
git:commit |
Pre-commit (scan for CVE IDs in message) | CVE ID check |
| Finishing branch | Step 2.5 (before PR creation options) | cve:scan |
Output Location
All scan results go to .cves/ (gitignored):
.cves/
├── SUMMARY.md # Combined report (copy to Google Docs)
├── cve-scan-results.md # Dependency CVE findings
├── security-review-results.md # Source code security findings
├── md-audit-results.md # Documentation CVE leak audit
├── trivy-fs.json # Trivy output (if available)
└── trivy-config-*.txt # Trivy Dockerfile scans
Related Skills
cve:scan— Full scanning (dependencies + code + docs)cve:brainstorm— Disclosure planning and public output blocking