Investigate a specific CVE

What this does

Given a CVE id, pulls SubImage's full picture for it: severity, KEV status, affected packages and resources, available fixes, and a one-line recommended action. After the static summary, offers to pivot into attack-path analysis on the impacted assets so the user can answer the harder question: "is this CVE actually exploitable here?"

Scanned artifacts are either container Images (registry pull) or FilesystemSnapshots (source checkout for PaaS providers like Railway that do not instantiate images). Treat both as first-class; an empty image list is not "no impact" when snapshots are affected. Authoritative Cypher shapes live in subimage-mcp:signals-via-cypher.

When to use

✅ User pastes or names a specific CVE id and wants to understand the impact in their environment. ✅ User asks "should we patch CVE-X first" or "is CVE-X in the KEV catalog". ✅ User wants the list of containers / packages / images / filesystem snapshots affected by a CVE.

❌ User wants the entire vulnerability backlog: use subimage-mcp:triage-new-findings (compliance), or count (:VulnerabilitySignal:Signal) by severity for raw numbers. ❌ User wants to compare two CVEs: just run this skill twice and contrast the outputs.

Prerequisites