gadievron

Cve Env — Security skill for Claude Code

Security community

Agentic CVE → Docker environment builder: given a CVE ID, builds and verifies a Docker environment running the affected application at its pre-patch version.

How to install Cve Env

This entry records only its repository, not the path inside it, so there is no exact command to give. Open gadievron/cve-env and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Cve Env does

Agentic CVE → Docker environment builder: given a CVE ID, builds and verifies a Docker environment running the affected application at its pre-patch version.

Alternatives in Security

FastAPI Review — Review a FastAPI application for architecture, async correctness, dependency injection, Pydantic schemas, secu 243.5k ★
OpenTag — Open-source, channel-native agent gateway for Slack 499 ★
Dotclaude — A comprehensive development environment with specialized AI agents for code review, security analysis, and tec 435 ★

README

cve-env

**Agentic CVE → Docker environment builder.**

Given a CVE ID, cve-env builds a Docker environment running the affected application at its pre-patch version and verifies the build is correct. The agent researches each CVE live (NVD + OSV + GitHub + container registries) and picks its own build path.

Version: 1.0 beta Author: Gadi Evron (@gadievron)

What `success` means

`status="success"` requires **both**:

Right version — a version-assertion exec_check (pip show, dpkg -l, openssl version, find / -name '*.jar', …) proving the deployed binaries fall in the CVE's affected range.
Working app — functional-smoke checks proving normal operation on benign input (e.g. HTTP GET / + a content match, or a SELECT 1 roundtrip for a database).

If verify runs but that evidence is incomplete, the runtime records the honest fallback `verified_partial` instead. cve-env's job ends at a correct, working environment — it builds and verifies; it does not assess or attempt the vulnerability.

Every build runs in a hardened container: `--cap-drop ALL`, `--security-opt no-new-privileges:true`, ports bound to `127.0.0.1` only.

Requirements

Python 3.12+ and uv
A Docker daemon reachable via docker on PATH. Developed and tested against Colima; any Docker-compatible daemon (Docker Desktop, OrbStack, rootless Docker) should work but is untested
The claude CLI, logged in — cve-env authenticates through your existing Claude Code session via claude-agent-sdk. No ANTHROPIC_API_KEY is consumed.

Install

git clone  && cd cve-env
uv sync

Quick start

# Build + verify one CVE (prints a per-stage report at the end)
uv run cve-env build CVE-2014-0160

# Probe external services (NVD, OSV, GitHub, Docker Hub, registries)
uv run cve-env doctor

Per-CVE audit traces (every tool call, result, and cost) are written to `output/agentic//