📘 Khy-OS 文档站 🧭 新手先读：核心概念

# CVE Query Skill

name: cve-query
version: 1.0.0
description: Query CVE databases, check known vulnerabilities in dependencies, and provide remediation guidance. Triggered when user asks about security vulnerabilities or CVEs.
layer: system
lifecycle: maintenance
category: security
tags: [security, cve, vulnerability, dependency-audit]
platforms: [khy-quant, claude-code, cosh]
dependencies: []

# CVE Query Skill#

Security vulnerability lookup and dependency audit.

## When to Activate#

- User asks about a specific CVE (e.g., "CVE-2024-XXXXX")
- User wants to check dependencies for known vulnerabilities
- User asks about security advisories or patches
- User requests a dependency audit

## Query Pipeline#

### Step 1: Identify Target#

Determine whether the query is about:

- A specific CVE ID
- A package/library name + version
- A full project dependency audit

### Step 2: Information Gathering#

For CVE lookups:

- Severity (CVSS score)
- Affected versions
- Attack vector and complexity
- Known exploits (public/private)

For dependency audits:

    # Node.js projects
    npm audit --json 2>/dev/null
    # Python projects
    pip audit --format json 2>/dev/null

### Step 3: Risk Assessment#

Rate each finding:

- Critical (CVSS >= 9.0): Immediate action required
- High (CVSS >= 7.0): Patch within 24-48 hours
- Medium (CVSS >= 4.0): Patch within 1 week
- Low (CVSS < 4.0): Track and patch at next release

### Step 4: Remediation#

Provide actionable fix steps:

1. Upgrade path (which version fixes the issue)
2. Workarounds if upgrade is not possible
3. Monitoring recommendations

## Safety Rules#

- Never attempt to exploit vulnerabilities
- Only query public CVE databases
- Do not disclose zero-day information
- Always recommend patching over workarounds