skills.rest
submariner-io
submariner-ioOFFICIAL
Explore all skills by this author →
Website𝕏@submarinerioGitHub

cve-fix

Scan Go repositories for CVEs, update dependencies, and commit fixes.

77|29|Updated Jan 6, 2020
Search Tags:#automation#security#dependencies#go#vulnerability management#cve
One-click install
npx skills add https://github.com/submariner-io/shipyard --skill cve-fix
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cve-fix
Source: https://github.com/submariner-io/shipyard/tree/main/skills/cve-fix
Command: npx skills add https://github.com/submariner-io/shipyard --skill cve-fix

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the process of identifying and fixing Common Vulnerabilities and Exposures (CVEs) in Go-based software projects, streamlining security updates.

Core Features & Use Cases

  • Automated CVE Scanning: Scans Go modules for known vulnerabilities using Grype.
  • Dependency Updates: Automatically updates vulnerable packages in go.mod and go.sum files.
  • Branch Management: Creates dedicated branches for fixes and handles commit creation.
  • Use Case: A development team needs to patch a critical vulnerability affecting multiple microservices. This Skill can be invoked on each service's repository to automatically update the vulnerable dependency, create a commit, and prepare a pull request, significantly reducing manual effort and time-to-patch.

Quick Start

Run the cve-fix skill to patch vulnerabilities in the current repository and branch.

Frequently Asked Questions about cve-fix

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate CVE patching across multiple Go repositories?▼

Automating CVE patching across Go repositories involves scanning modules with Grype, updating vulnerable dependencies in go.mod and go.sum files, and generating pull requests. This skill handles branch creation and build verification to streamline security updates across parallel branches.

How does Grype vulnerability scanning work for Go modules?▼

Grype vulnerability scanning for Go modules works by analyzing your project's dependency tree against a database of known security advisories. This skill uses Grype to identify vulnerable packages, locate them within your dependencies, and trigger automated updates to secure versions.

Can I automatically update vulnerable dependencies in go.mod and go.sum?▼

You can automatically update vulnerable dependencies in go.mod and go.sum by running an automated patching process. This skill locates vulnerable packages, updates the dependency files, cleans the build state, and verifies the build before committing the security fix.

What is the best way to manage branch creation and pull requests for security fixes?▼

Managing branch creation and pull requests for security fixes is best handled by automating the entire workflow. This skill creates dedicated branches for each fix, commits the updated go.mod files, verifies the build, and prepares a pull request to reduce manual effort.

Does automated CVE fixing support parallel execution across different branches?▼

Automated CVE fixing does support parallel execution across multiple repositories and branches. This allows development teams to patch critical vulnerabilities affecting numerous microservices simultaneously, significantly reducing the time-to-patch and manual intervention.

Related Skills

Explore More Software Engineering Skills→
motlinmotlin
14

git-workflow

Standardize git commits, rebasing, conflict resolution, and branch management.

Community
Basic
korchasakorchasa

agent-tech-lead-review

Automate final pull request review and merge in an SDLC pipeline.

Community
Advanced
yu-iskwyu-iskw

security-vulnerability-audit

Audits security vulnerabilities using Trunk CLI, Trivy and OSV-scanner.

Community
Intermediate
grafanagrafana
5.4k

fix-vendor-conflicts

Diagnose and resolve vendor conflicts during Go dependency upgrades.

Official
Advanced