Guides
Worked sequences that chain the tools and prompts for common jobs, from triaging one CVE to auditing an inherited repository.
Each guide is a sequence: what to ask, which tool or prompt answers, what comes back, and what to do with it.
| Guide | Job |
|---|---|
| Triage a CVE | From a bare identifier to a patch-or-defer decision you can defend |
| Gate a new dependency | Check a package before it enters the lockfile |
| Meet a KEV deadline | Find binding due dates that apply to what you run |
| Run an incident | A CVE goes hot: urgency, exposure, indicators, detection, mitigation |
| Review a pull request | Dependencies first, then the changed code, then a verdict |
| Audit an inherited repository | First contact with a codebase nobody has looked at |
| Run it behind a Cloudflare Portal | Administrator setup with Zero Trust |
The pattern
- Establish the facts with tools: KEV, EPSS, exploitation maturity and sightings, not what the model remembers.
- Establish the exposure with a local prompt: does the advisory reach your code.
- Decide and record why, so the decision survives the conversation.
- Act, then verify with the CLI.
Tools cover step 1 completely. Steps 2 to 4 need your repository, which is where the prompts and the CLI come in.