orca-cve-blast-radius

# Orca CVE Blast-Radius Skill Answers the question: **"This CVE just dropped — which of our assets are actually at risk, ranked by real exposure?"** Static CVSS doesn't tell you which workloads matter. This skill takes a CVE-ID, finds every affected asset across all accounts, and ranks them by **runtime exposure context** — internet-facing, attack-path participation, crown jewel status, and existing related alerts. ## Usage ``` /orca-cve-blast-radius CVE-2021-44228 /orca-cve-blast-radius CVE-2024-1234 /orca-cve-blast-radius CVE-2024-3094 prod ``` Or natural language: - "blast radius of CVE-2024-1234" - "where are we affected by Log4Shell?" - "which assets have CVE-2021-44228?" - "show me CVE-2024-3094 across all accounts" ## Processing Logic ### Step 1: Parse the CVE-ID Extract a single CVE-ID in `CVE-YYYY-NNNNN` form. If the user provided a name (e.g. "Log4Shell", "xz backdoor", "Spring4Shell"), map to the canonical CVE-ID first using a `discovery_search` query like `"<name> CVE"`. If the mapping is ambiguous, list candidates and ask the user to pick. Optional scope arg: `prod`, `staging`, `account <id>`. Default: all accounts. ### Step 2: Find every affected asset (parallel) Run all three queries in parallel: **Query 1: Asset hits by CVE-ID** ``` discovery_search: search_phrase: "assets with <CVE-ID>" limit: 50 ``` **Query 2: Critical exposure hits** ``` discovery_search: search_phrase: "internet facing assets with <CVE-ID>" limit: 50 ``` **Query 3: Ac...