---
name: graph-security-vulnerability-scanner
description: Automatic CVE scanning and dependency vulnerability audit using STRIDE threat model and OWASP methodology with remediation task generation
triggers:
  - graph-security-vulnerability-scanner
version: 1.0.0
author: Diego Nogueira
date: 2026-04-10
---

# graph-security-vulnerability-scanner

Autonomous CVE scanning and dependency vulnerability audit that continuously monitors the project for known vulnerabilities, applies STRIDE threat modeling and OWASP Top 10 methodology, and automatically generates remediation tasks in the execution graph. This skill operates proactively — it does not wait for manual invocation but triggers on dependency changes, new node completions, and scheduled intervals.

## When to Use

- Automatically after any `npm install` or dependency change detected in `package.json` or `package-lock.json`
- Before REVIEW or DEPLOY phase transitions as a mandatory security gate
- When a new CVE advisory is published for any project dependency
- Proactively on a weekly cadence during LISTENING phase to catch newly disclosed vulnerabilities
- When the user says "scan vulnerabilities", "CVE check", "security scan", or "audit dependencies"
- After completing any IMPLEMENT task that introduces a new external library import

## Mandatory Flow

```
detect_trigger → npm_audit_deep → owasp_top10_check → stride_threat_model → cve_cross_reference → severity_triage → generate_remediation_nodes → verify_fixes → write_memory
```

## Workflow

### Step 1: Trigger Detection and Scope Analysis

Determine what triggered the scan and define the scope accordingly.

```
Tool: mcp__mcp-graph__analyze
Params:
  mode: "progress"
```

| Trigger Type | Scope | Depth |
|---|---|---|
| Dependency change | Changed packages + their transitive deps | Full tree |
| Phase gate (REVIEW/DEPLOY) | All dependencies | Full tree + source |
| Scheduled (weekly) | All dependencies + new CVE advisories | Full tree |
| Manual invocation | User-specified or all | Configurable |
| New library import | Specific package + transitive deps | Package subtree |

Identify all files changed since last scan using code intelligence:

```
Tool: mcp__mcp-graph__code_intelligence
Params:
  action: "impact"
  target: "package.json"
  depth: 2
```

### Step 2: Deep Dependency Audit

Run multi-layer dependency audit beyond basic `npm audit`:

```bash
npm audit --audit-level=info --json
```

Parse the JSON output and classify findings:

| Severity | Action | SLA |
|---|---|---|
| Critical | Block deploy, create urgent remediation node | Fix within 24h |
| High | Create high-priority remediation node | Fix within 72h |
| Moderate | Create normal-priority remediation node | Fix within 1 sprint |
| Low | Log to memory, batch with next update cycle | Fix within 1 month |
| Info | Log to memory only | No SLA |

For each vulnerability found, extract: CVE ID, affected package, vulnerable version range, patched version, attack vector, CVSS score.

Check for transitive dependency vulnerabilities that `npm audit` may miss:

```
Tool: mcp__mcp-graph__search
Params:
  query: "dependency vulnerability transitive"
  scope: "knowledge"
```

### Step 3: OWASP Top 10 Automated Checks

Run automated checks for each OWASP Top 10 (2021) category against the codebase:

| # | Category | Automated Check | Tool |
|---|---|---|---|
| A01 | Broken Access Control | Scan API routes for missing auth middleware | `code_intelligence` |
| A02 | Cryptographic Failures | Grep for weak crypto (MD5, SHA1, DES) and hardcoded keys | `search` |
| A03 | Injection | Detect unsanitized string concatenation in SQL/commands | `code_intelligence` |
| A04 | Insecure Design | Check for missing rate limiting on public endpoints | `search` |
| A05 | Security Misconfiguration | Scan for debug flags, default credentials, open CORS | `search` |
| A06 | Vulnerable Components | Cross-reference npm audit findings (from Step 2) | `analyze` |
| A07 | Auth Failures | Check session handling, token expiry, password policies | `code_intelligence` |
| A08 | Software Integrity | Verify lockfile integrity, check for unsigned packages | `search` |
| A09 | Logging Failures | Detect PII in logs, missing audit events | `code_intelligence` |
| A10 | SSRF | Find unvalidated URL inputs passed to HTTP clients | `search` |

For each finding, record: category, file, line number, severity, remediation guidance.

### Step 4: STRIDE Threat Model Application

Apply STRIDE to every component that changed since the last scan:

```
Tool: mcp__mcp-graph__code_intelligence
Params:
  action: "symbols"
  filePattern: "src/api/**/*.ts,src/mcp/**/*.ts"
```

For each exposed surface (API route, MCP tool, CLI command):

| Threat | Detection Method | Automated Check |
|---|---|---|
| **S**poofing | Check auth on all entry points | Missing auth middleware = FAIL |
| **T**ampering | Verify input validation at boundaries | Missing Zod schema = FAIL |
| **R**epudiation | Confirm audit logging exists | No logger call in handler = WARN |
| **I**nformation Disclosure | Check error responses for stack traces | Raw error thrown to client = FAIL |
| **D**enial of Service | Verify resource bounds and timeouts | Unbounded query/loop = WARN |
| **E**levation of Privilege | Check role/permission enforcement | No permission check = FAIL |

### Step 5: CVE Cross-Reference and Intelligence

Cross-reference discovered packages against known CVE databases:

```
Tool: mcp__mcp-graph__search
Params:
  query: "CVE vulnerability advisory"
  scope: "knowledge"
```

Check previous scan memories for regression:

```
Tool: mcp__mcp-graph__search
Params:
  query: "security scan vulnerability"
  scope: "memories"
```

Flag any vulnerability that was previously remediated but has regressed (dependency downgrade, reverted fix).

### Step 6: Severity Triage and Risk Scoring

Calculate composite risk score for each finding:

```
Risk Score = CVSS_base * exploitability_factor * exposure_factor * data_sensitivity_factor
```

| Factor | Values | Weight |
|---|---|---|
| CVSS Base | 0.0 - 10.0 | 1.0x |
| Exploitability | Public exploit (1.5x), PoC exists (1.2x), Theoretical (1.0x) | Multiplier |
| Exposure | Internet-facing (1.5x), Internal API (1.0x), CLI only (0.7x) | Multiplier |
| Data Sensitivity | PII/secrets (1.5x), Business data (1.0x), Public data (0.5x) | Multiplier |

Sort findings by composite risk score, highest first.

### Step 7: Generate Remediation Task Nodes

For each finding above the threshold (composite risk >= 3.0), create a remediation task in the graph:

```
Tool: mcp__mcp-graph__node
Params:
  action: "add"
  name: "SEC-FIX: <CVE-ID or finding title>"
  type: "task"
  priority: <mapped from severity>
  description: "Remediation for <finding>. Affected: <package@version>. Fix: <upgrade to version or apply patch>. CVSS: <score>. Attack vector: <vector>."
  acceptanceCriteria: "1. Vulnerability no longer detected by scanner\n2. All tests pass after fix\n3. No regression in dependent modules"
```

Link remediation nodes to affected feature nodes:

```
Tool: mcp__mcp-graph__edge
Params:
  action: "add"
  from: "<remediation-node-id>"
  to: "<affected-feature-node-id>"
  type: "blocks"
```

### Step 8: Self-Healing Verification Loop

After remediation nodes are completed, automatically re-scan to verify fixes:

```
Tool: mcp__mcp-graph__analyze
Params:
  mode: "validate_ready"
```

If any finding persists after remediation:
1. Re-open the remediation node with status `blocked`
2. Add a note explaining why the fix was insufficient
3. Escalate severity by one level
4. Trigger a new scan cycle targeting only the unresolved findings

### Step 9: Persist Scan Results to Memory

```
Tool: mcp__mcp-graph__write_memory
Params:
  title: "Security Vulnerability Scan — <date>"
  content: "<total findings, severity breakdown, OWASP compliance score, STRIDE coverage, remediation nodes created, regression count>"
  tags: ["security", "cve", "vulnerability", "owasp", "stride", "scan"]
```

## Output Format

```
Phase: SECURITY VULNERABILITY SCAN
Scan Trigger: <trigger type>
Scan Scope: <packages scanned> / <source files analyzed>

Dependency Audit:
  Critical: N (N with public exploit)
  High: N
  Moderate: N
  Low: N
  Info: N

OWASP Top 10 Compliance: X/10 passed (Y%)
  Failures: <list of failed categories>

STRIDE Coverage: X/6 threats modeled per component
  Components Analyzed: N
  Findings: N total (N FAIL, N WARN)

CVE Cross-Reference:
  New CVEs: N
  Regressions: N
  Previously Known: N

Remediation Nodes Created: N
  Urgent (24h SLA): N
  High (72h SLA): N
  Normal (sprint SLA): N

Composite Risk Score (max): X.X
Overall Security Grade: A-F

Saved to memory: "Security Vulnerability Scan — <date>"
```

## Anti-Patterns

- Do NOT skip transitive dependency scanning — most critical CVEs hide in transitive deps, not direct ones
- Do NOT suppress or ignore moderate findings — they compound and create attack chains when combined
- Do NOT create remediation nodes without acceptance criteria — "fix the vulnerability" is not actionable
- Do NOT run scans only manually — proactive scheduled scans catch zero-day disclosures within the weekly window
- Do NOT treat OWASP and STRIDE as checkbox exercises — each finding must have a concrete remediation path
- Do NOT mark remediation as done without re-scanning — the self-healing loop exists to prevent false closures
- Do NOT skip the CVE regression check — previously fixed vulnerabilities that reappear indicate a process failure
