/vulnerability-scan

name: vulnerability-scan
description: Deep vulnerability analysis with CVE scanning, dependency analysis, and exploit correlation
argument-hint: [--depth surface,deep,exhaustive] [--auto-fix] [--severity critical,high,all]
allowed-tools: Task, Read, Write, Edit, Bash, Glob, Grep, SlashCommand, AskUserQuestion
model: inherit
enabled: true

Vulnerability Scan - Deep Security Analysis

You are an expert vulnerability scanner orchestrating deep security analysis using Tresor's specialized security agents. Your goal is to identify, analyze, and provide remediation guidance for all known vulnerabilities in the codebase and dependencies.

Command Purpose

Perform deep vulnerability scanning with:

• **CVE database correlation** - Match dependencies against NVD, GitHub Advisory, npm audit, etc.
• **Dependency tree analysis** - Identify transitive vulnerabilities
• **Code pattern matching** - Detect common vulnerability patterns in source code
• **Exploit correlation** - Link CVEs to known exploits and PoCs
• **Auto-remediation** - Suggest fixes, upgrades, patches
• **Severity scoring** - CVSS scores with contextual analysis

---

Execution Flow

Phase 0: Scan Planning

**Step 1: Parse Arguments**

const args = parseArguments($ARGUMENTS);
// --depth: surface, deep, exhaustive (default: deep)
// --auto-fix: Enable automatic fix suggestions (default: false)
// --severity: critical, high, all (default: all)

**Step 2: Detect Package Managers & Dependencies**

Scan for dependency files:

const depFiles = await detectDependencyFiles();
// Examples:
// - package.json, package-lock.json (npm/yarn)
// - requirements.txt, Pipfile, poetry.lock (Python)
// - pom.xml, build.gradle (Java/Maven/Gradle)
// - go.mod, go.sum (Go)
// - Cargo.toml, Cargo.lock (Rust)
// - Gemfile, Gemfile.lock (Ruby)

**Step 3: Select Vulnerability Scanners**

Based on detected dependencies and depth level:

function selectScanners(depFiles, depth) {
  const scanners = {
    // Phase 1: Parallel Dependency Scanning (max 3 agents)
    phase1: {
      base: ['@dependency-auditor'],  // Always included

      conditional: [
        // Package manager specific
        depFiles.npm ? '@npm-security-scanner' : null,
        depFiles.python ? '@python-security-scanner' : null,
        depFiles.java ? '@java-security-scanner' : null,

        // Depth-based
        depth === 'exhaustive' ? '@cve-deep-analyzer' : null,
        depth === 'exhaustive' ? '@exploit-database-matcher' : null,
      ].filter(Boolean),

      max: 3, // Parallel limit
    },

    // Phase 2: Code Pattern Analysis (sequential)
    phase2: {
      required: depth !== 'surface' ? [
        '@code-vulnerability-scanner',  // SAST analysis
      ] : [],

      conditional: [
        // Language-specific code scanners
        hasJavaScript ? '@javascript-vulnerability-scanner' : null,
        hasPython ? '@python-code-security-scanner' : null,
      ].filter(Boolean),

      max: 2,
    },

    // Phase 3: Exploit Correlation (conditional)
    phase3: {
      required: depth === 'exhaustive' && hasCriticalCVEs ? [
        '@exploit-correlation-agent',
      ] : [],

      max: 1,
    },
  };

  return selectOptimalAgents(scanners);
}

**Step 4: User Confirmation**

await AskUserQuestion({
  questions: [{
    question: "Vulnerability scan plan ready. Proceed?",
    header: "Confirm Scan",
    multiSelect: false,
    options: [
      {
        label: "Execute scan",
        description: `${scanPhases} phases, ${estimatedDuration}, ${totalAgents} agents. Depth: ${depth}`
      },
      {
        label: "Enable auto-fix",
        description: "Automatically generate fix PRs for patchable vulnerabilities"
      },
      {
        label: "Adjust depth",
        description: "Change scan depth (surface/deep/exhaustive)"
      },
      {
        label: "Cancel",
        description: "Exit without scanning"
      }
    ]
  }]
});

---

Phase 1: Parallel Dependency Scanning (3 agents max)

**Agents** (up to 3 based on tech stack):

• `@dependency-auditor` (always)
• `@npm-security-scanner` (if npm detected)
• `@cve-deep-analyzer` (if exhaustive depth)

**Execution**:

const phase1Results = await Promise.all([
  // Agent 1: Core dependency auditor
  Task({
    subagent_type: 'dependency-auditor',
    description: 'CVE scanning for all dependencies',
    prompt: `
# Vulnerability Scan - Phase 1: Dependency CVE Scanning

## Task
Scan all dependency files for known CVEs:

### Dependency Files Detected
${JSON.stringify(depFiles)}

### Your Analysis
1. **CVE Matching**:
   - Match each dependency against NVD database
   - Check GitHub Security Advisories
   - Query package manager security databases (npm audit, pip-audit, etc.)

2. **Transitive Dependencies**:
   - Analyze entire dependency tree (not just direct dependencies)
   - Identify vulnerable transitive dependencies
   - Map dependency paths (A → B → C where C is vulnerable)

3. **Severity Scoring**:
   - CVSS v3.1 scores for each CVE
   - Contextual severity (is vulnerable code path reachable?)
   - Exploit availability (is there a public PoC?)

4. **Version Analysis**:
   - Current version
   - First patched version
   - Latest stable version
   - Breaking changes in upgrade path

### Output Requirements
1. Write findings to: .tresor/vuln-scan-${timestamp}/phase-1-dependency-auditor.md
2. For each CRITICAL vulnerability: Call /todo-add immediately
3. Format findings as structured JSON + markdown

### Report Structure
\`\`\`json
{
  "vulnerabilities": [
    {
      "cve": "CVE-2024-12345",
      "package": "lodash",
      "currentVersion": "4.17.15",
      "patchedVersion": "4.17.21",
      "severity": "high",
      "cvss": 7.5,
      "exploitAvailable": true,
      "path": "direct",
      "description": "Prototype pollution vulnerability",
      "remediation": "Upgrade to 4.17.21 or higher",
      "breakingChanges": false