/engage.cvediff
Find the canonical fix commit(s) for a CVE across sources, then diff for root cause
> /plugin marketplace add hypnguyen1209/offensive-claude > /plugin install offensive-claude@offensive-claude-marketplace
How it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/engage.cvediff
Context preview
What this command does when you run it.
Find the canonical fix commit(s) for a CVE across sources, then diff for root cause
Command definition
engage.cvediff.mddescription: Find the canonical fix commit(s) for a CVE across sources, then diff for root cause
/engage.cvediff
Locates the fix commit(s) for a CVE across OSV / NVD / GitHub Advisories, de-duplicates them, and optionally clones (scope-gated, hardened) to emit `git diff fix^..fix` — the start of n-day patch diffing. Feeds `skills/reverse-engineering/references/patch-diffing-protocol.md` and can chain into `/engage.crash` for root-cause + exploitability.
Usage
`/engage.cvediff <CVE-id> [--source osv,nvd,ghsa] [--diff --repo <url> --sha <fix>]`
Process
1. **Discover** — `cve_diff.py find <CVE>` queries each source, extracts every commit reference (github/gitlab/cgit + OSV GIT-range `fixed` events), merges by (repo, sha). A source that errors is recorded, not fatal. 2. **Pick the canonical fix** — prefer a commit confirmed by ≥2 sources (`also_in`); verify the SHA exists in the repo before trusting it. 3. **Diff (gated)** — `cve_diff.py diff <CVE> --repo <url> --sha <fix> --scope .engage/scope/scope.json`. The repo host is checked against `scope_guard` FIRST (out-of-scope ⇒ refused, exit 3); the clone runs through `safe_subprocess.git_safe` (no hooks/prompt/host-config/ext-transport/symlinks). 4. **Root cause** — feed the diff into patch-diffing (BinDiff/ghidriff for binaries) or read it directly; optionally `/engage.crash` to prove reachability + empirical exploitability.
Notes
- Read-only public advisory APIs; the clone is the only state-changing step and it is scope-gated.
- A missing/ownership-changed fix commit is common — corroborate across sources; a single source is
often wrong or stale.
Read more
description: Find the canonical fix commit(s) for a CVE across sources, then diff for root cause
/engage.cvediff
Locates the fix commit(s) for a CVE across OSV / NVD / GitHub Advisories, de-duplicates them, and optionally clones (scope-gated, hardened) to emit `git diff fix^..fix` — the start of n-day patch diffing. Feeds `skills/reverse-engineering/references/patch-diffing-protocol.md` and can chain into `/engage.crash` for root-cause + exploitability.
Usage
`/engage.cvediff <CVE-id> [--source osv,nvd,ghsa] [--diff --repo <url> --sha <fix>]`
Process
1. **Discover** — `cve_diff.py find <CVE>` queries each source, extracts every commit reference (github/gitlab/cgit + OSV GIT-range `fixed` events), merges by (repo, sha). A source that errors is recorded, not fatal. 2. **Pick the canonical fix** — prefer a commit confirmed by ≥2 sources (`also_in`); verify the SHA exists in the repo before trusting it. 3. **Diff (gated)** — `cve_diff.py diff <CVE> --repo <url> --sha <fix> --scope .engage/scope/scope.json`. The repo host is checked against `scope_guard` FIRST (out-of-scope ⇒ refused, exit 3); the clone runs through `safe_subprocess.git_safe` (no hooks/prompt/host-config/ext-transport/symlinks). 4. **Root cause** — feed the diff into patch-diffing (BinDiff/ghidriff for binaries) or read it directly; optionally `/engage.crash` to prove reachability + empirical exploitability.
Notes
- Read-only public advisory APIs; the clone is the only state-changing step and it is scope-gated.
- A missing/ownership-changed fix commit is common — corroborate across sources; a single source is
often wrong or stale.
A spec-driven offensive security framework for Claude Code — structured engagement workflows based on the Cyber Kill Chain, 31 kill-chain skills (multi-file progressive-disclosure) plus a discipline layer (a SessionStart dispatcher + 6 process/discipline
Repo: hypnguyen1209/offensive-claude
Other commands on offensive-claude.
- /engage.actions
Execute Phase 7 - Actions on Objectives and Goal Achievement
Open command - /engage.c2
Execute Phase 6 - Command and Control Infrastructure Setup
Open command - /engage.crash
Crash → root cause → reachability → empirical exploitability verdict (native bugs)
Open command - /engage.deliver
Execute Phase 3 - Delivery and Payload Deployment
Open command - /engage.exploit
Execute Phase 4 - Exploitation and Access Establishment
Open command - /engage.gate
Run gate validation on the current phase before proceeding
Open command