cve-reachability-analyzer

Analyze CVE reachability in software repositories by examining how vulnerable dependencies are imported and used. Determines whether vulnerable components, classes, or functions are reachable from project code through call chain analysis, reflection detection, dynamic loading patterns, and configuration-gated behavior. Classifies each CVE as likely reachable, possibly reachable, or likely unreachable with supporting evidence. Use when analyzing security vulnerabilities in dependencies, performing post-disclosure CVE triage, assessing vulnerability impact, or when users ask to analyze CVE reachability, check if vulnerabilities are exploitable, or evaluate dependency security risks.

1.05x

Quality

85%

Does it follow best practices?

Impact

99%

1.05x

Average score across 3 eval scenarios

Securityby

Passed

No known issues

Evaluation results

100%

Security Triage: YAML Processing Service

Classification criteria and test vs. production distinction

Criteria

Without context

With context

Correct top-level classification

100%

Confidence level assigned

100%

Version match confirmed

100%

Production call site cited

100%

Test-only usage distinguished

100%

Dead code recognized

100%

Safe function excluded

100%

Call chain from entry point

100%

Uncertainty section present

100%

Recommendations present

100%

Dependency Vulnerability Triage: Node.js API Service

Configuration-gated reachability and assumption documentation

Criteria

Without context

With context

Feature flag as configuration gate

100%

Possibly Reachable classification

86%

100%

Dev-only route as unreachable

100%

Production config state unknown

100%

Uncertainty section with config unknowns

100%

Version check

100%

Call site with file reference

100%

Non-vulnerable functions excluded

100%

Recommendations reflect uncertainty

100%

Does not classify as Likely Reachable

100%

97%

Vulnerability Impact Assessment: Java Microservice

Call graph construction and dynamic invocation detection

Criteria

Without context

With context

Version match confirmed

100%

enableDefaultTyping identified

100%

Full call chain from HTTP endpoint

100%

Likely Reachable classification

100%

Confidence level assigned

100%

Reflection detected

100%

Reflection classified as uncertainty

40%

70%

Safe ObjectMapper excluded

100%

Test-only usage not counted

100%

Analysis Notes section

100%

Recommendations present

100%

Repository: ArabelaTso/Skills-4-SE
Commit: 0f00a4f

Evaluated: 29 days ago
Agent: Claude Code
Model: Claude Sonnet 4.6

Table of Contents

Security Triage: YAML Processing Service Dependency Vulnerability Triage: Node.js API Service Vulnerability Impact Assessment: Java Microservice

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.