Cve fix

Skill submariner-io/shipyard/skills/cve-fix

Fix CVEs in Go repositories. Arguments are optional and order-independent. TRIGGER when user asks to fix CVEs, scan for vulnerabilities, or mentions grype/CVE/GHSA.From its SKILL.md

Install

npx -y skills add submariner-io/shipyard --skill cve-fix

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

SKILL.md

4.0 KB, as published. Nobody here has run it

CVE Fix Workflow

Do not read, debug, or modify the CVE scripts.

Single Repo (default)

If the arguments do NOT contain all, run this command exactly as written:

#!/bin/bash
set -euo pipefail

# Find scripts directory
CVE_SCRIPTS=""
for d in "$(pwd)/skills/cve-fix/scripts" \
         "$HOME/.claude/plugins/cve-fix/scripts"; do
  [[ -d "$d" ]] && CVE_SCRIPTS="$d" && break
done
if [[ -z "$CVE_SCRIPTS" ]]; then
  echo "ERROR: Cannot find skills/cve-fix/scripts/ directory"
  exit 1
fi

exec bash "$CVE_SCRIPTS/fix-all.sh" $ARGUMENTS

fix-all.sh does everything: detect config, create fix branch, scan for CVEs, fix each deterministically, run tests, agent-review all results, and print the PR command.

Exit code 0: All CVEs addressed. Review commits and run the printed PR command.

Exit code 2: Some CVEs unresolved after review.

Exit code 1: Error.

Multi-Repo ("all")

If the arguments contain all (e.g., /cve-fix all 0.23), do NOT run the bash block above. Instead:

Find the skill directory: look for skills/cve-fix/ in the current repo, or under ~/.claude/plugins/.
Read repos.yaml from that directory for the list of repo names.
Extract the branch from the remaining arguments (e.g., 0.23).
Spawn one Agent per repo. Each agent should run bash SKILL_DIR/scripts/fix-all.sh NAME BRANCH via the Bash tool (not the Skill tool, which times out in subagents).

Report per repo: CVEs found, fixed, ignored, and PR command. On errors or timeout, run bash SKILL_DIR/scripts/clean.sh before reporting. Never modify the CVE fix scripts themselves.

Usage

/cve-fix - current repo, current branch
/cve-fix 0.23 - current repo, specified branch
/cve-fix submariner-operator 0.24 - repo name from repos.yaml
/cve-fix /absolute/path/to/repo 0.24 - absolute path
/cve-fix all 0.23 - all repos in repos.yaml

Arguments are order-independent. Short versions like 0.23 auto-expand to release-0.23. Repos are absolute paths or names from repos.yaml.

From the command line (without Claude):

make -C skills/cve-fix fix REPO=submariner-operator BRANCH=0.24   # repo from repos.yaml
make -C skills/cve-fix fix REPO=/absolute/path BRANCH=0.24        # absolute path
make -C skills/cve-fix all BRANCH=0.23                            # all repos
make -C skills/cve-fix test                                       # run unit tests

Per-Repo Configuration

Place a .cve-fix.yaml file in the repo root to override auto-detected settings. All fields are optional — omitted fields use auto-detected defaults.

Field	Default	Description
`build-command`	`make build` if target exists	Build before scanning (needed for stdlib CVEs)
`clean-command`	`make clean` if target exists	Clean artifacts before scan
`test-command`	`make unit` > `make test` > `go test ./...`	Verify build after fixes
`build-image`	(none)	Container image for Go version detection
`k8s-version-guard`	`false`	Treat K8s minor bumps as breaking changes
`upstream-org`	(from git remote)	GitHub org for PR command generation
`unset-env`	(none)	Env vars to unset before build/test

Common Issues

Issue	Solution
CVE persists after fix	Verify FIXED-IN version; check for replace directives
New CVE appears after fix	Dependency downgrade introduced it; fix immediately
Tests fail	Try different version; check CI logs
Container "no route to host"	Run `sudo systemctl restart docker` or `sudo systemctl restart podman`
Stdlib CVEs	Fixed via go directive update. Check build image Go version if CI fails
Git fetch fails	Run `git fetch` manually before starting