name: cve-query
version: 1.0.0
description: Query CVE databases, check known vulnerabilities in dependencies, and provide remediation guidance. Triggered when user asks about security vulnerabilities or CVEs.
layer: system
lifecycle: maintenance
category: security
tags: [security, cve, vulnerability, dependency-audit]
platforms: [khy-quant, claude-code, cosh]
dependencies: []

CVE Query Skill#

Security vulnerability lookup and dependency audit.

When to Activate#

• User asks about a specific CVE (e.g., "CVE-2024-XXXXX")
• User wants to check dependencies for known vulnerabilities
• User asks about security advisories or patches
• User requests a dependency audit

Query Pipeline#

Step 1: Identify Target#

Determine whether the query is about:

• A specific CVE ID
• A package/library name + version
• A full project dependency audit

Step 2: Information Gathering#

For CVE lookups:

• Severity (CVSS score)
• Affected versions
• Attack vector and complexity
• Known exploits (public/private)

For dependency audits:

# Node.js projects
npm audit --json 2>/dev/null
# Python projects
pip audit --format json 2>/dev/null

Step 3: Risk Assessment#

Rate each finding:

• Critical (CVSS >= 9.0): Immediate action required
• High (CVSS >= 7.0): Patch within 24-48 hours
• Medium (CVSS >= 4.0): Patch within 1 week
• Low (CVSS < 4.0): Track and patch at next release

Step 4: Remediation#

Provide actionable fix steps:

1. Upgrade path (which version fixes the issue)
2. Workarounds if upgrade is not possible
3. Monitoring recommendations

Safety Rules#

• Never attempt to exploit vulnerabilities
• Only query public CVE databases
• Do not disclose zero-day information
• Always recommend patching over workarounds