# Resolve Cve

> Triage a CVE: assess impact against this repo's dependencies, then bump, document not-affected, or plan a code fix. Use when the user mentions a CVE, Jira vulnerability issue, or security advisory for a dependency.

- Skill: `openshift/resolve-cve` (Agent Skill)
- Install (CLI): `npx skillmds@latest add openshift/resolve-cve`
- Raw SKILL.md: https://api.skillmd.com/api/skills/openshift/resolve-cve/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: openshift (https://skillmd.com/u/openshift)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/openshift/resolve-cve

---


# resolve-cve

Use this skill for **lightspeed-agentic-sandbox**. Workflow matches the
Lightspeed Service skill, but Jira filters and verification targets are adjusted.

## Finding issues (Jira)

If the user gives a Jira key or URL, use that issue directly.

If they ask what to triage, search your org's vulnerability backlog. **Do not**
assume the same `summary ~` filter as `lightspeed-service-api-rhel9`. For this
Konflux component, issues may reference:

- Component name: `lightspeed-agentic-sandbox` (see `.tekton/*.yaml`)
- Repository: `openshift/lightspeed-agentic-sandbox`

Build a JQL filter with your project admin's pattern, e.g.:

```
project = <PROJECT> AND type = Vulnerability AND statusCategory = "To Do"
  AND (summary ~ "lightspeed-agentic-sandbox" OR summary ~ "openshift/lightspeed-agentic-sandbox")
ORDER BY priority DESC
```

If no project access, ask the user for the Jira key or paste the flaw text.

## Step 1: Read the issue

Parse CVE ID, affected package, version range, and fix reference from the
issue body (same approach as the upstream skill).

## Step 2: Assess impact

1. Search `pyproject.toml` and `uv.lock` for the package (case-insensitive).
2. Compare installed version to the advisory range.
3. Check whether vulnerable APIs are used in `src/lightspeed_agentic/`.
4. Trace transitive deps in `uv.lock` if needed.

## Step 3: Present assessment

Use the same verdict template as the upstream skill (**NOT AFFECTED** /
**bump** / **code change**). **Stop for user acknowledgment** before resolving.

## Step 4: Resolve

- **Not affected:** Jira comment + transition per team policy (same structure
  as upstream skill).
- **Dependency bump:** follow **deps-update** with `uv lock --upgrade-package
  {package}`, then `make requirements`, `make verify`, `make test`.
- **Code fix:** rare; minimal change + tests; run `make verify && make test`.

Commit message examples:

```
fix: resolve CVE-YYYY-NNNNN — bump {package} to {version}
```

## Constraints

- User acknowledgment before acting on the verdict.
- Prefer targeted `--upgrade-package` over full `--upgrade` for CVE PRs.
- Run `make verify` and `make test` before declaring done.