Vulnerability Skill

Security vulnerability management for GitLab using glab api raw endpoint calls.

Quick Reference

Operation	Command Pattern	Risk
List vulnerabilities	glab api projects/:id/vulnerabilities	-
Get vulnerability	glab api projects/:id/vulnerabilities/:vuln_id	-
Confirm vulnerability	glab api projects/:id/vulnerabilities/:vuln_id/confirm -X POST	⚠️
Dismiss vulnerability	glab api projects/:id/vulnerabilities/:vuln_id/dismiss -X POST -f ...	⚠️
Resolve vulnerability	glab api projects/:id/vulnerabilities/:vuln_id/resolve -X POST	⚠️
Revert to detected	glab api projects/:id/vulnerabilities/:vuln_id/revert -X POST	⚠️
List findings	glab api projects/:id/vulnerability_findings	-

Risk Legend: - Safe | ⚠️ Caution | ⚠️⚠️ Warning | ⚠️⚠️⚠️ Danger

When to Use This Skill

ALWAYS use when:

• User mentions "vulnerability", "security issue", "CVE"
• User wants to view security scan results
• User mentions "SAST", "DAST", "dependency scanning", "container scanning"
• User wants to dismiss or resolve security findings
• User asks about security dashboard

NEVER use when:

• User wants to run security scans (use gitlab-ci)
• User wants to configure security settings (use project settings)
• User wants general issue tracking (use gitlab-issue)

API Prerequisites

Required Token Scopes: read_api or api

Permissions:

• Read vulnerabilities: Developer+
• Manage vulnerabilities: Developer+

GitLab Tier: Ultimate required for full vulnerability management features

Vulnerability States

State	Description
detected	New, unreviewed vulnerability
confirmed	Verified as real vulnerability
dismissed	Marked as false positive or won't fix
resolved	Fixed and no longer present

Severity Levels

Severity	Description
critical	Highest severity, immediate action needed
high	Significant risk
medium	Moderate risk
low	Minor risk
info	Informational finding
unknown	Severity not determined

Available Commands

List Project Vulnerabilities

# List all vulnerabilities
glab api projects/123/vulnerabilities --method GET

# Filter by state
glab api "projects/123/vulnerabilities?state=detected" --method GET

# Filter by severity
glab api "projects/123/vulnerabilities?severity=critical,high" --method GET

# Filter by multiple criteria
glab api "projects/123/vulnerabilities?state=detected&severity=critical,high" --method GET

# With pagination
glab api projects/123/vulnerabilities --paginate

# Using project path
glab api "projects/$(echo 'mygroup/myproject' | jq -Rr @uri)/vulnerabilities"

Get Vulnerability Details

# Get specific vulnerability
glab api projects/123/vulnerabilities/456 --method GET

Confirm Vulnerability

Marks a detected vulnerability as confirmed (real security issue).

# Confirm vulnerability
glab api projects/123/vulnerabilities/456/confirm --method POST

Dismiss Vulnerability

Marks a vulnerability as dismissed (false positive or accepted risk).

# Dismiss as false positive
glab api projects/123/vulnerabilities/456/dismiss --method POST \
  -f comment="False positive - this code path is not reachable"

# Dismiss as acceptable risk
glab api projects/123/vulnerabilities/456/dismiss --method POST \
  -f comment="Accepted risk - mitigated by network controls"

# Dismiss with dismissal reason (if available)
glab api projects/123/vulnerabilities/456/dismiss --method POST \
  -f comment="Not applicable to our use case" \
  -f dismissal_reason="used_in_tests"

Resolve Vulnerability

Marks a vulnerability as resolved (fixed).

# Resolve vulnerability
glab api projects/123/vulnerabilities/456/resolve --method POST

Revert to Detected State

Reverts a vulnerability back to detected state.

# Revert to detected
glab api projects/123/vulnerabilities/456/revert --method POST

List Vulnerability Findings

Findings are the raw results from security scanners.

# List all findings
glab api projects/123/vulnerability_findings --method GET

# Filter by severity
glab api "projects/123/vulnerability_findings?severity=critical,high" --method GET

# Filter by scanner
glab api "projects/123/vulnerability_findings?scanner=sast" --method GET

# Filter by pipeline
glab api "projects/123/vulnerability_findings?pipeline_id=789" --method GET

# With pagination
glab api projects/123/vulnerability_findings --paginate

Security Dashboard (Group Level)

# Get security statistics for group
glab api groups/456/vulnerability_exports --method POST \
  -f export_format="csv"

# Get group vulnerability statistics
glab api "groups/456/vulnerability_statistics" --method GET

Common Workflows

Workflow 1: Triage New Vulnerabilities

project_id=123

# Get all detected (new) vulnerabilities
glab api "projects/$project_id/vulnerabilities?state=detected" --paginate | \
  jq -r '.[] | "[\(.severity)] \(.title) - \(.id)"'

# Review critical/high first
glab api "projects/$project_id/vulnerabilities?state=detected&severity=critical,high" | \
  jq -r '.[] | "ID: \(.id)\nTitle: \(.title)\nSeverity: \(.severity)\nScanner: \(.scanner.name)\nLocation: \(.location | @json)\n---"'

Workflow 2: Generate Security Report

project_id=123

# Summary by severity
echo "=== Vulnerability Summary ==="
glab api "projects/$project_id/vulnerabilities" --paginate | \
  jq -r 'group_by(.severity) | map({severity: .[0].severity, count: length}) | .[] | "\(.severity): \(.count)"'

# Summary by state
echo ""
echo "=== By State ==="
glab api "projects/$project_id/vulnerabilities" --paginate | \
  jq -r 'group_by(.state) | map({state: .[0].state, count: length}) | .[] | "\(.state): \(.count)"'

# Summary by scanner
echo ""
echo "=== By Scanner ==="
glab api "projects/$project_id/vulnerabilities" --paginate | \
  jq -r 'group_by(.scanner.name) | map({scanner: .[0].scanner.name, count: length}) | .[] | "\(.scanner): \(.count)"'

Workflow 3: Bulk Dismiss False Positives

project_id=123

# Dismiss all info-level findings from specific scanner
glab api "projects/$project_id/vulnerabilities?severity=info&state=detected" --paginate | \
  jq -r '.[].id' | while read vuln_id; do
    echo "Dismissing $vuln_id"
    glab api projects/$project_id/vulnerabilities/$vuln_id/dismiss --method POST \
      -f comment="Bulk dismissed - info level findings"
  done

Workflow 4: Track Critical Vulnerabilities

project_id=123

# List critical vulnerabilities with details
glab api "projects/$project_id/vulnerabilities?severity=critical" --paginate | \
  jq -r '.[] | {
    id: .id,
    title: .title,
    state: .state,
    detected_at: .detected_at,
    scanner: .scanner.name,
    identifiers: [.identifiers[]?.name] | join(", ")
  }'

Workflow 5: Check for CVEs

project_id=123
cve="CVE-2021-44228"

# Search for specific CVE
glab api "projects/$project_id/vulnerabilities" --paginate | \
  jq -r ".[] | select(.identifiers[]?.name == \"$cve\") | \"ID: \(.id), State: \(.state), Title: \(.title)\""

Workflow 6: Export Vulnerabilities

project_id=123

# Export to JSON
glab api "projects/$project_id/vulnerabilities" --paginate > vulnerabilities.json

# Export to CSV format
glab api "projects/$project_id/vulnerabilities" --paginate | \
  jq -r '["id","title","severity","state","scanner","detected_at"],
         (.[] | [.id, .title, .severity, .state, .scanner.name, .detected_at]) | @csv' > vulnerabilities.csv

Workflow 7: Compare Pipeline Results

project_id=123

# Get findings from specific pipeline
pipeline_id=789
glab api "projects/$project_id/vulnerability_findings?pipeline_id=$pipeline_id" | \
  jq -r '.[] | "\(.severity): \(.name)"'

Scanner Types

Scanner	Report Type	Description
sast	SAST	Static Application Security Testing
dast	DAST	Dynamic Application Security Testing
dependency_scanning	Dependency Scanning	Third-party dependency vulnerabilities
container_scanning	Container Scanning	Container image vulnerabilities
secret_detection	Secret Detection	Hardcoded secrets in code
coverage_fuzzing	Coverage Fuzzing	Fuzzing test results
api_fuzzing	API Fuzzing	API fuzzing results

Troubleshooting

Issue	Cause	Solution
403 Forbidden	Ultimate required or no access	Check GitLab tier and permissions
Empty results	No scans run	Configure and run security scanners in CI
Old vulnerabilities	No recent pipeline	Run new pipeline with security jobs
Can't dismiss	Already dismissed or resolved	Check current state
Missing scanner type	Scanner not configured	Add scanner to CI configuration

Best Practices

1. Triage regularly: Review new vulnerabilities frequently
2. Document dismissals: Always add comments explaining why
3. Track critical issues: Monitor critical/high severity closely
4. Integrate with issues: Create issues for confirmed vulnerabilities
5. Automate where possible: Use CI to fail on new critical findings

Related Documentation

• API Helpers
• Safeguards
• Quick Reference
• GitLab Vulnerabilities API
• GitLab Vulnerability Findings API