skills.rest
chainloop-dev
chainloop-devOFFICIAL
Explore all skills by this author →
WebsiteGitHub

vulnerability-remediation

Reviews Chainloop vulnerability policy violations and fixes CVEs in Dockerfiles and go.mod.

583|54|Updated Mar 6, 2023
Search Tags:#Dockerfile#cve#sarif#vulnerability remediation#grype#go.mod#chainloop
One-click install
npx skills add https://github.com/chainloop-dev/chainloop --skill vulnerability-remediation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vulnerability-remediation
Source: https://github.com/chainloop-dev/chainloop/tree/main/.claude/skills/vulnerability-remediation
Command: npx skills add https://github.com/chainloop-dev/chainloop --skill vulnerability-remediation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams need to track down failing vulnerability policy checks, locate the affected container images or Go modules, and apply verified fixes. This Skill automates that loop for the chainloop project by pulling compliance results from Chainloop, reading SARIF scan evidence, and applying confirmed upgrades.

Core Features & Use Cases

  • Compliance-driven triage: Queries Chainloop for failing vulnerability policy evaluations and downloads the matching SARIF evidence by digest.
  • Dockerfile remediation: Upgrades the pinned atlas image in app/controlplane/Dockerfile.migrations by digest, verifying candidate versions with grype before and after.
  • Go module remediation: Bumps the Go toolchain or specific dependencies in go.mod for stdlib and third-party CVEs, then runs go mod tidy.
  • Use Case: A daily compliance scan flags CVE-2024-XXXXX in the control-plane-migrations image. The Skill finds the failing material, downloads its SARIF report, confirms a clean atlas version with grype, updates the Dockerfile digest and ATLAS_VERSION references, and opens a signed-off PR.

Quick Start

Ask the assistant to review open vulnerability policy violations for the chainloop project and fix any CVEs found in the Dockerfiles or go.mod.

Frequently Asked Questions about vulnerability-remediation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix vulnerability policy violations in Chainloop?▼

Query the chainloop-best-practices framework compliance for the project version, identify failing vulnerability requirements, download the matching SARIF evidence by digest, then upgrade the affected image or Go module and verify with grype.

How to verify a CVE fix with grype before committing?▼

Run grype with the --only-fixed flag against the current image or directory to confirm the CVE rows appear, then run it against the candidate version to confirm only the header line remains with no CVE rows.

Does this handle Go stdlib vulnerabilities in go.mod?▼

Yes. For stdlib CVEs it upgrades the Go version in go.mod and Dockerfiles, and for third-party modules it runs go get with the fixed version followed by go mod tidy, then verifies with grype.

Why pin Docker images by SHA256 digest instead of tags?▼

Digest pinning guarantees the exact image content is used, preventing tag mutation from silently changing what gets deployed. The Skill pulls the new version, extracts its RepoDigest, and updates the FROM line with the full sha256 digest.

What if the latest stable atlas image still has CVEs?▼

Check the latest tag, which atlas rebuilds frequently with an updated Go toolchain. If it scans clean and the version is a reasonable increment, it is acceptable because the image is pinned by digest.

Related Skills

Explore More Software Engineering Skills→
dashkandashkan
1

golang-continuous-integration

Generate GitHub Actions CI/CD workflows for Go projects with testing, linting, and security scanning.

Community
Advanced
saolalabsaolalab
37

vulnerability-management

Track security vulnerabilities with CVSS severity mapping and SLA-aligned remediation timelines.

Official
Intermediate
luissimon96luissimon96

graph-dependency

Audit dependencies, generate SBOMs, and check license compliance for software projects.

Community
Advanced
j4hr3nj4hr3n

sca-audit

Identify and triage CVEs in project dependencies across multiple ecosystems.

Community
Advanced