Skip to content

feat: add CVE remediation skills for ai-helpers#9

Closed
vmrh21 wants to merge 1 commit intomainfrom
ai-helpers-cve-skills
Closed

feat: add CVE remediation skills for ai-helpers#9
vmrh21 wants to merge 1 commit intomainfrom
ai-helpers-cve-skills

Conversation

@vmrh21
Copy link
Copy Markdown
Collaborator

@vmrh21 vmrh21 commented Apr 29, 2026

Summary

  • Add 5 CVE remediation skills packaged in the opendatahub-io/ai-helpers SKILL.md format
  • Ready to be contributed to ai-helpers as a PR once reviewed here
  • Skills follow autofix conventions (.autofix-context/ inputs, autofix-output/.autofix-verdict.json output)

Skills

Skill Purpose
jira-autofix-cve-resolve CVE orchestrator — parses ticket, resolves repos, coordinates scan/fix/verify/PR across all branches
cve-scan Version-matched vulnerability scanning (govulncheck with GOTOOLCHAIN, npm audit, pip-audit)
cve-fix-apply Applies fix guided by .cve-fix/examples.md — Go version bumps, npm overrides, base image updates
cve-verify Post-fix binary scan to confirm CVE is resolved before creating PR
cve-vex-assess Auto-detects VEX justifications (Component not Present, Vulnerable Code not Present, not in Execute Path)

Test plan

  • Review skill YAML front matter matches ai-helpers format
  • Verify no references to external repos or comparison language
  • Confirm verdict/context conventions match autofix PR #165 patterns

🤖 Generated with Claude Code

Add 5 skills packaged in the opendatahub-io/ai-helpers format:
- jira-autofix-cve-resolve: CVE orchestrator for Vulnerability tickets
- cve-scan: version-matched vulnerability scanning (govulncheck, npm audit, pip-audit)
- cve-fix-apply: guided fix application with .cve-fix/examples.md support
- cve-verify: post-fix binary verification
- cve-vex-assess: auto-detect VEX justifications

Skills follow the autofix conventions: .autofix-context/ for inputs,
autofix-output/.autofix-verdict.json for outputs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@vmrh21 vmrh21 closed this Apr 29, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant