cve-audit git:20260716.c3487c6A

Immutable. This exact content is served forever at /api/v1/blob/0054bd38ef971562.

---
name: cve-audit
description: Audit exact npm dependency versions against OSV and emit a reproducible evidence packet with zero unverified findings.
source:
  type: cli-tool
  command: node
  args:
    - scan.mjs
    - core.mjs
  timeout_seconds: 120
  sandbox:
    profile: network
    cwd_policy: skill-directory
    network: true
    require_enforcement: false
inputs:
  target_name:
    type: string
    required: true
    description: Human-readable name of the audited project.
  target_repo:
    type: string
    required: true
    description: Public source repository URL.
  target_commit:
    type: string
    required: true
    description: Full immutable Git commit containing the lockfile.
  lockfile_url:
    type: string
    required: true
    description: Public HTTPS package-lock.json URL pinned to target_commit.
  dependency_scope:
    type: string
    required: false
    default: direct-production
    description: direct-production or all-installed.
runx:
  category: security
  tags:
    - cve
    - dependencies
    - osv
  artifacts:
    named_emits:
      audit_result: audit_result
      report: report
      evidence: evidence
links:
  source: https://github.com/jaasieldelgado131/runx-exact-cve-audit
  registry: https://runx.ai/x/jaasieldelgado131/cve-audit
  advisory_source: https://osv.dev
---

# Exact CVE Audit

## What this skill does

This skill audits exact npm versions from an immutable `package-lock.json`
against the public OSV API. It emits a machine-readable audit result,
`evidence.json`, and a finding-by-finding Markdown report. The governed graph in
`X.yaml` independently replays every query and seals a delivery packet only
when the reported and replayed advisory sets match exactly.

It does not install dependencies, execute target code, mutate the target
repository, repair packages, or publish vulnerability claims.

## When to use this skill

Use it when a reviewer needs checkable evidence for the advisories affecting
the exact npm versions in a public, immutable lockfile. It is suitable for
dependency review, release triage, and reproducible security evidence where a
package-name-only or loose-range match would create false positives.

## When not to use this skill

Do not use it for a mutable branch URL, a manifest without exact installed
versions, a private lockfile without explicit read authority, non-npm
ecosystems, exploit development, or claims about transitive coverage when the
selected scope is `direct-production`. Do not treat missing OSV data as proof
that a package is safe.

## Inputs

- `target_name`: display name for the audited project.
- `target_repo`: public HTTPS source repository.
- `target_commit`: full 40-character immutable Git commit.
- `lockfile_url`: public HTTPS lockfile URL containing that commit.
- `dependency_scope`: `direct-production` by default, or `all-installed`.

The caller authorizes only public reads of the pinned lockfile and OSV. No
credential, token, local project file, or private payload is an accepted input.

## Procedure

1. Validate that the repository and lockfile URLs use HTTPS, the commit is a
   full Git hash, and the lockfile URL is pinned to that hash.
2. Fetch the lockfile and record its SHA-256 digest before parsing it.
3. Extract exact installed versions from lockfile versions 2 or 3. Preserve the
   requested scope in every artifact.
4. Query OSV with `{ ecosystem: npm, package, version }` for every inventory
   entry. Exclude withdrawn advisories.
5. Record each finding with dependency, exact version, advisory ID, OSV URL,
   aliases, installed path, and the exact query that produced it.
6. In the governed graph, replay every exact-version query in a separate step.
   Fail closed if an advisory is unsupported, omitted, withdrawn, or changed.
7. Emit the report, evidence, verification, delivery packet, and sealed receipt.

## Edge cases and stop conditions

- Refuse non-HTTPS or mutable lockfile URLs.
- Refuse abbreviated commits and lockfiles that do not contain the commit.
- Refuse unsupported lockfile versions or entries without exact versions.
- Return `needs_input` when the target, commit, or lockfile evidence is not
  immutable enough to support reproducible review.
- Stop if OSV times out, returns malformed data, or changes between scan and
  independent replay.
- Stop if any false hit or missing hit is detected.
- Report the selected dependency scope; never imply broader coverage.
- Keep tokens, credentials, private source, and target code out of artifacts.

## Output schema

The scan emits:

```json
{
  "audit_result": {
    "schema": "runx.security.exact_cve_audit.v1",
    "target": {
      "repo": "https://github.com/owner/repo",
      "commit": "40-character hash",
      "lockfile_sha256": "64-character digest"
    },
    "dependency_scope": "direct-production",
    "inventory": [],
    "findings": [],
    "result": {
      "exact_dependencies_queried": 0,
      "advisory_findings": 0,
      "source": "OSV"
    }
  },
  "report": {
    "schema": "runx.security.exact_cve_report.v1",
    "markdown": "# Exact CVE audit: ...",
    "markdown_sha256": "64-character digest"
  },
  "evidence": {
    "summary": "human-readable audit summary",
    "observations": []
  }
}
```

The graph adds verification and delivery packets to a sealed `runx.receipt.v1`
graph receipt with child receipt lineage. The audit remains read-only: it does
not write unmanaged files into the target workspace or installed skill.

## Worked example

For OWASP NodeGoat at commit
`c5cb68a7084e4ae7dcc60e6a98768720a81841e8`, the checked-in harness reads the
pinned lockfile, audits 16 exact direct production versions, reports the OSV
advisories returned for those versions, and independently requires zero false
and zero missing hits before sealing.

The second harness case audits the repository's immutable clean fixture at
commit `83d554f904f9f73bd26ce9c15e3786ba7d62b1de`. It verifies that an exact
dependency with no OSV advisory produces zero findings while still completing
the independent replay and sealed-receipt path.

If the same request points at `main/package-lock.json`, validation returns a
needs-input failure because the lockfile is mutable and does not contain the
declared immutable commit. No audit or receipt is presented as complete.