/arn-code-batch-cve-scan

name: arn-code-batch-cve-scan
description: >-
  This skill should be used when the user says "scan for CVEs", "CVE scan",
  "check for vulnerabilities", "dependabot triage", "audit dependencies",
  "security scan", "arness CVE scan", "arn-code-batch-cve-scan",
  "run a scheduled CVE scan", "finalize a CVE proposal", or wants Arness to
  discover, triage, and ticket security advisories across project dependencies
  (GitHub Dependabot plus locally-detected scanners). Three modes: interactive,
  proposal (unattended, safe for Routines or claude -p), and finalize (review a
  proposal and file tickets on GitHub or Jira).
version: 1.0.0
argument-hint: "[--mode=interactive|proposal|finalize] [--proposal-path=<path>]"

Arness Batch CVE Scan

Discover, triage, and ticket security advisories across project dependencies. Dual-source CVE discovery (GitHub Dependabot + locally-detected scanners), per-CVE triage via the `arn-code-cve-analyst` agent, project-existing waiver capture, and pre-triage parent + per-group sub-issue ticketing. All scanner / waiver / tracker detection is **evidence-based** — this skill never enumerates tool names; everything delegates to `<code-patterns-dir>/security-scanning.md` (written by the `arn-code-codebase-analyzer` agent).

**Three modes** (`--mode=<value>`):

• `interactive` (default): full ergonomics, inline ticketing, prompts for waivers, `AskUserQuestion` available.
• `proposal`: ZERO user prompts, ZERO writes to GitHub / Jira / project waiver files; emits a `CVE_SCAN_PROPOSAL.md` + `.json` sidecar that finalize mode consumes. Safe to schedule via Claude Code Routines or `claude -p` headless.
• `finalize`: reads a previously-emitted proposal, walks `needs-review` items via `AskUserQuestion`, applies deferred writes behind a single consent gate.

This skill is a **sequencer** — it MUST NOT duplicate sub-reference logic. All procedural detail lives in `references/`. The body below names the steps and points to the right reference.

Pipeline position:

                  arn-code-codebase-analyzer (security-scanning.md)
                                  │
                                  ▼
                  **arn-code-batch-cve-scan** (3 modes)
                                  │
                  dispatches per-CVE
                                  │
                                  ▼
                  arn-code-cve-analyst (per-CVE triage)
                                  │
                                  ▼
                  Ticketing (interactive / proposal-render / finalize-POST)
                                  │
                                  ▼
                  arn-code-batch-cve-fix (consumes tickets)

---

Step 0: Ensure Configuration

Read `${CLAUDE_PLUGIN_ROOT}/skills/arn-code-ensure-config/references/step-0-fast-path.md` and follow its instructions. This guarantees `## Arness` is configured with Arness Code fields.

After ensure-config completes, extract from `## Arness`:

• **Security scanning** — `enabled | none | skip`. If `none` or `skip`, inform the user: "Security scanning is set to `<value>`. Update the `Security scanning:` field in `## Arness` to `enabled` to run this skill." STOP.
• **Security branch** — branch name or `auto`. If `auto`, resolve via `git symbolic-ref --short refs/remotes/origin/HEAD`. This is the branch the skill scans (NEVER the working tree).
• **Code patterns** — directory containing `security-scanning.md`.
• **Issue tracker** — `github | jira | none`. Drives the ticketing or no-tracker-fallback branch.
• **Plans directory** — base path for proposal-artifact and no-tracker-fallback outputs.
• **Platform** — `github | jira | none`. Used for visibility detection.

If `Security scanning:` or `Security branch:` is missing, Layer 2c will have prompted the user via `AskUserQuestion` and written the chosen value. This skill consumes the field — it does not write it.

If `<code-patterns-dir>/security-scanning.md` is missing, inform the user: "Security scanning is enabled but `security-scanning.md` was not found. Re-run `arn-code-ensure-config` or invoke `arn-code-codebase-analyzer` directly to generate it." STOP.

---

Step 1: Mode Selection

Read `${CLAUDE_PLUGIN_ROOT}/skills/arn-code-batch-cve-scan/references/modes.md` and follow its CLI parsing procedure. Set the `mode` variable (one of `interactive`, `proposal`, `finalize`) used throughout the rest of the skill.

The hard rules per mode are the canonical contract every other reference must satisfy. If you find yourself unsure about reachability of `AskUserQuestion` or write semantics at any later step, return to `modes.md`.

---

Step 2: Stale Advisory-DB Gate

Read `${CLAUDE_PLUGIN_ROOT}/skills/arn-code-batch-cve-scan/references/stale-db.md` and follow its procedure. Mode-aware:

• `interactive`: prompt the user for `--allow-stale-db` justification on stale DB.
• `proposal`: refuse without prompting; record `needs-review: stale-db` in the proposal; exit non-zero so the scheduler flags the failure.
• `finalize`: not relevant (finalize works against the proposal's frozen scanner output).

---

Step 3: Branch Existence Validation

Validate that `<security-branch>` exists on the remote:

git ls-remote --exit-code origin "<security-branch>"

If the branch is missing:

• `interactive`: prompt the user for a corrected branch name (`AskUserQuestion`).
• `proposal`: write `needs-review: branch-missing` to the proposal and exit non-zero.
• `finalize`: not relevant.

This validation runs only in `interactive` and `proposal` modes (`finalize` consumes a frozen proposal that already passed this check).

---

Step 4: Discovery (Dual-Source)

Skip in `finalize` mode (the proposal already contains the frozen discovery output).

Read `${CLAUDE_PLUGIN_ROOT}/skills/arn-code-batch-cve-scan/references/discovery.md` and follow its dual-source procedure. Discovery is read-only and identical in `interactive` and `proposal` modes.

All manifest and lock