cve-reachability-analyzer

# Post-Disclosure CVE Reachability Analyzer ## Overview This skill performs static analysis of software repositories to determine whether disclosed CVEs in dependencies are reachable from the project's code. It analyzes import patterns, call chains, dynamic invocation, and configuration to classify each CVE's reachability with evidence-based justification. ## Workflow ### Step 1: Gather Input Information Collect and validate the required information: 1. **Repository analysis**: - Identify programming language(s) - Locate dependency files (package.json, requirements.txt, pom.xml, etc.) - Understand project structure and entry points 2. **CVE information**: - CVE ID and description - Affected package name and version range - Vulnerable component (function/class/method) - Vulnerability type (injection, overflow, etc.) - Fixed version 3. **Configuration information** (optional): - Feature flags and their states - Build profiles (dev/staging/production) - Environment variables - Runtime configuration files ### Step 2: Verify Dependency Presence Check if the vulnerable dependency exists in the project: 1. **Parse dependency files**: - Read language-specific dependency files (see [language_guide.md](references/language_guide.md)) - Extract package names and version constraints - Build dependency tree (including transitive dependencies) 2. **Version matching**: - Compare installed version against vulnerable version range ...