vulnerability-report

What this skill does

# Vulnerability Report Skill

When generating vulnerability reports, scan all project dependencies for known CVEs, categorize findings by severity, and produce three separate reports — one for each severity tier. Each report is a standalone document with full context, remediation steps, and priority guidance.

**IMPORTANT**: Always save THREE markdown files to the `project-decisions/` directory:
1. `YYYY-MM-DD-vulnerabilities-high.md` — Critical and High severity (CVSS ≥ 7.0)
2. `YYYY-MM-DD-vulnerabilities-medium.md` — Medium severity (CVSS 4.0–6.9)
3. `YYYY-MM-DD-vulnerabilities-low.md` — Low and Informational (CVSS < 4.0)

## 0. Output Setup
````bash
mkdir -p project-decisions

# Files will be saved as:
# project-decisions/YYYY-MM-DD-vulnerabilities-high.md
# project-decisions/YYYY-MM-DD-vulnerabilities-medium.md
# project-decisions/YYYY-MM-DD-vulnerabilities-low.md
````

## 1. Dependency Discovery

### Detect Package Ecosystem
````bash
# Detect all package managers in use
echo "=== Package Ecosystems Detected ==="

# Node.js / JavaScript / TypeScript
ls package.json package-lock.json yarn.lock pnpm-lock.yaml bun.lockb 2>/dev/null && echo "→ Node.js detected"

# Python
ls requirements.txt Pipfile pyproject.toml poetry.lock setup.py setup.cfg 2>/dev/null && echo "→ Python detected"

# Go
ls go.mod go.sum 2>/dev/null && echo "→ Go detected"

# Ruby
ls Gemfile Gemfile.lock 2>/dev/null && echo "→ Ruby detected"

# PHP
ls composer.json composer.lock 2>/dev/null && echo "→ PHP detected"

# Rust
ls Cargo.toml Cargo.lock 2>/dev/null && echo "→ Rust detected"

# Java
ls pom.xml build.gradle build.gradle.kts 2>/dev/null && echo "→ Java detected"

# .NET
ls *.csproj *.sln packages.config 2>/dev/null && echo "→ .NET detected"

# Docker (base image vulnerabilities)
ls Dockerfile Dockerfile.* docker-compose.yml 2>/dev/null && echo "→ Docker detected"
````

### Inventory Dependencies
````bash
# Node.js — count direct and transitive
echo "=== Node.js Dependencies ==="
echo "Direct dependencies: $(cat package.json 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d.get('dependencies',{})))" 2>/dev/null || echo "N/A")"
echo "Dev dependencies: $(cat package.json 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d.get('devDependencies',{})))" 2>/dev/null || echo "N/A")"
echo "Total installed: $(ls node_modules/ 2>/dev/null | wc -l || echo "N/A")"

# Python
echo "=== Python Dependencies ==="
pip list --format=columns 2>/dev/null | wc -l || echo "N/A"
cat requirements.txt 2>/dev/null | grep -v "^#\|^$" | wc -l || echo "N/A"

# Go
echo "=== Go Dependencies ==="
cat go.sum 2>/dev/null | awk '{print $1}' | sort -u | wc -l || echo "N/A"

# Ruby
echo "=== Ruby Dependencies ==="
cat Gemfile.lock 2>/dev/null | grep "    [a-z]" | wc -l || echo "N/A"

# PHP
echo "=== PHP Dependencies ==="
cat composer.lock 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); print(len(d.get('packages',[])))" 2>/dev/null || echo "N/A"
````

## 2. Vulnerability Scanning

### Node.js / npm
````bash
# Full npm audit with JSON output
npm audit --json 2>/dev/null > /tmp/npm-audit-output.json

# Parse audit results
cat /tmp/npm-audit-output.json | python3 -c "
import sys, json
try:
    data = json.load(sys.stdin)
    
    # npm v7+ format
    if 'vulnerabilities' in data:
        vulns = data['vulnerabilities']
        for name, info in sorted(vulns.items(), key=lambda x: {'critical':0,'high':1,'moderate':2,'low':3,'info':4}.get(x[1].get('severity','info'), 5)):
            severity = info.get('severity', 'unknown')
            via = info.get('via', [])
            fix = info.get('fixAvailable', False)
            range_affected = info.get('range', 'unknown')
            
            # Get CVE details from via
            cves = []
            if isinstance(via, list):
                for v in via:
                    if isinstance(v, dict):
                        cves.append({
                            'title': v.get('title', 'N/A'),
                            'url': v.get('url', ''),
                            'severity': v.get('severity', severity),
                            'cwe': v.get('cwe', []),
                            'cvss': v.get('cvss', {}).get('score', 'N/A'),
                            'range': v.get('range', range_affected)
                        })
            
            print(f'PACKAGE: {name}')
            print(f'  Severity: {severity.upper()}')
            print(f'  Affected: {range_affected}')
            print(f'  Fix Available: {fix}')
            for cve in cves:
                print(f'  CVE Title: {cve[\"title\"]}')
                print(f'  CVSS Score: {cve[\"cvss\"]}')
                print(f'  URL: {cve[\"url\"]}')
                print(f'  CWE: {cve[\"cwe\"]}')
            print()
    
    # Summary
    metadata = data.get('metadata', {}).get('vulnerabilities', {})
    print('=== SUMMARY ===')
    print(f'Critical: {metadata.get(\"critical\", 0)}')
    print(f'High: {metadata.get(\"high\", 0)}')
    print(f'Moderate: {metadata.get(\"moderate\", 0)}')
    print(f'Low: {metadata.get(\"low\", 0)}')
    print(f'Info: {metadata.get(\"info\", 0)}')
    print(f'Total: {metadata.get(\"total\", 0)}')
except Exception as e:
    print(f'Error parsing: {e}', file=sys.stderr)
" 2>/dev/null

# Also check with npm audit fix --dry-run to see what's auto-fixable
npm audit fix --dry-run 2>/dev/null | tail -20
````

### Node.js / yarn
````bash
# Yarn audit
yarn audit --json 2>/dev/null | head -100
````

### Node.js / pnpm
````bash
# pnpm audit
pnpm audit --json 2>/dev/null | head -100
````

### Python / pip
````bash
# pip-audit (preferred)
pip install pip-audit --break-system-packages 2>/dev/null
pip-audit --format=json 2>/dev/null > /tmp/pip-audit-output.json
cat /tmp/pip-audit-output.json | python3 -c "
import sys, json
try:
    data = json.load(sys.stdin)
    for vuln in data:
        name = vuln.get('name', 'unknown')
        version = vuln.get('version', 'unknown')
        vulns = vuln.get('vulns', [])
        for v in vulns:
            print(f'PACKAGE: {name}=={version}')
            print(f'  ID: {v.get(\"id\", \"N/A\")}')
            print(f'  Fix Versions: {v.get(\"fix_versions\", [])}')
            print(f'  Description: {v.get(\"description\", \"N/A\")[:200]}')
            print()
except Exception as e:
    print(f'Error: {e}', file=sys.stderr)
" 2>/dev/null

# Safety check (alternative)
pip install safety --break-system-packages 2>/dev/null
safety check --json 2>/dev/null | head -100
````

### Go
````bash
# govulncheck
go install golang.org/x/vuln/cmd/govulncheck@latest 2>/dev/null
govulncheck ./... 2>/dev/null
````

### Ruby
````bash
# bundler-audit
gem install bundler-audit 2>/dev/null
bundle-audit check --update 2>/dev/null
````

### PHP
````bash
# Composer audit
composer audit --format=json 2>/dev/null | head -100
````

### Docker Base Images
````bash
# Check Dockerfile base images
echo "=== Docker Base Images ==="
grep "^FROM" Dockerfile Dockerfile.* 2>/dev/null

# Check if base images are pinned
grep "^FROM" Dockerfile 2>/dev/null | while read line; do
  image=$(echo "$line" | awk '{print $2}')
  echo "$image" | grep -q ":" || echo "⚠️ UNPINNED: $image (using :latest implicitly)"
  echo "$image" | grep -q ":latest" && echo "⚠️ UNPINNED: $image (using :latest explicitly)"
  echo "$image" | grep -qE ":[0-9]" && echo "✅ PINNED: $image"
  echo "$image" | grep -qE "@sha256:" && echo "✅ DIGEST PINNED: $image"
done
````

### Lockfile Integrity
````bash
# Check lockfiles exist and are committed
echo "=== Lockfile Status ==="
for lockfile in package-lock.json yarn.lock pnpm-lock.yaml Pipfile.lock poetry.lock Gemfile.lock composer.lock Cargo.lock go.sum; do
  if [ -f "$lockfile" ]; then
    if git ls-files --error-unmatch "$lockfile" >/dev/null 2>&1; then
      echo "✅ $lockfile — committed"
    else
      echo "⚠️ $lockfile — exists but NOT committed to git"
    fi
  fi
done

# Check for unpinned v