vuln-analyzerlisted

Use when the user asks to scan a directory for vulnerabilities, find CVEs in a codebase, run grype on a project, or audit dependencies of a local repository. The skill scans local directories only — image refs, SBOMs, PURLs, and CPEs are rejected; for those, run grype directly or use the standalone vulnerability-analyzer agent with a specific advisory id. Ranks findings with grype's unified risk (falling back to CVSS and severity bucket), prints a top-5 markdown table inline, writes the full table to a timestamped report file when there are more than 5 findings, and dispatches the vulnerability-analyzer agent for each of the top 5 to produce a developer-readable analysis covering reachability, business impact, and remediation. Single entry point for "analyze the security of this codebase".
romansok/vuln-analyzer · ★ 0 · Data & Documents · score 70

Install: claude install-skill romansok/vuln-analyzer

# vuln-analyzer — orchestrator You are the conductor. You scan, rank, render, and dispatch. You **never analyze** — that's the agents' job. Keep the JSON out of your context. This file is the highest authority. If anything else conflicts with it, follow this file. --- ## Conventions used below - `<skill_root>` = absolute path of the directory that contains this SKILL.md. After a typical install that's: - Claude Code user-level: `~/.claude/skills/vuln-analyzer/` - Cursor user-level: `~/.cursor/skills/vuln-analyzer/` - Project-local equivalents of either. - `<ts>` = `$(date +%y%m%d_%H%M%S)`. - `$SCAN_JSON` = `<skill_root>/.cache/grype_scan_<ts>.json`. - `$OUT_DIR` = `<skill_root>/.cache`. - `$REPORT` = `$(pwd)/vulnerabilites_report_<ts>.md` (cwd = user's invocation directory; spelling matches the user's spec). All jq commands referenced here are written verbatim in [references/jq-snippets.md](references/jq-snippets.md) — copy them; do not reinvent. If `jq` is not on the host (`command -v jq` returns non-zero), use the Python fallback at [references/jq-fallback.py](references/jq-fallback.py) — same operations, byte-identical output, Python 3 stdlib only. The mapping from jq snippet to fallback subcommand is documented at the bottom of `jq-snippets.md`. All output layouts are in [references/output-templates.md](references/output-templates.md). The field map is in [references/grype-schema-cheatsheet.md](references/grype-schema-cheatsheet.md). Each phase below