fix-security-issue

Investigate and fix the security issue $ARGUMENTS reported by trivy, osv-scanner, grype, or another security linter.

Delegation hint — for non-trivial CVEs, delegate the applicability/exploitability analysis to the security-analyst agent (opus) and the mechanical version bump (once decided) to the version-bumper agent (haiku). This keeps deep reasoning on opus and pin edits on haiku, minimising token spend.

Step 1 — Research the CVE

Browse the internet to gather full context:

• Visit the CVE URL from the scan output (e.g. https://avd.aquasec.com/nvd/<cve-id>)
• Check the fixed version, affected component, and attack vector
• Understand the exploit mechanism: what input/behavior triggers the vulnerability?

Step 2 — Locate the vulnerable dependency

Find where the vulnerable package comes from: