v1.2.0: cve-review (known CVEs and end-of-life software)

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "raystack",
       "source": "./",
-      "version": "1.1.1",
+      "version": "1.2.0",
       "description": "Skills by Harun R. Rayhan: a full development flow (new project intake, research, PRD, specs, plans, reviewed builds, ship; gap-fill, design review and migration for existing projects), read-only scans and reviews (security, performance, scalability, reliability and availability, architecture incl. MVC and CQRS, frontend, code health, CI/CD pipelines, AWS, infrastructure, databases), working principles and local browser verification.",
       "category": "devops"
     }

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "raystack",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "description": "Skills by Harun R. Rayhan: a full development flow (new project intake, research, PRD, specs, plans, reviewed builds, ship; gap-fill, design review and migration for existing projects), read-only scans and reviews (security, performance, scalability, reliability and availability, architecture incl. MVC and CQRS, frontend, code health, CI/CD pipelines, AWS, infrastructure, databases), working principles and local browser verification.",
   "author": {
     "name": "Harun R. Rayhan",

.cursor-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "raystack",
   "displayName": "RayStack",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "description": "Skills by Harun R. Rayhan: a full development flow (new project intake, research, PRD, specs, plans, reviewed builds, ship; gap-fill, design review and migration for existing projects), read-only scans and reviews (security, performance, scalability, reliability and availability, architecture incl. MVC and CQRS, frontend, code health, CI/CD pipelines, AWS, infrastructure, databases), working principles and local browser verification.",
   "author": {
     "name": "Harun R. Rayhan"

CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 1.2.0 (2026-11-04)
+
+- New `cve-review`: finds known CVEs in dependencies (osv-scanner and the ecosystem audits,
+  with a check that your code reaches the vulnerable function) and software that will
+  collect CVEs: end-of-life runtimes and frameworks, old or floating base images, unsupported
+  cloud versions, vendored libraries, and no update process. End-of-life dates and the CISA
+  known-exploited list are looked up only with consent. Image scans are listed for you to
+  run, not run. Run it with `/audit cve`; `/audit security` and `/audit all` include it.
+  RayStack is now thirty-two skills.
+
 ## 1.1.1 (2026-11-04)
 
 - The installer knows OpenClaw (`--agent openclaw`, `~/.openclaw/skills`) and its earlier

README.md

@@ -64,6 +64,7 @@ file:line evidence and a suggested fix. They never change your code or anything
 | Review | What it looks at |
 | --- | --- |
 | `app-security-review` | Authorization and IDOR, injection, secrets, sessions, client IP spoofing, dependency risk |
+| `cve-review` | Known CVEs in dependencies, and software that will collect them: end-of-life runtimes and frameworks, old base images, unpinned or vendored code, no update process |
 | `pipeline-security-review` | CI/CD: workflow permissions, untrusted input, pinned actions, Dockerfiles, supply chain |
 | `infra-review` | Deploys, rollback, backups, monitoring and exposure on any platform (Railway, Cloudflare, VPS, Kubernetes, AWS, GCP, Azure) |
 | `performance-review` | N+1 queries, hot paths, blocking calls, caching, payload and bundle weight |
@@ -82,7 +83,7 @@ live data `(unconfirmed)`. Each report ends with the commands it needs you to ru
 
 **Scan.** `/audit all` or `/audit <type>` runs a set of reviews as one job with one round of
 questions. Types: `security`, `performance`, `scalability`, `reliability`, `infra`, `aws`,
-`database`, `architecture`, `code`, `frontend` and `all`. When two or more reviews run, it also
+`database`, `cve`, `architecture`, `code`, `frontend` and `all`. When two or more reviews run, it also
 writes one merged, ranked report. What each type runs is in the
 [guide](docs/guide.md#scans).
 
@@ -476,7 +477,7 @@ above). Start a new agent session afterwards.
 
 ## Skills
 
-RayStack is thirty-one skills. You only need `/raystack` (or `/dev` to build and `/audit` to review); they call the rest.
+RayStack is thirty-two skills. You only need `/raystack` (or `/dev` to build and `/audit` to review); they call the rest.
 
 | Skill | What it does |
 | --- | --- |
@@ -491,7 +492,7 @@ RayStack is thirty-one skills. You only need `/raystack` (or `/dev` to build and
 | `dev-gaps` | Finds the docs an existing project is missing and writes them from the code and your answers |
 | `dev-review` | Read-only check of the architecture, specs and plan against the code |
 | `dev-migrate` | Moves part of a project to another language, framework or database, step by step with parity tests |
-| 13 reviews | See [What it does](#what-it-does) |
+| 14 reviews | See [What it does](#what-it-does) |
 | `aws-readonly-setup` | Creates a read-only AWS profile for the AWS reviews |
 | `local-verify` | Checks a user-facing change in a real local browser before it ships |
 | `principle-ship` | Done means live: PR, self-review, green CI, merge, deploy confirmed |
@@ -524,7 +525,7 @@ Or in a terminal:
 rm -rf ~/.raystack ~/.raystack-installs                 # then the checkout and its list
 ```
 
-`--uninstall` removes exactly the thirty-one RayStack skills and nothing else.
+`--uninstall` removes exactly the thirty-two RayStack skills and nothing else.
 
 ## Credits
 

VERSION

@@ -1 +1 @@
-1.1.1
+1.2.0

docs/agents.md

@@ -1,6 +1,6 @@
 # Agent support
 
-RayStack ships the same thirty-one skills (`skills/<name>/SKILL.md`) to every agent. Each agent gets
+RayStack ships the same thirty-two skills (`skills/<name>/SKILL.md`) to every agent. Each agent gets
 a manifest only when it has a documented plugin format. Researched 2026-10-28. Anything marked
 **unverified** was not confirmed against official docs or a local run.
 

docs/guide.md

@@ -150,6 +150,7 @@ It offers a PDF at the end.
 | `scaling-review` | What breaks first at 10x and 100x load |
 | `codebase-review` | Test gaps on core paths, big files that change often, dead code, duplicated business rules, swallowed errors, outdated or abandoned dependencies |
 | `app-security-review` | Authorization and IDOR, injection, secrets in code and git history, sessions, security logging, vulnerable dependencies |
+| `cve-review` | Known CVEs in dependencies (osv-scanner and the ecosystem audits, with reach checked in your code), end-of-life runtimes and frameworks, base images, pinned cloud versions, vendored libraries, and whether anything opens update PRs. Image scans (`trivy`) are listed for you to run, not run |
 | `pipeline-security-review` | GitHub Actions and GitLab CI, pinned actions, workflow permissions, Dockerfiles, IaC, lockfiles and supply chain |
 | `infra-review` | Deploys, rollback, backups, monitoring and exposure on any platform |
 | `aws-billing-review`, `aws-security-review`, `aws-bottleneck-review` | AWS spend ($/mo savings), IAM and exposure, throttling and limits |
@@ -170,7 +171,7 @@ or more ran, it also writes one merged, ranked summary, `reviews/YYYY-MM-DD-scan
 
 | Type | Runs |
 | --- | --- |
-| `security` | app security, pipeline security, AWS security, infra |
+| `security` | app security, CVEs, pipeline security, AWS security, infra |
 | `performance` | performance, database, AWS bottlenecks |
 | `scalability` | scaling, database |
 | `reliability` | reliability, database, scaling, infra |
@@ -180,6 +181,7 @@ or more ran, it also writes one merged, ranked summary, `reviews/YYYY-MM-DD-scan
 | `infra` | infra, pipeline security, AWS security, AWS bottlenecks |
 | `aws` | the three AWS reviews |
 | `database` | database |
+| `cve` | cve |
 | `all` | every review that fits the repo |
 
 ## What RayStack writes

install.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Install (or remove) the thirty-one RayStack skills for any agent that reads SKILL.md folders.
+# Install (or remove) the thirty-two RayStack skills for any agent that reads SKILL.md folders.
 set -eu
 
 # Resolve symlinks to this script so ROOT is the real checkout.
@@ -11,14 +11,14 @@ done
 ROOT=$(cd "$(dirname "$self")" && pwd -P)
 # Skills earlier versions shipped; removed from the target only when RayStack installed them.
 RETIRED="blog blog-topics blog-draft humanize blog-cover"
-SKILLS="raystack audit aws-billing-review aws-security-review aws-bottleneck-review infra-review scaling-review database-review app-security-review performance-review pipeline-security-review aws-readonly-setup principle-ship principle-smallest-change principle-ask-with-question-tool principle-secrets-layout local-verify dev dev-hub dev-research dev-prd dev-spec dev-plan dev-build dev-gaps dev-review dev-migrate architecture-review frontend-review reliability-review codebase-review"
+SKILLS="raystack audit aws-billing-review aws-security-review aws-bottleneck-review infra-review scaling-review database-review app-security-review performance-review pipeline-security-review aws-readonly-setup principle-ship principle-smallest-change principle-ask-with-question-tool principle-secrets-layout local-verify dev dev-hub dev-research dev-prd dev-spec dev-plan dev-build dev-gaps dev-review dev-migrate architecture-review frontend-review reliability-review codebase-review cve-review"
 
 usage() {
   cat <<'USAGE'
 Usage: install.sh [--agent all|<agent>|custom] [--dir <skills-dir>] [--project [<repo>]]
                   [--link] [--uninstall] [--update] [--dry-run] [--yes] [--force] [-h|--help]
 
-Copies the thirty-one RayStack skills into an agent's skills directory (default agent: claude).
+Copies the thirty-two RayStack skills into an agent's skills directory (default agent: claude).
 Agents: claude codex cursor grok antigravity gemini copilot windsurf cline kiro roo kilo amp
 goose opencode qwen trae junie augment warp zed openhands continue openclaw
 clawdbot moltbot.
@@ -30,7 +30,7 @@ clawdbot moltbot.
   --update     pull the latest RayStack into this checkout, then reinstall every place
                this checkout installed to (global and project); other flags are ignored
   --link       symlink to this checkout instead of copying
-  --uninstall  remove exactly the thirty-one RayStack skills from the target
+  --uninstall  remove exactly the thirty-two RayStack skills from the target
   --dry-run    print what would happen, change nothing
   --force      also replace/remove same-named folders RayStack did not install
 Same-named folders without the .raystack-installed marker (or a link into this checkout)

plugin.json

@@ -1,7 +1,7 @@
 {
-  "$schema": "https://agent-plugins.org/schemas/1.1.1/plugin.schema.json",
+  "$schema": "https://agent-plugins.org/schemas/1.2.0/plugin.schema.json",
   "name": "raystack",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "description": "Skills by Harun R. Rayhan: a full development flow (new project intake, research, PRD, specs, plans, reviewed builds, ship; gap-fill, design review and migration for existing projects), read-only scans and reviews (security, performance, scalability, reliability and availability, architecture incl. MVC and CQRS, frontend, code health, CI/CD pipelines, AWS, infrastructure, databases), working principles and local browser verification.",
   "author": {
     "name": "Harun R. Rayhan",

skills/app-security-review/SKILL.md

@@ -79,7 +79,7 @@ Work through `references/checklist.md`, every area, with the framework notes tha
   goes under a "Worth hardening" section after the findings, never ranked as a finding.
   Framework defaults (CSRF tokens, template escaping, ORM binding) are not findings unless the
   code shows them disabled or bypassed.
-- Dependency CVEs: confirm the app's own code reaches the vulnerable function before ranking
+- Dependency CVEs: `cve-review` goes deeper (end-of-life runtimes, images, cloud versions); when its report exists, add a one-line `see <report>` instead of repeating. Confirm the app's own code reaches the vulnerable function before ranking
   it. Otherwise it goes under "Worth hardening" with the upgrade.
 - Logging findings (area 12) use a **Blind spot** line (the attack that would go unseen)
   instead of **Exploit**, and rank at most Medium.

skills/audit/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: audit
-description: Entry point for RayStack's read-only reviews and scans. Use for "/audit", "/audit all", "/audit security", "audit my stack", "review my codebase", "which review should I run", "review my AWS", "review my database", cloud cost, security, bottlenecks, deploys, scaling, databases, app code security, performance, N+1 queries, CI/CD or GitHub Actions security, architecture, CQRS, MVC, frontend, reliability, availability, code quality or tech debt, and scans that run several reviews as one job ("scan", "scan all", "scan security").
+description: Entry point for RayStack's read-only reviews and scans. Use for "/audit", "/audit all", "/audit security", "audit my stack", "review my codebase", "which review should I run", "CVE scan", "review my AWS", "review my database", cloud cost, security, bottlenecks, deploys, scaling, databases, app code security, performance, N+1 queries, CI/CD or GitHub Actions security, architecture, CQRS, MVC, frontend, reliability, availability, code quality or tech debt, and scans that run several reviews as one job ("scan", "scan all", "scan security").
 ---
 
 # Audit
@@ -15,10 +15,10 @@ read-only.
 | `/audit <area>` (security, database, frontend, architecture, AWS cost...) | That review, step 2 skips the pick |
 | `/audit all` or `/audit <scan type>` | A scan: a set of reviews as one job (Scan below) |
 
-The thirteen reviews: `aws-billing-review`, `aws-security-review`, `aws-bottleneck-review`,
+The fourteen reviews: `aws-billing-review`, `aws-security-review`, `aws-bottleneck-review`,
 `infra-review`, `scaling-review`, `database-review`, `app-security-review`,
 `performance-review`, `pipeline-security-review`, `architecture-review`, `frontend-review`,
-`reliability-review`, `codebase-review`. Read-only AWS access: `aws-readonly-setup`.
+`reliability-review`, `codebase-review`, `cve-review`. Read-only AWS access: `aws-readonly-setup`.
 
 ## 0. Scan or review
 
@@ -39,7 +39,8 @@ names only and are fine), `*.tfstate*`, kubeconfigs or credential files.
   or IaC: `database-review`. Queues, workers, autoscaling config: `scaling-review`.
 - App code (routes, controllers, an ORM): `app-security-review`; with an ORM or a frontend
   build also `performance-review`.
-- CI workflows, a `Dockerfile`, IaC or k8s: `pipeline-security-review`.
+- CI workflows, a `Dockerfile`, IaC or k8s: `pipeline-security-review`. A lockfile, a runtime
+  version file, a `Dockerfile` or pinned cloud versions: `cve-review`.
 - App code: also `architecture-review` and `codebase-review`. A frontend build (React, Vue,
   Svelte, Angular, Next, Nuxt, Inertia): `frontend-review`. App code with outbound calls,
   queues, jobs or deploy config: `reliability-review`.
@@ -50,7 +51,8 @@ Then read the user's words:
   `aws-security-review`. "slow", "throttling", "limits": `aws-bottleneck-review`.
 - "slow page", "slow endpoint", "N+1": `performance-review`. "10x", "launch", "will it scale":
   `scaling-review`.
-- "security audit of my app", "IDOR", "XSS", "SQL injection": `app-security-review`.
+- "security audit of my app", "IDOR", "XSS", "SQL injection": `app-security-review`. "CVE",
+  "vulnerable dependencies", "end of life", "known vulnerabilities": `cve-review`.
 - "architecture", "CQRS", "MVC", "layers", "god class", "coupling": `architecture-review`.
   "frontend", "React", "Vue", "accessibility", "re-renders": `frontend-review`. "reliability",
   "availability", "uptime", "SLO", "retries", "failover": `reliability-review`. "code quality",
@@ -69,7 +71,7 @@ Use plain text only without such a tool. It allows up to 4 questions with up to
 
 1. "AWS and CI reviews" (multi-select): the three `aws-*` reviews, `pipeline-security-review`.
 2. "Code reviews" (multi-select): `app-security-review`, `performance-review`,
-   `architecture-review`, `codebase-review`, `frontend-review`.
+   `architecture-review`, `codebase-review`, `frontend-review`, `cve-review`.
 3. "Platform reviews" (multi-select): `infra-review`, `scaling-review`, `database-review`,
    `reliability-review`.
 
@@ -108,7 +110,7 @@ reference, not a second entry". Run `database-review` before `infra-review`.
 ## Scan
 
 `scan <type>` (security, performance, scalability, reliability, architecture, code, frontend,
-infra, aws, database, all) runs steps 1, 3 and 4 on
+infra, aws, database, cve, all) runs steps 1, 3 and 4 on
 the type's review list. Type and consent: [scans.md](../raystack/references/scans.md), which replaces
 step 2 (no review pick) with one question-tool call. It also has the table, skipped reviews and the
 combined `reviews/YYYY-MM-DD-scan-<type>.md` (skill `scan-<type>`).