ai-helpers

Overview

This skill acts as a mandatory triage gate before any software fix attempt. It automatically fetches vulnerability data, clones repositories, checks dependency manifests across multiple ecosystems (Python, Go, Node.js), performs semantic version and symbol comparisons, classifies the impact into standardized verdicts, outputs detailed markdown assessment artifacts, and synchronizes status comments back to Jira.

Capabilities

• ▸Fetch vulnerability advisories from NVD, GitHub Security Advisories, and Go vulnerability database
• ▸Clone target repositories and check out specific branches safely
• ▸Scan requirements.txt, pyproject.toml, go.mod, and package.json for vulnerable package versions
• ▸Compare installed vs fixed package versions across ecosystems
• ▸Perform code symbol analysis using govulncheck and import grep
• ▸Classify vulnerability impact verdicts (package-bump, go-stdlib, rpm-layer, code-change-required, not-affected)
• ▸Generate structured markdown assessment artifacts
• ▸Post automated status comments to Jira

Best for

Triage incoming CVE alerts for software repositories, Determine if a specific project is actually affected by a vulnerability, Classify vulnerabilities into actionable fix categories like package bumps or code changes, Generate standardized vulnerability assessment reports and sync comments to Jira

Works with

Security considerations

Executes shell scripts, interacts with external advisory databases via curl, clones git repositories from remote URLs, and updates external Jira tickets.

Categories