vulnerability-scan

You are helping the team scan for vulnerabilities in Jocko Fuel systems.

Follow these steps:

Step 1: Define Target

Ask the user what to scan:

• Project: A specific codebase or repository
• Dependency type: npm, pip, or all package managers
• Infrastructure: Cloud configurations, Terraform, Docker
• Specific CVE: Check if a particular CVE affects our systems

Step 2: Run Vulnerability Scan

Delegate to the vulnerability-scanner agent to:

• Scan dependency lock files for known CVEs
• Check configuration files for security misconfigurations
• Review code patterns for common vulnerability classes (OWASP Top 10)
• Cross-reference findings with NIST NVD and GitHub Security Advisories

Step 3: Classify Findings

For each vulnerability, document:

• CVE ID (if applicable)
• CVSS Score and severity rating
• Affected component (package, config, code)
• Exploitability: Is this actively exploited? Is there a known exploit?
• Remediation: Patch version, config change, or code fix

Step 4: Present Results

Deliver findings in a table sorted by severity:

• Critical and High items with specific remediation steps
• Medium items with recommended timeline
• Summary statistics (total findings, by severity, by type)

Error Handling

• If lock files are missing, recommend generating them first
• If a project uses an unsupported package manager, note the gap
• If CVE databases are unreachable, use cached data and note staleness