Start the AI exercise

Using an actual assistant is optional; the evidence-based critique is the lesson. Use an assistant approved by your institution. Without one, go directly to sample-response.md in this folder, critique at least four recommendations using your report and the supplied source, then complete the same submission table and reviewed manual repair. You can skip skill installation and provider setup on this route; no subscription is required.

Prepare the files

1. In an exported kit, enter app/ and use MANAGER-SETUP.md in the kit root. In the full repository, enter this exercise's examples/<manager>/student and use the track README. Install dependencies, run tests and capture a scan. If live scanning is unavailable, use the dated reference reports and label your evidence accordingly.
2. From app/, run:

npm exec --yes --package=cve-lite-cli@1.40.0 -- cve-lite install-skill

3. Inspect the generated files below. They are scanner-use instructions, not an automatically running scanner. Back up pre-existing assistant files before installation; this kit does not initially include them.

Assistant	Instruction file generated inside app/	How to start this lab
Claude Code	.claude/commands/cve-lite.md	Open the app folder in your assistant session. Explicitly ask it to read this file, then paste analysis.md. The generated command can also be exposed as /cve-lite, but use the analysis-only prompt for this lab.
Codex	AGENTS.md	Open the app folder as the project. Ask it to read the CVE Lite CLI section, then paste analysis.md.
Gemini CLI	GEMINI.md	Open the app folder as the project. Ask it to read the CVE Lite CLI section, then paste analysis.md.
Cursor	.cursor/rules/cve-lite.mdc	Open app/ in the editor and explicitly include this rule file in your request, then paste analysis.md.
GitHub Copilot	.github/copilot-instructions.md	Open app/ in the editor and explicitly include its CVE Lite CLI section in your request, then paste analysis.md.

Assistant interfaces and automatic loading vary. Explicitly supplying the file makes the exercise independent of automatic discovery. The file-generation step was tested; conversations with each provider were not.

Give it the evidence

Open analysis.md from this prompts folder in an editor and copy its contents into the assistant. If your terminal is still in app/, the file is at ../prompts/analysis.md in an exported kit. Supply package.json, the selected manager's lockfile, src/app.mjs, test/app.test.mjs and the scan JSON. Do not supply the instructor solution or unrelated files.

Choose the assistant's review/read-only mode if available and decline requests to execute commands or change files. Do not rely on a prompt as a security boundary. You will apply approved changes manually.

Ask it to name the instruction file and report it used and cite specific report fields. That response is not proof of compliance; verify its actual recommendations. Save its answer with provider/model/date when known. Record the difference between the model's proposal and your measured results.

Finish

Complete the claim/evidence/decision table in submission-template.md. Use the manager-specific change syntax in MANAGER-SETUP.md after review, then run tests and rescan. Reject statements that a command succeeded unless you have actually executed it and retained the result.