/arn-code-batch-cve-scan

name: arn-code-batch-cve-scan
description: >-
  This skill should be used when the user says "scan for CVEs", "CVE scan",
  "check for vulnerabilities", "find vulnerabilities", "check security advisories",
  "dependabot triage", "dependabot scan", "scan dependencies for security issues",
  "audit dependencies", "vulnerability triage", "security scan", "run security audit",
  "arness CVE scan", "arn-code-batch-cve-scan", "run a scheduled CVE scan",
  "produce a CVE proposal", "finalize a CVE proposal", or wants Arness to discover,
  triage, and ticket security advisories across project dependencies. Supports
  three modes (interactive, proposal, finalize) so the workflow is safe to schedule
  unattended via Claude Code Routines and tool-agnostic enough to drive headlessly
  via claude -p or any LLM-running CLI. Dual-source discovery (GitHub Dependabot
  plus locally-detected scanners), per-CVE triage via arn-code-cve-analyst,
  project-native waiver capture, and pre-triage parent plus per-group sub-issue
  ticketing on GitHub or Jira. Reads from the configured Security branch.

Arness Batch CVE Scan

Discover, triage, and ticket security advisories across project dependencies. Dual-source CVE discovery (GitHub Dependabot + locally-detected scanners), per-CVE triage via the `arn-code-cve-analyst` agent, project-existing waiver capture, and pre-triage parent + per-group sub-issue ticketing. All scanner / waiver / tracker detection is **evidence-based** — this skill never enumerates tool names; everything delegates to `<code-patterns-dir>/security-scanning.md` (written by Phase 1's codebase-analyzer extension).

**Three modes** (`--mode=<value>`):

• `interactive` (default): full ergonomics, inline ticketing, prompts for waivers, `AskUserQuestion` available.
• `proposal`: ZERO user prompts, ZERO writes to GitHub / Jira / project waiver files; emits a `CVE_SCAN_PROPOSAL.md` + `.json` sidecar that finalize mode consumes. Safe to schedule via Claude Code Routines or `claude -p` headless.
• `finalize`: reads a previously-emitted proposal, walks `needs-review` items via `AskUserQuestion`, applies deferred writes behind a single consent gate.

This skill is a **sequencer** — it MUST NOT duplicate sub-reference logic. All procedural detail lives in `references/`. The body below names the steps and points to the right reference.

Pipeline position:

                  arn-code-codebase-analyzer (security-scanning.md)
                                  │
                                  ▼
                  **arn-code-batch-cve-scan** (3 modes)
                                  │
                  dispatches per-CVE
                                  │
                                  ▼
                  arn-code-cve-analyst (per-CVE triage)
                                  │
                                  ▼
                  Ticketing (interactive / proposal-render / finalize-POST)
                                  │
                                  ▼
                  arn-code-batch-cve-fix (consumes tickets)

---

Step 0: Ensure Configuration

Read `${CLAUDE_PLUGIN_ROOT}/skills/arn-code-ensure-config/references/step-0-fast-path.md` and follow its instructions. This guarantees `## Arness` is configured with Arness Code fields.

After ensure-config completes, extract from `## Arness`:

• **Security scanning** — `enabled | none | skip`. If `none` or `skip`, inform the user: "Security scanning is set to `<value>`. Update the `Security scanning:` field in `## Arness` to `enabled` to run this skill." STOP.
• **Security branch** — branch name or `auto`. If `auto`, resolve via `git symbolic-ref --short refs/remotes/origin/HEAD`. This is the branch the skill scans (NEVER the working tree).
• **Code patterns** — directory containing `security-scanning.md`.
• **Issue tracker** — `github | jira | none`. Drives the ticketing or no-tracker-fallback branch.
• **Plans directory** — base path for proposal-artifact and no-tracker-fallback outputs.
• **Platform** — `github | jira | none`. Used for visibility detection.

If `Security scanning:` or `Security branch:` is missing, Layer 2c will have prompted the user via `AskUserQuestion` and written the chosen value (see Phase 5 wiring). This skill consumes the field — it does not write it.

If `<code-patterns-dir>/security-scanning.md` is missing, inform the user: "Security scanning is enabled but `security-scanning.md` was not found. Re-run `arn-code-ensure-config` or invoke `arn-code-codebase-analyzer` directly to generate it." STOP.

---

Step 1: Mode Selection

Read `${CLAUDE_PLUGIN_ROOT}/skills/arn-code-batch-cve-scan/references/modes.md` and follow its CLI parsing procedure. Set the `mode` variable (one of `interactive`, `proposal`, `finalize`) used throughout the rest of the skill.

The hard rules per mode are the canonical contract every other reference must satisfy. If you find yourself unsure about reachability of `AskUserQuestion` or write semantics at any later step, return to `modes.md`.

---

Step 2: Stale Advisory-DB Gate

Read `${CLAUDE_PLUGIN_ROOT}/skills/arn-code-batch-cve-scan/references/stale-db.md` and follow its procedure. Mode-aware:

• `interactive`: prompt the user for `--allow-stale-db` justification on stale DB.
• `proposal`: refuse without prompting; record `needs-review: stale-db` in the proposal; exit non-zero so the scheduler flags the failure.
• `finalize`: not relevant (finalize works against the proposal's frozen scanner output).

---

Step 3: Branch Existence Validation

Validate that `<security-branch>` exists on the remote:

git ls-remote --exit-code origin "<security-branch>"

If the branch is missing:

• `interactive`: prompt the user for a corrected branch name (`AskUserQuestion`).
• `proposal`: write `needs-review: branch-missing` to the proposal and exit non-zero.
• `finalize`: not relevant.

This validation runs only in `interactive` and `proposal` modes (`finalize` consumes a froz