codebase-impact-analysis

Codebase Impact Analysis

Determines whether a Go codebase is impacted by a specific CVE by applying multiple analysis methods with increasing confidence, collecting evidence, and assigning a risk level.

When to Use This Skill

Use this skill when:

• A CVE profile has been gathered (from the cve-intelligence-gathering skill)
• You need to determine if the current Go project is affected
• You need to assign a risk level with supporting evidence

Prerequisites

Required Tools (validated in Phase 0 of parent command)

• go toolchain with go.mod in workspace root
• govulncheck: go install golang.org/x/vuln/cmd/govulncheck@latest
• callgraph: go install golang.org/x/tools/cmd/callgraph@latest
• digraph: go install golang.org/x/tools/cmd/digraph@latest

Required Inputs

From Phase 1 (cve-intelligence-gathering skill):

• CVE ID
• Affected package/module name(s)
• Vulnerable version range
• Fixed version (if available)
• Vulnerable function signatures (if known)

From Parent Command:

• --algo preference for call graph analysis (default: vta)

Implementation Steps

Step 1: Identify Go Module Dependencies

# Parse dependencies from go.mod
go list -m all

# Get detailed dependency info
go list -m -json all

• Read go.mod from workspace root
• Parse direct and indirect dependencies
• Extract module versions

Step 2: Cross-Reference Vulnerable Packages

Apply the following methods in order. Each provides increasing confidence.

Method 1: Dependency Matching

• Compare CVE-affected packages with go.mod dependencies
• Check if affected package versions are in use
• Account for version ranges and semantic versioning

# Check if vulnerable package is a dependency
go list -m <vulnerable-package>

Decision Point:

• IF package NOT in dependencies → Skip to risk assignment (likely LOW RISK)
• IF package found → Continue to Method 2

Method 2: Go Vulnerability Scanner

# Run official Go vulnerability scanner
govulncheck ./...