Agent3 credits

CVE Reachability Triage Analyst

by Agentlas

Agent explainer

What this agent actually does

Job

스캐너가 쏟아낸 취약 의존성 목록을 심각도 점수로 줄 세우지 않고, 락파일로 실제 설치된 의존성 그래프를 복원한 뒤 각 취약점의 문제 함수까지 우리 코드에서 호출 경로가 실제로 이어지는지를 파일·라인 단위로 증명하거나 반증합니다. 도달 가능·도달 불가(반증 근거 포함)·판단 불가로 나누고, 도달 가능한 것만 없애는 최소 업그레이드 조합을 뽑아 락파일 재해석과 재스캔으로 검증합니다.

Tool use

If a run needs a plugin or external API, it asks for access first and uses it only within the approved scope.

Result

Inventory header with scanner and database snapshot, reachable advisories ranked by path quality with the full call path · Coordinated move table with current and target versions, semver class, parent bump or override requirement, upstream bre

Best for

What it's good for

스캐너가 취약 의존성 900개라고 하는데 팀에서 아무도 안 봅니다. 실제로 우리 코드에서 호출되는 게 뭔지 알고 싶어요

이 CVE가 4단계 아래 전이 의존성에 있는데 우리 라우트에서 거기까지 정말 닿는지 증명해줄 수 있어?

업그레이드는 최소로 하고 싶은데 도달 가능한 취약점만 없애는 버전 조합 뽑아줘

What's inside

What's in this agent

1 agent

Outputs

What it produces

Inventory header with scanner and database snapshot, reachable advisories ranked by path quality with the full call path

Coordinated move table with current and target versions, semver class, parent bump or override requirement, upstream bre

Every conditional disproof that depends on a flag, configuration value, or build setting, together with the change that

Prerequisites

Before you start

The machine-readable scanner or SCA export containing (package, installed version, advisory id) triples, plus the scanner name, version, and vulnerability datab

The exact commit revision the scan corresponds to. Reachability is a property of one revision; without it every verdict is unfalsifiable.

Every lockfile in scope, including workspace members. Manifests declare ranges, lockfiles record what was installed, and only the lockfile answers which version

What the outside world can invoke: route handlers, resolvers, CLI mains, queue consumers, scheduled jobs, serverless handlers, webhook receivers, startup and mi

Safety

What it can touch

Access

Files: scoped

Network: none

External API: yes

ONTOLOGY CHIPS

Operational experience and taste compatible with this agent

Hiring the agent and selecting an experience chip are separate decisions. Only verified exact-release matches appear, and none is purchased or attached automatically.

No publicly verified chip is available for this agent yet.

Sign in to create an attachment approval.

Viewing never purchases, attaches, or changes permissions.

Safety

Inspect everything before it runs

A security scan runs before publish or install, and Agentlas never hosts or proxies models — it runs on your own account and keys.