---

name: cve-source-check promoted_to: deploy description: "Audit CVE/vulnerability source coverage for a technology stack. Maps each component (container, library, base image, runtime) to authoritative CVE feeds, flags gaps, and produces audit-ready reports. Generic: works for any service or stack." user-invocable: false argument-hint: "[--inventory <file>] [--inline <tech-list>] [--current-sources <file>] [--service <name>] [--check-urls]" allowed-tools:

• Bash
• Read
• Write
• Edit
• Glob
• Grep routing: triggers:
  • "check cve sources"
  • "cve source coverage"
  • "audit cve feeds"
  • "vulnerability source audit"
  • "verify cve sources"
  • "security feed audit" category: infrastructure complexity: Simple pairs_with:
  • assessment

---

CVE Source Check

Audit CVE/vulnerability source coverage for a technology stack. Maps components to authoritative CVE feeds via a versioned registry, flags gaps, and produces audit-ready reports (JSON + Markdown).

In scope: component-to-feed mapping, coverage/gap reporting, optional URL reachability checks. Out of scope: running scanners (Trivy/Snyk), fetching CVE content, private vuln databases.

Quick Start

# Inline, offline
python3 scripts/check-cve-sources.py \
  --inline "go@1.22,alpine@3.19,postgres@16,redis@7,nginx@1.25" \
  --service my-service

# Inventory + monitored feeds + link verification
python3 scripts/check-cve-sources.py \
  --inventory examples/inventory.example.json \
  --current-sources examples/current-sources.example.txt \
  --service my-service --check-urls

Inputs

| Flag | Purpose | |---|---| | --inventory <file> | JSON: [{name, version?, type?}, ...] or {components: [...]}. | | --inline "name@ver,..." | Comma-separated list. Mutually exclusive with --inventory. | | --current-sources <file> | One URL per line. # comments and blank lines skipped. | | --service <name> | Name for report header and filenames. | | --check-urls | HEAD-check every source URL (5s timeout, graceful degradation). | | --registry <path> | Override default tech-source-registry.json. | | --out-dir <path> | Output directory (default: cwd). |

JSON only. YAML not supported (no stdlib parser).

Outputs

Files: cve-source-report-{service}-{YYYYMMDD}.{md,json} in --out-dir.

| Exit | Meaning | |---|---| | 0 | Full coverage. | | 1 | Gaps (unmapped components or unmonitored sources). | | 2 | Unreachable source URL (only with --check-urls). | | 3 | Input error (missing/malformed registry or inventory). |

Workflow

Phase 1: LOAD

1. Locate tech-source-registry.json (next to SKILL.md by default, or --registry).
2. Build inventory from --inventory (JSON list or {components: [...]}) or --inline (comma-split name@version).
3. If --current-sources provided, read URLs and normalize for case-insensitive comparison.

Gate: at least one component present. Empty inventory -> exit 3.

Phase 2: MAP & VERIFY

1. Look up each component name (and aliases) in the registry.
   • Found -> mapped, attach source list. Missing -> unmapped, sources [].
2. If current sources loaded, mark each source monitored: true when its normalized URL appears.
3. If --check-urls: HEAD-check each unique URL. Treat 200/301/302/403/405 as reachable. 4xx (except 403/405) and 5xx -> reachable: false. Timeout/DNS/TLS failure -> reachable: null (WARN, does not affect exit code). 5s timeout per URL, cached per run.

Gate: every component has status; every source has monitored and reachable fields.

Phase 3: REPORT

1. Compute summary: components, mapped/unmapped, monitored, coverage %, gaps, unreachable.
2. Write JSON report with per-component status and per-source monitored/reachable fields.
3. Write Markdown report: summary table, components table (markers), gaps section (when gaps exist), unmapped section (when unmapped exist).
4. Print one-screen summary to stdout. Set exit code per table above.

Gate: both files written, summary printed.

Registry Schema

tech-source-registry.json shape:

{
  "$schema_version": "1.0",
  "kinds": ["advisory-list", "github-security", "mailing-list", "distro-tracker", "vendor-page", "mitre"],
  "priorities": ["primary", "secondary"],
  "technologies": [
    {"name": "postgres", "aliases": ["postgresql","pg"], "type": "container",
     "sources": [{"url": "https://...", "kind": "advisory-list", "priority": "primary"}]}
  ]
}

Each technology: name (lowercase, unique), aliases (list), type (runtime/base-image/container/library), sources (1-3, at least one primary).

To add a technology: pick canonical name, list aliases, add 1-3 sources (lead with vendor advisory page), re-run against a sample inventory.

Error Handling

| Error | Cause | Fix | |---|---|---| | Failed to load registry | Missing or malformed JSON | Validate with python3 -m json.tool | | Failed to load inventory | Missing, malformed, or wrong shape | Validate JSON; must be list or {components: [...]} | | Inventory empty | No usable components | Each entry needs name. Inline needs non-empty tokens. | | Coverage stuck at 0% | --current-sources URLs don't match registry | Copy URLs from registry. Scheme/host case and trailing slash are normalized; rest must match. | | Many [--] entries with --check-urls | Network issues | Re-run without --check-urls. Network errors don't affect gap exit code. |