How do I install the Resolve Cve skill?

Run npx skillmds@latest add openshift/resolve-cve in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Resolve Cve safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Resolve Cve?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Resolve Cve free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Resolve Cve?

openshift (@openshift) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Resolve Cve by openshift — Agent Skill

Name: Resolve Cve
Author: openshift

File contents

resolve-cve

Use this skill for lightspeed-agentic-sandbox. Workflow matches the Lightspeed Service skill, but Jira filters and verification targets are adjusted.

Finding issues (Jira)

If the user gives a Jira key or URL, use that issue directly.

If they ask what to triage, search your org's vulnerability backlog. Do not assume the same summary ~ filter as lightspeed-service-api-rhel9. For this Konflux component, issues may reference:

Component name: lightspeed-agentic-sandbox (see .tekton/*.yaml)
Repository: openshift/lightspeed-agentic-sandbox

Build a JQL filter with your project admin's pattern, e.g.:

project = <PROJECT> AND type = Vulnerability AND statusCategory = "To Do"
  AND (summary ~ "lightspeed-agentic-sandbox" OR summary ~ "openshift/lightspeed-agentic-sandbox")
ORDER BY priority DESC

If no project access, ask the user for the Jira key or paste the flaw text.

Step 1: Read the issue

Parse CVE ID, affected package, version range, and fix reference from the issue body (same approach as the upstream skill).

Step 2: Assess impact

Search pyproject.toml and uv.lock for the package (case-insensitive).
Compare installed version to the advisory range.
Check whether vulnerable APIs are used in src/lightspeed_agentic/.
Trace transitive deps in uv.lock if needed.

Step 3: Present assessment

Use the same verdict template as the upstream skill (NOT AFFECTED / bump / code change). Stop for user acknowledgment before resolving.

Step 4: Resolve

Not affected: Jira comment + transition per team policy (same structure as upstream skill).
Dependency bump: follow deps-update with uv lock --upgrade-package {package}, then make requirements, make verify, make test.
Code fix: rare; minimal change + tests; run make verify && make test.

Commit message examples:

fix: resolve CVE-YYYY-NNNNN — bump {package} to {version}

Constraints

User acknowledgment before acting on the verdict.
Prefer targeted --upgrade-package over full --upgrade for CVE PRs.
Run make verify and make test before declaring done.

---name: resolve-cvedescription: Triage a CVE: assess impact against this repo's dependencies, then bump, document not-affected, or plan a code fix. Use when the user mentions a CVE, Jira vulnerability issue, or security advisory for a dependency.---# resolve-cveUse this skill for **lightspeed-agentic-sandbox**. Workflow matches theLightspeed Service skill, but Jira filters and verification targets are adjusted.## Finding issues (Jira)If the user gives a Jira key or URL, use that issue directly.If they ask what to triage, search your org's vulnerability backlog. **Do not**assume the same `summary ~` filter as `lightspeed-service-api-rhel9`. For thisKonflux component, issues may reference:- Component name: `lightspeed-agentic-sandbox` (see `.tekton/*.yaml`)- Repository: `openshift/lightspeed-agentic-sandbox`Build a JQL filter with your project admin's pattern, e.g.:```project = <PROJECT> AND type = Vulnerability AND statusCategory = "To Do" AND (summary ~ "lightspeed-agentic-sandbox" OR summary ~ "openshift/lightspeed-agentic-sandbox")ORDER BY priority DESC```If no project access, ask the user for the Jira key or paste the flaw text.## Step 1: Read the issueParse CVE ID, affected package, version range, and fix reference from theissue body (same approach as the upstream skill).## Step 2: Assess impact1. Search `pyproject.toml` and `uv.lock` for the package (case-insensitive).2. Compare installed version to the advisory range.3. Check whether vulnerable APIs are used in `src/lightspeed_agentic/`.4. Trace transitive deps in `uv.lock` if needed.## Step 3: Present assessmentUse the same verdict template as the upstream skill (**NOT AFFECTED** /**bump** / **code change**). **Stop for user acknowledgment** before resolving.## Step 4: Resolve- **Not affected:** Jira comment + transition per team policy (same structure as upstream skill).- **Dependency bump:** follow **deps-update** with `uv lock --upgrade-package {package}`, then `make requirements`, `make verify`, `make test`.- **Code fix:** rare; minimal change + tests; run `make verify && make test`.Commit message examples:```fix: resolve CVE-YYYY-NNNNN — bump {package} to {version}```## Constraints- User acknowledgment before acting on the verdict.- Prefer targeted `--upgrade-package` over full `--upgrade` for CVE PRs.- Run `make verify` and `make test` before declaring done.

Frequently asked questions

Resolve Cve