CVE Triage
When to use
This skill begins where the scan ends. It receives a list of CVE hits and decides per item: what's this worth, when do we fix, or do we not? Running the scan and building the SBOM happen elsewhere; this is the filter that separates noise from signal.
Triggers:
- An inbox of Dependabot/Snyk/Mend/osv-scanner/grype/Trivy findings to walk through.
- A new public vulnerability (Log4Shell-style, XZ-style, regreSSHion-style) with the question "does this hit us?".
- A CI
[Description truncada. Veja o README completo no GitHub.]