vulnerability-analysis

---
name: vulnerability-analysis
description: Analyze CVE/GHSA vulnerabilities from multiple sources. Collect vulnerability data (GHSA/NVD/OSV), analyze patches, identify security patterns, construct attack sequences, perform risk assessment. Use when you need to understand a specific vulnerability in depth.
license: MIT
---

# Vulnerability Analysis

Spawn an isolated subagent to handle all data collection and analysis. The agent saves results to disk and returns a clean summary — no API responses or patch diffs pollute the main context.

## How to Use

Extract the vulnerability ID from the user's request (e.g. `CVE-2024-12345` or `GHSA-xxxx-yyyy-zzzz`), then call the Agent tool with `subagent_type: "general-purpose"` and the prompt below, substituting `VULN_ID` with the actual identifier.

After the agent completes, report its summary to the user.

---

## Agent Prompt Template

```
You are performing authorized security research for a vulnerability analysis task.

Target: VULN_ID

---

### Step 1: Setup

Install dependencies (skip if already installed):

    cd .claude/skills/vulnerability-analysis/resources && uv pip install -r requirements.txt

### Step 2: Collect Data

Run this Python to collect vulnerability data:

    import sys, os, json, asyncio
    from pathlib import Path
    _res = next(p for p in [
        Path('.claude/skills/vulnerability-analysis/resources'),
        Path.home() / '.claude/skills/vulnerability-analysis/resources',
    ] if p.exists())
    sys.path.insert(0, str(_res))
    from collectors import collect_vulnerability_data
    from parsers import fetch_and_parse_patches, detect_security_patterns

    vuln_data = asyncio.run(collect_vulnerability_data("VULN_ID"))

    os.makedirs("VULN_ID", exist_ok=True)
    with open("VULN_ID/vuln_data.json", "w") as f:
        json.dump(vuln_data, f, indent=2)

    print(f"Title: {vuln_data['title']}")
    print(f"Severity: {vuln_data['severity']}, CVSS: {vuln_data.get('cvss_score')}")
    print(f"Patch URLs: {vuln_data.get('patch_urls', [])}")

If patch URLs are present, fetch and parse them:

    patches = asyncio.run(fetch_and_parse_patches(vuln_data['patch_urls']))
    for p in patches:
        patterns = detect_security_patterns(p)
        print(f"File: {p['file_path']}, patterns: {[x['pattern'] for x in patterns]}")

### Step 3: Analyze

Using the vulnerability description, patches, and detected patterns, reason through:

1. Security pattern — what class of bug is this? (injection, crypto weakness, auth bypass, etc.)
2. Exploit flow — step-by-step attack: what does the attacker do, what are the prerequisites, what succeeds?
3. Risk assessment — CIA triad impacts (HIGH/LOW/NONE), attack vector (NETWORK/LOCAL), complexity, privileges required

### Step 4: Build and Save Report

    from models import (SecurityPattern, ExploitStep, ExploitFlow,
                        RiskAssessment, VulnerabilityAnalysis, VulnerabilityReport)

    pattern = SecurityPattern(
        pattern_type="...",         # e.g. CRYPTO_WEAKNESS, SQL_INJECTION
        description="...",
        exploitability_score=0.0,   # 0.0-1.0
        significance="...",
        evidence=[...]
    )

    exploit_flow = ExploitFlow(
        steps=[
            ExploitStep(
                step_number=1,
                action="...",
                prerequisites=[...],
                expected_outcome="...",
                technical_details="..."
            ),
            # ... more steps
        ],
        overall_complexity="MEDIUM",  # TRIVIAL/LOW/MEDIUM/HIGH/VERY_HIGH
        prerequisites=[...],
        success_indicators=[...]
    )

    risk = RiskAssessment(
        risk_level="HIGH",
        confidentiality_impact="HIGH",
        integrity_impact="LOW",
        availability_impact="NONE",
        attack_vector="NETWORK",
        attack_complexity="LOW",
        privileges_required="NONE",
        user_interaction="NONE",
        mitigations=[...],
        reasoning="..."
    )

    analysis = VulnerabilityAnalysis(
        patterns=[pattern],
        exploit_flow=exploit_flow,
        risk_assessment=risk,
        key_insights=[...],
        confidence_score=0.85,
        analysis_notes="..."
    )

    report = VulnerabilityReport(
        id=vuln_data['id'],
        title=vuln_data['title'],
        description=vuln_data['description'],
        severity=vuln_data['severity'],
        cvss_score=vuln_data.get('cvss_score'),
        cwe_ids=vuln_data.get('cwe_ids', []),
        affected_packages=vuln_data.get('affected_packages', []),
        patch_urls=vuln_data.get('patch_urls', []),
        references=vuln_data.get('references', []),
        analysis=analysis
    )

    with open("VULN_ID/vulnerability_analysis.json", "w") as f:
        json.dump(report.model_dump(), f, indent=2)

### Step 5: Return Summary

Return ONLY a concise summary — not the full JSON. Include:
- Title, severity, CVSS score
- 2-3 key insights
- Exploit complexity and risk level
- Confidence score
- Saved report path: VULN_ID/vulnerability_analysis.json
```

---

See `reference.md` for full API documentation, `examples.md` for a complete real-world walkthrough, and `troubleshooting.md` for common errors.