remediation-planning

Remediation Planning

Creates actionable remediation plans for vulnerable Go codebases based on analysis results from previous phases.

Supported Remediation Types

1. Dependency Update - Update Go package to fixed version
2. Go Runtime Update - Update Go itself (for stdlib vulnerabilities)
3. Configuration Change - Disable features, change settings, adjust security controls
4. Code Refactoring - Replace vulnerable patterns, add validation, refactor code
5. Security Patch - Apply vendor-provided patch files
6. Workarounds - Temporary mitigations (timeouts, rate limiting, input validation)
7. Infrastructure - Network policies, firewall rules, WAF configuration
8. Combination - Multiple remediation types together

The skill automatically determines the appropriate remediation strategy based on CVE details and impact analysis.

When to Use This Skill

Use this skill when:

• Codebase is confirmed or likely affected by a CVE
• Need specific remediation steps beyond "update the package"
• Fixed version exists but need to assess compatibility
• No fixed version available and need workarounds
• Project uses custom build/test commands via Makefile

Implementation Steps

Step 1: Analyze Inputs and Determine Strategy

Required Inputs from Previous Phases:

From Phase 1 (cve-intelligence-gathering):

• CVE ID, severity, CVSS score
• Affected package/module and vulnerable version range
• Fixed version (if available)
• Vulnerability type and remediation guidance

From Phase 2 (codebase-impact-analysis):

• Risk level (HIGH / MEDIUM / LOW / NEEDS REVIEW)
• Current package version and dependency type
• Usage locations and functions being called

From Call Graph Analysis (optional):

• Reachability risk level and call chain
• Entry points

From govulncheck (optional):

• Detection result and vulnerable symbols

Decision Tree:

IF risk_level = "LOW":
  → Document findings, recommend monitoring and manual review
  
IF risk_level = "HIGH" or "MEDIUM":
  IF fixed_version EXISTS:
    IF affected_package is in go.mod → Dependency Update (Step 2)
    ELSE IF affected_package is Go stdlib → Go Runtime Update (Step 2A)
      
  IF fixed_version = null:
    IF remediation_guidance has "configuration" → Configuration Change (Step 2B)
    IF remediation_guidance has "code change" OR pattern vulnerability → Code Refactoring (Step 2C)
    IF remediation_guidance has "patch" → Apply Patch (Step 2D)
    ELSE → Workarounds (Step 3)
      
IF risk_level = "NEEDS_REVIEW":
  → Manual review + defensive workarounds (Step 3)