dependency-cve-triage

---

name: dependency-cve-triage description: Triage workflow for dependency vulnerabilities: determine reachability, impact, and safe upgrade/remediation plan.

Use this skill when asked to triage CVEs, decide upgrade priority, or prepare remediation tickets.

Step-by-step process

1. Confirm the vulnerable component
   • Package name, affected versions, transitive vs direct dependency
2. Assess reachability
   • Is the vulnerable code path used? Under what configuration?
   • Is it internet-exposed or behind auth?
3. Assess impact
   • RCE vs info leak vs DoS; required privileges; exploit maturity
4. Choose a remediation
   • Upgrade to a fixed version (preferred)
   • Pin/override transitive versions
   • Disable the vulnerable feature/code path
   • Compensating controls (WAF rules, config hardening) as a stopgap
5. Plan the change
   • Minimal version jump, note breaking changes
   • Add regression tests for the vulnerable behavior if practical
6. Document
   • Ticket with: affected services, urgency, change plan, validation steps

Output template

• CVE / Package
• Affected versions / current version
• Exploit preconditions
• Reachability assessment
• Recommended fix
• Validation / rollout notes

Repo integration (optional)

Related prompt:

• dependency-cve-triage.prompt.md