Verified plugins

ai.oz0/cve-triage

Known vulnerabilities from OSV in a checkout's locked dependencies, ranked, with ticket drafts; offline with a mirror.

For: tenant administrators and plugin users.

ai.oz0/cve-triage scans lockfiles in a repository checkout on the node and looks up each pinned package in OSV. Its oz0-cve-triage agent ranks the findings and drafts tickets for issues worth fixing.

The plugin only reads the checkout. It executes no checkout code and creates no tickets.

Function	What it does
`oz0_cve_triage.scan_dependencies`	`path`, `mirror`, `include_dev`. Reads go.mod, uv.lock, poetry.lock, Pipfile.lock, requirements*.txt, package-lock.json and yarn.lock (skipping node_modules, .venv, vendor and .git), and returns each advisory that affects a package, ranked
`oz0_cve_triage.osv_query`	`ecosystem` (Go, PyPI, npm), `name`, `version`, `mirror`: one package's advisories

A finding's rank is its advisory's base score (CVSS v3 when the record has a vector, else its database's label), then direct dependencies, which the project upgrades itself, and those with a fixed version. Versions are compared as each ecosystem compares them (PEP 440 for PyPI, semantic versions for Go and npm), with the OSV schema's range rules.

Install

Its agent oz0-cve-triage asks for the tenant's default model alias with tools, never a vendor's model, so it runs on whichever provider the tenant set up first; map it elsewhere with oz0 model alias set default <provider>/<model>.

Terminal

oz0 plugin install hub:ai.oz0/cve-triage
oz0 run oz0-cve-triage "Triage the dependencies of /srv/checkouts/shop"

Online or offline

Without a mirror the plugin asks api.osv.dev, which its egress list names. With one, nothing leaves the node. Its settings are settings of the tenant, not secrets (version 1.0.0 read them as optional secrets; with 1.1.0 old secrets of these names become settings by themselves):

Setting	Value
`CVE_TRIAGE_OSV_MIRROR`	A mirrored advisory file or folder on the nodes: OSV's `all.zip` per ecosystem (bulk data), a folder of `.json` records, a `.json` or a `.jsonl` file
`CVE_TRIAGE_OSV_OFFLINE`	`true` (or `1`) refuses the API when no mirror is given
`CVE_TRIAGE_OSV_API_URL`	Another OSV API than `https://api.osv.dev`, such as a mirror server of your own (it must be on the egress allowlist)

Terminal

oz0 setting set CVE_TRIAGE_OSV_MIRROR /srv/osv/PyPI-all.zip
oz0 setting set CVE_TRIAGE_OSV_OFFLINE true

A request may name a mirror too ("... with the advisories in /srv/osv"); the agent passes it as mirror.

ai.oz0/net-diag

DNS, TCP, HTTP, TLS and route probes from the node an agent runs on, and an agent that explains an outage.

ai.oz0/host-health

The health of the node an agent runs on, read-only and offline, and an on-call agent that summarises it.

On this page