---
name: "mkl-audit-cve"
description: "Audit CVE advisories against codebase usage with minimal token context."
---

<skill name="mkl-audit-cve">
  <description>Audit CVE advisories against codebase usage with minimal token context.</description>
  <context>
    Auditing alerts from Dependabot, Renovate, or GHSA must not dump dependencies into context.

    Execute a targeted audit:
    1. Is our codebase importing or calling the vulnerable code path?
    2. What is the immediate maintainer action (safe routine upgrade vs. urgent remediation)?
  </context>
  <workflow>
    <step name="targeted-extraction">
      Extract essential advisory attributes:
      - **Identifier**: CVE or GHSA ID (e.g. `CVE-2020-14343`).
      - **Affected package**: Package name (e.g. `pyyaml`) and version range.
      - **Vulnerable symbol**: Function or class (e.g. `yaml.load`).
      - **Trigger**: Input pattern causing exploitability.
    </step>
  </workflow>
  <verification name="usage-verification-via-targeted-search">
    Run ripgrep (`rg`) or AST search for the vulnerable symbol and import entrypoints; exclude test fixtures.

    - **Python**: `rg -n "\b<symbol>\s*\("`
    - **Node.js**: `rg -n "\b<symbol>\s*\("`
    - **Rust**: `rg -n "\b<symbol>\s*::|\b<symbol>\s*\("`

    Dependencies:
    - **Direct**: Declared in `pyproject.toml`, `package.json`, or `Cargo.toml`.
    - **Transitive**: Present in lockfiles (`uv.lock`, `package-lock.json`).
  </verification>
  <section name="verdict-generation">
    - **Uninvoked / Not called**: Mark `Low Immediate Risk / Trivial Upgrade`. Exploitability absent; merge in regular updates.
    - **Invoked / Reachable**: Highlight site (`file:line`). Mark `High Immediate Risk / Active Vulnerability`. Recommend immediate patched version bump or defensive workaround.
    - If upstream fixes are unavailable, supply input sanitization or a defensive workaround.
  </section>
  <section name="standard-output-schema">
    All audit summaries must stay under 200 words (< 260 tokens):

    ```text
    ### CVE Audit: <CVE-ID> (<pkg> <ver>)
    - **Symbol**: `<symbol>`
    - **Reach**: [Direct at <file:line> | Uninvoked]
    - **Kind**: [Direct | Transitive]
    - **Verdict**: [Low Immediate Risk / Trivial Upgrade | High Immediate Risk / Active Vulnerability]
    - **Action**: <Recommendation or workaround>
    ```
  </section>
  <example type="authored">
    ### Example 1: Python — Direct Vulnerability (Invoked)
    - **Alert**: `CVE-2020-14343` (`PyYAML < 5.4`). Vulnerable symbol: `yaml.load()`.
    - **Search**: `rg -n "\byaml\.load\(" src/` -> `src/config.py:42: yaml.load(stream)`

    ```text
    ### CVE Audit: CVE-2020-14343 (PyYAML 5.3.1)
    - **Symbol**: `yaml.load()`
    - **Reach**: Direct (`src/config.py:42`)
    - **Kind**: Direct (`pyproject.toml`)
    - **Verdict**: High Immediate Risk / Active Vulnerability
    - **Action**: Arbitrary execution. Upgrade PyYAML or use `yaml.safe_load()`.
    ```

    ### Example 2: Node.js — Transitive Vulnerability (Uninvoked)
    - **Alert**: `CVE-2020-28500` (`lodash < 4.17.21`). Vulnerable symbol: `_.defaultsDeep`.
    - **Search**: `rg -n "\bdefaultsDeep\b" src/` -> No matches.

    ```text
    ### CVE Audit: CVE-2020-28500 (lodash 4.17.20)
    - **Symbol**: `lodash.defaultsDeep`
    - **Reach**: Uninvoked
    - **Kind**: Transitive (`winston`)
    - **Verdict**: Low Immediate Risk / Trivial Upgrade
    - **Action**: Uncalled symbol. Merge lockfile bump.
    ```

    ### Example 3: Rust — Transitive Vulnerability (Uninvoked)
    - **Alert**: `RUSTSEC-2021-0139` (`tokio < 1.8.4`). Vulnerable symbol: `tokio::sync::oneshot`.
    - **Search**: `rg -n "\b(sync::oneshot|oneshot::channel)\b" src/` -> No matches.

    ```text
    ### CVE Audit: RUSTSEC-2021-0139 (tokio 1.8.0)
    - **Symbol**: `tokio::sync::oneshot`
    - **Reach**: Uninvoked
    - **Kind**: Direct crate, unused module
    - **Verdict**: Low Immediate Risk / Trivial Upgrade
    - **Action**: Exploitability absent. Upgrade `tokio`.
    ```
  </example>
</skill>