Daily Cve Digest

daily-cve-digest

A weekday Category 2 agent. Closes the gap between "Dependabot already covers our advisories" and "actually, Dependabot misses N entire classes of signal." This skill brings the full advisory surface into view, scoped to the org's stack.

Agent config (consumed by scheduled-agent-runner)

agent_name: daily-cve-digest
cadence: daily
schedule_hint: "weekday 07:00 local; skip weekends"
source_filter:
  custom: cve-feeds
  feeds:
    - https://github.com/advisories/feed
    - https://osv.dev/list/atom
    - https://services.nvd.nist.gov/rest/json/cves/2.0
  stack_config: ./stack.yml
  max_items_per_feed: 100  # daily volume; severity filtering trims
verify_loadbearing: false  # advisory text from NVD/GHSA is authoritative
curate_findings: true       # critical/high findings stage facts for memory-curator
digest_template_overrides:
  template: cve-digest
  why_you_care_extra: |
    Per item:
    1. Direct match against critical_libraries OR ecosystem-level signal?
    2. Will Dependabot surface this automatically? (yes/no/partial)
    3. SLA for first response + remediation per severity_actions in stack.yml

Matching logic

For each incoming advisory:

1. Ecosystem check: does the advisory's package belong to an ecosystem declared in_production: true?
2. Critical library check: does the advisory's package name match an entry in critical_libraries? If yes, always include regardless of severity.
3. Ecosystem-wide signal check: is the advisory about the ecosystem itself (not a specific package)? E.g., npm registry attack, pip-installer CVE, container-runtime CVE. Always include.
4. Dependabot-covers check: based on advisory type:
   • Direct package CVE with Dependabot-supported ecosystem → YES, Dependabot will surface
   • Base-image CVE → PARTIAL (Dependabot covers Docker but misses image-specific advisories)
   • Supply-chain attack disclosure (package takeover, typosquat campaign) → NO (advisory-only; no automated patch)
   • Transitive-depth-beyond-Dependabot-reach → NO

Output structure

# Daily CVE Digest — {date}

## At a glance
- {N critical, M high, K medium} matching items
- {X items Dependabot will NOT auto-surface} — these are the action-required ones

## Critical (SLA: 24h response, 7d remediate)
### {CVE-ID} — {package}
- **Affected**: {package + version range}
- **Severity**: critical (CVSS {score})
- **Dependabot covers?**: {yes/no/partial}
- **Affected paths in stack**: {which services likely impacted}
- **Source**: {URL}

## High (SLA: 3 business days, 30d remediate)
### {CVE-ID} — {package}
[same shape]

## Medium (SLA: 1 week, 90d remediate)
[same shape, condensed]

## Ecosystem-wide signals (no specific package match but worth knowing)
- {one-liners}

## Cross-references to vault
- Stack-config currency: last reviewed {date}, next review {date+90d}
- Facts staged for memory-curator: {list}
- Items queued for stakeholder-update-writer: {critical items only}

Composes with

Standard Phase-1 foundation. Also:

• stack.yml in this skill folder — the matching config.
• [[2026-06-20-dependabot-best-practices-regulated-org]] — Dependabot's coverage characteristics inform the "Dependabot covers?" line.

Acceptance test (for step 22 done-criteria)

stack.yml exists with declared ecosystems, critical_libraries, and severity_actions. SKILL.md describes the matching logic + Dependabot-covers categorization clearly. Live first-run exercise deferred to first weekday-AM cron firing.