AI-Assisted Remediation: student worksheet

CVE Lite Classroom · Classroom repository · CVE Lite CLI

In a student kit, read MANAGER-SETUP.md and enter app/. In the source repository, read examples//README.md and enter its student/ directory. Prompts and workflow templates are in the exercise/kit root, not inside app/.

Readiness: complete Exercise 01 or equivalent dependency-remediation practice first. You should be able to explain a direct/transitive dependency, locate an advisory in a report, justify a version change and run tests plus a rescan. Review DEPENDENCY-BASICS.md in the kit (or docs/dependency-basics.md at the repository root). If those tasks are unfamiliar, do Exercise 01 before this lesson. Allow 30 minutes as a follow-on, or 45–60 minutes with equivalent knowledge but no previous exposure to this activity; setup is additional.

1. Prepare the supplied student application and capture its scan using MANAGER-SETUP.md. Use a separate copy from any previous exercise.
2. Follow prompts/assistant-quickstart.md in the exercise/kit root. It explains skill installation, the instruction file for each assistant and the no-account route.
3. Open prompts/analysis.md from the kit root (../prompts/analysis.md if your terminal is inside app/). Give your supported assistant ONLY the supplied instruction file, source, manifest, lockfile, tests and scan. Ask for a plan without editing or executing commands. Record provider/model/date if available.
4. Complete at least four rows of the claim/evidence/decision table provided in submission-template.md. Cite a report field, source behavior, dependency path or advisory for each decision. Check whether proposed fix commands match YOUR package manager and whether a major upgrade is justified. If an actual assistant gives fewer than four substantive claims, use the authored sample for the remaining critique and label those rows.
5. Manually approve and apply a reviewed change, then run tests and rescan. Record actual results, not an assistant's assertion of success.
6. Reflect: what did the skill help with? Which claims still required independent verification? Does import presence prove exploitability?

No AI access? Critique prompts/sample-response.md using the scan and source. Then carry out a reviewed manual fix. This is an authored teaching scenario, not a recorded model response.