diff --git a/marketplace/rh-agentic-collection.yml b/marketplace/rh-agentic-collection.yml
index 9d8ebdb9..1c2569ee 100644
--- a/marketplace/rh-agentic-collection.yml
+++ b/marketplace/rh-agentic-collection.yml
@@ -14,6 +14,13 @@ modules:
       - "openshift"
       - "administration"
       - "management"
+      - "security"
+      - "cve"
+      - "sbom"
+      - "vex"
+      - "coreos"
+      - "container-security"
+      - "vulnerability-management"
 
   - name: "rh-developer"
     description: "Plugins for building and deploying applications on Red Hat platforms."
@@ -97,3 +104,4 @@ modules:
       - "governance"
       - "troubleshooting"
       - "execution"
+
diff --git a/ocp-admin/.catalog/collection.json b/ocp-admin/.catalog/collection.json
index 4c162bd8..9d076f75 100644
--- a/ocp-admin/.catalog/collection.json
+++ b/ocp-admin/.catalog/collection.json
@@ -7,10 +7,13 @@
     "Red Hat",
     "Openshift",
     "Administration",
-    "Management"
+    "Management",
+    "Security",
+    "Container Security",
+    "Vulnerability Management"
   ],
   "contents": {
-    "description": "The pack provides three skills for cluster lifecycle and fleet visibility on OpenShift, using Assisted Installer and OCM APIs\nwhere applicable and read-only cluster APIs for consolidated reports.\n",
+    "description": "The pack provides seven skills for cluster lifecycle, fleet visibility, and security validation on OpenShift,\nusing Assisted Installer and OCM APIs for cluster management, read-only cluster APIs for consolidated reports,\nand Python helper scripts for CVE/SBOM/VEX-based security validation.\n",
     "orchestration_skills": [],
     "skills": [
       {
@@ -27,6 +30,26 @@
         "description": "Consolidated health report across kubeconfig contexts, skipping non-OpenShift contexts by default.",
         "name": "cluster-report",
         "summary_markdown": "Aggregate node, namespace, and workload signals across contexts that resolve to real OpenShift clusters.\n**Use when:**\n- \"Health report across clusters\"\n- \"Fleet summary from kubeconfig\"\n- \"Compare resource usage between contexts\"\n**What it does:**\n- Verifies each context is OpenShift before collecting metrics to avoid kube API errors.\n- Summarizes capacity, GPU presence, and pod health for operations review.\n"
+      },
+      {
+        "description": "Container image CVE validation using official SBOMs, Red Hat VEX data, and MITRE/OSV.dev metadata.",
+        "name": "container-cve-validator",
+        "summary_markdown": "Full CVE validation pipeline for Red Hat container images with SBOM attestation extraction, VEX matching,\nversion comparison, newer image scanning, and VEX data gap detection.\n**Use when:**\n- \"Is this CVE a real issue in my container image?\"\n- \"Validate RHSA against my image\"\n- \"Batch scan CVEs from a CSV file\"\n**What it does:**\n- Extracts official SBOMs, checks VEX product status, performs version comparison, and scans for patched images.\n"
+      },
+      {
+        "description": "CoreOS (RHCOS) CVE validation for specific OCP releases with RHEL EUS stream awareness.",
+        "name": "coreos-cve-validator",
+        "summary_markdown": "CVE validation for Red Hat Enterprise Linux CoreOS in specific OCP releases.\n**Use when:**\n- \"Does this CVE affect CoreOS in OCP 4.20?\"\n- \"Check CVE against RHCOS\"\n**What it does:**\n- Extracts RPM list from CoreOS images, validates against VEX with RHEL EUS CPE matching.\n"
+      },
+      {
+        "description": "CVE reconnaissance from MITRE, OSV.dev, and Go vulnerability database.",
+        "name": "cve-recon",
+        "summary_markdown": "Structured CVE metadata lookup with affected packages, version ranges, and CVSS scores.\n**Use when:**\n- \"What packages does this CVE affect?\"\n- \"Look up CVE details\"\n**What it does:**\n- Queries three data sources and returns merged results with cross-references.\n"
+      },
+      {
+        "description": "Container image metadata inspection with SBOM reference and registry ownership validation.",
+        "name": "image-inspect",
+        "summary_markdown": "Fetch image labels, validate registry ownership, resolve tag/digest via SBOM.\n**Use when:**\n- \"Inspect this container image\"\n- \"What SBOM does this image have?\"\n**What it does:**\n- Extracts labels, validates ownership, resolves SBOM artifact OCI reference.\n"
       }
     ],
     "skills_decision_guide": [
@@ -44,11 +67,31 @@
         "reason": "Read-only aggregation after OpenShift context verification.",
         "skill_to_use": "cluster-report",
         "user_request": "\"Fleet health\" or \"multi-cluster report from kubeconfig\""
+      },
+      {
+        "reason": "Full validation pipeline using SBOM attestations, Red Hat VEX data, and newer image scanning.",
+        "skill_to_use": "container-cve-validator",
+        "user_request": "\"Validate CVE against container image\" or \"Is this CVE a false positive?\""
+      },
+      {
+        "reason": "Extracts CoreOS RPM list, validates against VEX with RHEL EUS stream awareness.",
+        "skill_to_use": "coreos-cve-validator",
+        "user_request": "\"Check CVE against CoreOS in OCP 4.20\" or \"Validate RHSA against RHCOS\""
+      },
+      {
+        "reason": "Quick CVE metadata lookup from MITRE, OSV.dev, and Go vulnerability database.",
+        "skill_to_use": "cve-recon",
+        "user_request": "\"What packages does this CVE affect?\" or \"Look up CVE details\""
+      },
+      {
+        "reason": "Fetches image labels, registry ownership, and SBOM artifact reference.",
+        "skill_to_use": "image-inspect",
+        "user_request": "\"Inspect this container image\" or \"What SBOM does this image have?\""
       }
     ]
   },
   "deploy_and_use": "#deploy_and_use.md",
-  "description": "Automation capabilities for OpenShift Container Platform cluster management, workload orchestration, security policies, and operational tasks.",
+  "description": "Automation capabilities for OpenShift Container Platform cluster management, workload orchestration, security validation, and operational tasks including CVE validation for container images and CoreOS.",
   "homepage": "https://github.com/RHEcosystemAppEng/agentic-collections",
   "id": "openshift-administration",
   "keywords": [
@@ -56,7 +99,13 @@
     "assisted-installer",
     "ocm",
     "fleet",
-    "kubeconfig"
+    "kubeconfig",
+    "cve",
+    "sbom",
+    "vex",
+    "security",
+    "vulnerability",
+    "coreos"
   ],
   "legal_resources": {
     "license_agreement_url": "https://github.com/RHEcosystemAppEng/agentic-collections/blob/main/LICENSE",
@@ -71,7 +120,9 @@
   "mcp_section": "#mcp_section.md",
   "name": "Agentic skill pack for Red Hat OpenShift",
   "personas": [
-    "OpenShift Administrator"
+    "OpenShift Administrator",
+    "Security Engineer",
+    "DevSecOps"
   ],
   "provider": "Red Hat",
   "repository": "https://github.com/RHEcosystemAppEng/agentic-collections",
@@ -85,6 +136,21 @@
       "description": "Source repository for these packs, skills, and catalog metadata.",
       "title": "agentic-collections repository",
       "url": "https://github.com/RHEcosystemAppEng/agentic-collections"
+    },
+    {
+      "description": "Official Red Hat VEX/CSAF data, security advisories, and CVE information.",
+      "title": "Red Hat Security Data",
+      "url": "https://security.access.redhat.com/"
+    },
+    {
+      "description": "Authoritative CVE metadata source used for vulnerability reconnaissance.",
+      "title": "MITRE CVE API",
+      "url": "https://cveawg.mitre.org/"
+    },
+    {
+      "description": "Open Source Vulnerability database with cross-references to Go, PyPI, npm ecosystems.",
+      "title": "OSV.dev",
+      "url": "https://osv.dev/"
     }
   ],
   "sample_workflows": [
@@ -99,9 +165,17 @@
     {
       "name": "Multi-cluster health",
       "workflow": "User: \"Summarize node and pod health for every OpenShift context in my kubeconfig\"\n- `/cluster-report` skips non-OpenShift contexts and aggregates signals for operators\n"
+    },
+    {
+      "name": "Container CVE validation",
+      "workflow": "User: \"Is CVE-2024-45490 a real issue in registry.redhat.io/ubi9/ubi:latest?\"\n- `/container-cve-validator` extracts SBOM, checks VEX, confirms true/false positive with remediation\n"
+    },
+    {
+      "name": "CoreOS vulnerability check",
+      "workflow": "User: \"Does CVE-2025-61726 affect CoreOS in OCP 4.20.16?\"\n- `/coreos-cve-validator` extracts RPMs, finds affected package, checks VEX under OCP and RHEL EUS CPEs\n"
     }
   ],
-  "summary": "The ocp-admin collection covers Assisted Installer cluster creation, multi-cluster discovery across self-managed and managed\nOpenShift, and kubeconfig-backed fleet health reporting. Use CLAUDE.md intent routing to pick `/cluster-creator`,\n`/cluster-inventory`, or `/cluster-report`.\n",
+  "summary": "The ocp-admin collection covers Assisted Installer cluster creation, multi-cluster discovery across self-managed and managed\nOpenShift, kubeconfig-backed fleet health reporting, and security validation for Red Hat container images and CoreOS using\nofficial SBOMs and VEX data. Use CLAUDE.md intent routing to pick the right skill.\n",
   "support_level": "Unknown",
   "version": "0.1.0"
 }
diff --git a/ocp-admin/.catalog/collection.yaml b/ocp-admin/.catalog/collection.yaml
index 1be62b71..1cc9f06a 100644
--- a/ocp-admin/.catalog/collection.yaml
+++ b/ocp-admin/.catalog/collection.yaml
@@ -11,23 +11,29 @@ categories:
 - Openshift
 - Administration
 - Management
+- Security
+- Container Security
+- Vulnerability Management
 personas:
 - OpenShift Administrator
+- Security Engineer
+- DevSecOps
 marketplaces:
 - Claude Code
 - Cursor
 support_level: Unknown
 maturity: GREEN
-description: Automation capabilities for OpenShift Container Platform cluster management, workload orchestration, security
-  policies, and operational tasks.
+description: Automation capabilities for OpenShift Container Platform cluster management, workload orchestration,
+  security validation, and operational tasks including CVE validation for container images and CoreOS.
 summary: |
   The ocp-admin collection covers Assisted Installer cluster creation, multi-cluster discovery across self-managed and managed
-  OpenShift, and kubeconfig-backed fleet health reporting. Use CLAUDE.md intent routing to pick `/cluster-creator`,
-  `/cluster-inventory`, or `/cluster-report`.
+  OpenShift, kubeconfig-backed fleet health reporting, and security validation for Red Hat container images and CoreOS using
+  official SBOMs and VEX data. Use CLAUDE.md intent routing to pick the right skill.
 contents:
   description: |
-    The pack provides three skills for cluster lifecycle and fleet visibility on OpenShift, using Assisted Installer and OCM APIs
-    where applicable and read-only cluster APIs for consolidated reports.
+    The pack provides seven skills for cluster lifecycle, fleet visibility, and security validation on OpenShift,
+    using Assisted Installer and OCM APIs for cluster management, read-only cluster APIs for consolidated reports,
+    and Python helper scripts for CVE/SBOM/VEX-based security validation.
   skills:
   - name: cluster-creator
     description: End-to-end OpenShift cluster creation using Red Hat Assisted Installer (SNO and HA; bare metal, vSphere, OCI, Nutanix).
@@ -62,6 +68,44 @@ contents:
       **What it does:**
       - Verifies each context is OpenShift before collecting metrics to avoid kube API errors.
       - Summarizes capacity, GPU presence, and pod health for operations review.
+  - name: container-cve-validator
+    description: Container image CVE validation using official SBOMs, Red Hat VEX data, and MITRE/OSV.dev metadata.
+    summary_markdown: |
+      Full CVE validation pipeline for Red Hat container images with SBOM attestation extraction, VEX matching,
+      version comparison, newer image scanning, and VEX data gap detection.
+      **Use when:**
+      - "Is this CVE a real issue in my container image?"
+      - "Validate RHSA against my image"
+      - "Batch scan CVEs from a CSV file"
+      **What it does:**
+      - Extracts official SBOMs, checks VEX product status, performs version comparison, and scans for patched images.
+  - name: coreos-cve-validator
+    description: CoreOS (RHCOS) CVE validation for specific OCP releases with RHEL EUS stream awareness.
+    summary_markdown: |
+      CVE validation for Red Hat Enterprise Linux CoreOS in specific OCP releases.
+      **Use when:**
+      - "Does this CVE affect CoreOS in OCP 4.20?"
+      - "Check CVE against RHCOS"
+      **What it does:**
+      - Extracts RPM list from CoreOS images, validates against VEX with RHEL EUS CPE matching.
+  - name: cve-recon
+    description: CVE reconnaissance from MITRE, OSV.dev, and Go vulnerability database.
+    summary_markdown: |
+      Structured CVE metadata lookup with affected packages, version ranges, and CVSS scores.
+      **Use when:**
+      - "What packages does this CVE affect?"
+      - "Look up CVE details"
+      **What it does:**
+      - Queries three data sources and returns merged results with cross-references.
+  - name: image-inspect
+    description: Container image metadata inspection with SBOM reference and registry ownership validation.
+    summary_markdown: |
+      Fetch image labels, validate registry ownership, resolve tag/digest via SBOM.
+      **Use when:**
+      - "Inspect this container image"
+      - "What SBOM does this image have?"
+      **What it does:**
+      - Extracts labels, validates ownership, resolves SBOM artifact OCI reference.
   orchestration_skills: []
   skills_decision_guide:
   - user_request: '"Create cluster" or "install OpenShift with Assisted Installer"'
@@ -73,6 +117,18 @@ contents:
   - user_request: '"Fleet health" or "multi-cluster report from kubeconfig"'
     skill_to_use: cluster-report
     reason: Read-only aggregation after OpenShift context verification.
+  - user_request: '"Validate CVE against container image" or "Is this CVE a false positive?"'
+    skill_to_use: container-cve-validator
+    reason: Full validation pipeline using SBOM attestations, Red Hat VEX data, and newer image scanning.
+  - user_request: '"Check CVE against CoreOS in OCP 4.20" or "Validate RHSA against RHCOS"'
+    skill_to_use: coreos-cve-validator
+    reason: Extracts CoreOS RPM list, validates against VEX with RHEL EUS stream awareness.
+  - user_request: '"What packages does this CVE affect?" or "Look up CVE details"'
+    skill_to_use: cve-recon
+    reason: Quick CVE metadata lookup from MITRE, OSV.dev, and Go vulnerability database.
+  - user_request: '"Inspect this container image" or "What SBOM does this image have?"'
+    skill_to_use: image-inspect
+    reason: Fetches image labels, registry ownership, and SBOM artifact reference.
 mcp_section: '#mcp_section.md'
 deploy_and_use: '#deploy_and_use.md'
 sample_workflows:
@@ -89,6 +145,14 @@ sample_workflows:
   workflow: |
     User: "Summarize node and pod health for every OpenShift context in my kubeconfig"
     - `/cluster-report` skips non-OpenShift contexts and aggregates signals for operators
+- name: Container CVE validation
+  workflow: |
+    User: "Is CVE-2024-45490 a real issue in registry.redhat.io/ubi9/ubi:latest?"
+    - `/container-cve-validator` extracts SBOM, checks VEX, confirms true/false positive with remediation
+- name: CoreOS vulnerability check
+  workflow: |
+    User: "Does CVE-2025-61726 affect CoreOS in OCP 4.20.16?"
+    - `/coreos-cve-validator` extracts RPMs, finds affected package, checks VEX under OCP and RHEL EUS CPEs
 resources:
 - title: OpenShift documentation
   url: https://docs.redhat.com/en/documentation/openshift_container_platform/
@@ -96,6 +160,15 @@ resources:
 - title: agentic-collections repository
   url: https://github.com/RHEcosystemAppEng/agentic-collections
   description: Source repository for these packs, skills, and catalog metadata.
+- title: Red Hat Security Data
+  url: https://security.access.redhat.com/
+  description: Official Red Hat VEX/CSAF data, security advisories, and CVE information.
+- title: MITRE CVE API
+  url: https://cveawg.mitre.org/
+  description: Authoritative CVE metadata source used for vulnerability reconnaissance.
+- title: OSV.dev
+  url: https://osv.dev/
+  description: Open Source Vulnerability database with cross-references to Go, PyPI, npm ecosystems.
 legal_resources:
   license_agreement_url: https://github.com/RHEcosystemAppEng/agentic-collections/blob/main/LICENSE
   privacy_policy_url: https://www.redhat.com/en/about/privacy-policy
@@ -111,3 +184,9 @@ keywords:
 - ocm
 - fleet
 - kubeconfig
+- cve
+- sbom
+- vex
+- security
+- vulnerability
+- coreos
diff --git a/ocp-admin/CLAUDE.md b/ocp-admin/CLAUDE.md
index 29e7a1c8..22d9ecdb 100644
--- a/ocp-admin/CLAUDE.md
+++ b/ocp-admin/CLAUDE.md
@@ -1,10 +1,10 @@
 # ocp-admin Plugin
 
-You are an OpenShift administrator assistant. You help users create OpenShift clusters using Red Hat Assisted Installer, manage multi-cluster fleets, and monitor cluster health across self-managed (OCP, SNO) and managed service (ROSA, ARO, OSD) deployments.
+You are an OpenShift administrator and security assistant. You help users create OpenShift clusters using Red Hat Assisted Installer, manage multi-cluster fleets, monitor cluster health across self-managed (OCP, SNO) and managed service (ROSA, ARO, OSD) deployments, and validate CVEs against Red Hat container images and OpenShift CoreOS using official SBOMs and VEX data.
 
 ## Skill-First Rule
 
-ALWAYS use the appropriate skill for OpenShift cluster administration tasks. Do NOT call MCP tools (openshift-self-managed, openshift-ocm-managed, openshift-administration) directly — skills handle error recovery, multi-API coordination, credential safety, and user confirmations automatically.
+ALWAYS use the appropriate skill for OpenShift cluster administration and security validation tasks. Do NOT call MCP tools (openshift-self-managed, openshift-ocm-managed, openshift-administration) or helper scripts directly — skills handle error recovery, multi-API coordination, credential safety, and user confirmations automatically.
 
 To invoke a skill, use the Skill tool with the skill name (e.g., `/cluster-creator`).
 
@@ -17,6 +17,10 @@ Match the user's request to the correct skill:
 | Create cluster, install OpenShift, deploy SNO, deploy HA cluster, provision cluster, set up cluster | `/cluster-creator` |
 | List clusters, show cluster status, cluster details, cluster events, installation progress, cluster inventory | `/cluster-inventory` |
 | Health report, multi-cluster status, fleet summary, resource usage across clusters, cluster comparison | `/cluster-report` |
+| Validate a CVE against a container image, check if image is affected, RHSA against an image | `/container-cve-validator` |
+| Validate a CVE against CoreOS/RHCOS in a specific OCP version | `/coreos-cve-validator` |
+| Look up CVE details, affected packages, version ranges, ecosystem info | `/cve-recon` |
+| Inspect container image metadata, labels, SBOM reference, registry ownership | `/image-inspect` |
 
 If the request doesn't clearly match one skill, ask the user to clarify.
 
@@ -26,6 +30,9 @@ Some workflows require multiple skills in sequence:
 
 - **New cluster deployment monitoring**: `/cluster-creator` → `/cluster-inventory` (check installation progress) → `/cluster-report` (verify health)
 - **Fleet health check**: `/cluster-inventory` (list all clusters) → `/cluster-report` (aggregate metrics)
+- **Container image metadata audit then CVE validation**: `/image-inspect` (check metadata and SBOM) → `/container-cve-validator` (validate specific CVE)
+- **CVE research then validate**: `/cve-recon` (look up CVE details) → `/container-cve-validator` or `/coreos-cve-validator` (validate against specific image or OCP version)
+- **CoreOS security check**: `/coreos-cve-validator` (validate CVE against OCP release) — uses `oc` and `podman` for CoreOS RPM extraction
 
 After completing a skill, suggest relevant next-step skills to the user.
 
@@ -37,6 +44,18 @@ Three MCP servers are available. Skills manage these automatically — do not ca
 - **openshift-ocm-managed** (Required for cluster-inventory) — OpenShift Cluster Manager API for managed service clusters (ROSA, ARO, OSD). Requires OFFLINE_TOKEN.
 - **openshift-administration** (Required for cluster-report) — Kubernetes/OpenShift cluster operations for multi-cluster management. Requires KUBECONFIG with cluster access. Read-only mode enforced.
 
+## Helper Scripts (Security Validation)
+
+Security validation skills use Python helper scripts in `scripts/security-validation/` for deterministic data fetching from public APIs (Red Hat security APIs, MITRE CVE API, OSV.dev). Skills call these scripts via `python $SCRIPTS_DIR/<script>` — do not call scripts directly outside of a skill workflow. These skills do not use MCP servers.
+
+## Security Validation Prerequisites
+
+- `regctl` — remote image metadata inspection
+- `cosign` — SBOM extraction from container attestations
+- `python3` + `requests` — helper scripts
+- `syft` — fallback SBOM generation (optional, used when attestations unavailable)
+- `oc` + `podman` — CoreOS RPM extraction (coreos-cve-validator only)
+
 ## Global Rules
 
 1. **Never expose credentials** — do not display OFFLINE_TOKEN, kubeconfig contents, pull secrets, or any credential values in output. Only report whether they exist.
@@ -54,3 +73,5 @@ Three MCP servers are available. Skills manage these automatically — do not ca
 5. **Installation monitoring** — for `/cluster-creator`, actively monitor installation progress and report validation errors from cluster events. Don't just trigger installation and disappear.
 6. **OpenShift cluster verification** — `/cluster-report` verifies each kubeconfig context is a genuine OpenShift cluster before reporting. Non-OpenShift contexts are skipped by default to avoid errors.
 7. **Suggest next steps** — after completing a skill, suggest related skills or documentation the user might need next.
+8. **No ad-hoc data processing** — for security validation skills, do not write custom bash scripts, jq filters, or grep commands to process data. The LLM reads raw JSON and performs matching in its reasoning.
+9. **Official data only** — use official Red Hat SBOMs (build-time/release-time attestations) and VEX files. Do not use third-party vulnerability databases as primary sources.
diff --git a/ocp-admin/README.md b/ocp-admin/README.md
index 3ac398f0..b2709493 100644
--- a/ocp-admin/README.md
+++ b/ocp-admin/README.md
@@ -31,6 +31,13 @@ The ocp-admin collection provides specialized tools for managing OpenShift clust
 - **For cluster operations**:
   - OpenShift cluster access via `KUBECONFIG`
   - For multi-cluster reports, a kubeconfig with multiple contexts
+- **For security validation**:
+  - `python3` + `requests` — helper scripts for API calls
+  - `regctl` — remote image metadata inspection ([install guide](https://github.com/regclient/regclient))
+  - `cosign` — SBOM extraction from container attestations ([install guide](https://github.com/sigstore/cosign))
+  - `syft` — (optional) fallback SBOM generation when attestations are unavailable ([install guide](https://github.com/anchore/syft))
+  - `oc` + `podman` — CoreOS RPM extraction (coreos-cve-validator only)
+  - Registry authentication: `regctl registry login registry.redhat.io` for Red Hat image access
 
 ### Installation (Lola)
 
@@ -328,6 +335,87 @@ Generate consolidated health reports across multiple OpenShift clusters.
 - `assemble.py` - Resolves file references and loads MCP output
 - `aggregate.py` - Computes metrics and identifies issues
 
+### 4. **container-cve-validator** - Container Image CVE Validation
+
+Validate CVEs against Red Hat container images using official SBOM attestations, Red Hat VEX data, and CVE metadata from MITRE/OSV.dev.
+
+**Use when**:
+- "Is CVE-2024-45490 a real issue in my UBI9 image?"
+- "Validate this CVE against registry.redhat.io/ubi9/ubi:latest"
+- "My scanner flagged RHSA-2026:3337 on our image. Is this relevant?"
+- "Batch scan these CVEs from a CSV file"
+
+**What it does**:
+- Extracts official SBOM attestations from container images
+- Checks Red Hat VEX/CSAF data for product-specific vulnerability status
+- Performs version comparison (RPM EVR, Go semver, PyPI, npm)
+- Scans for newer patched images in the same or newer product stream
+- Detects VEX data gaps and recommends reporting to secalert@redhat.com
+- Supports CVE IDs, RHSA advisory IDs, and batch CSV input
+- Output formats: markdown (full/summary), JSON, CSV
+
+**Helper Scripts** (in `scripts/security-validation/`):
+- `validate_input.py` - Validates CVE IDs and image references
+- `inspect_image.py` - Extracts container image metadata via regctl
+- `fetch_cve_metadata.py` - Queries MITRE, OSV.dev, and Go vuln DB
+- `download_sbom.py` - Fetches SBOM attestations from registry
+- `fetch_redhat_vex.py` - Retrieves Red Hat VEX security advisories
+- `scan_newer_images.py` - Finds patched image releases
+
+### 5. **coreos-cve-validator** - CoreOS CVE Validation
+
+Validate CVEs against Red Hat Enterprise Linux CoreOS (RHCOS) in specific OCP releases.
+
+**Use when**:
+- "Does CVE-2025-61726 affect CoreOS in OCP 4.20.16?"
+- "Check this CVE against RHCOS in our OCP cluster"
+- "Validate RHSA against CoreOS"
+
+**What it does**:
+- Extracts full RPM package list from CoreOS images via `oc adm release info` + `podman`
+- Classifies RPMs by source (RHEL repository, OCP repository, Fast Datapath)
+- Validates against VEX data with RHEL EUS stream awareness (not latest RHEL)
+- Detects RHCOS VEX discrepancies (RPM patched in RHEL but CoreOS not rebuilt)
+- Handles both legacy (OCP < 4.19) and RHEL-based (OCP >= 4.19) CoreOS versioning
+
+**Helper Scripts** (in `scripts/security-validation/`):
+- `validate_input.py` - Validates CVE IDs and OCP versions
+- `fetch_cve_metadata.py` - Queries CVE data sources
+- `fetch_coreos_metadata.py` - Extracts CoreOS RPM list (supports `--authfile` for pull secret)
+- `fetch_redhat_vex.py` - Retrieves VEX advisories
+
+### 6. **cve-recon** - CVE Reconnaissance
+
+Query MITRE, OSV.dev, and Go vulnerability database to produce a structured report for a given CVE.
+
+**Use when**:
+- "What packages does CVE-2024-45490 affect?"
+- "Look up CVE details and version ranges"
+- "Get ecosystem and severity info for this CVE"
+
+**What it does**:
+- Queries MITRE CVE API, OSV.dev, and Go vulnerability database in a single call
+- Reports affected packages with ecosystem, version ranges, and CVSS scores
+- Provides cross-references (GO-*, GHSA-*) and deduplicated reference URLs
+- Output formats: markdown, JSON, CSV
+
+### 7. **image-inspect** - Container Image Metadata Inspection
+
+Fetch container image labels, validate registry ownership, resolve tag/digest via SBOM, and report the SBOM artifact reference.
+
+**Use when**:
+- "Inspect this container image"
+- "What SBOM does this image have?"
+- "Check metadata for registry.redhat.io/ubi9/ubi:latest"
+- "Is this image from Red Hat?"
+
+**What it does**:
+- Extracts image labels (CPE, name, vendor, maintainer, build timestamp)
+- Validates registry ownership (official Red Hat vs. mirrored)
+- Resolves tag/digest from SBOM `pkg:oci/` PURL
+- Reports SBOM artifact OCI reference and fetch command
+- Output formats: markdown, JSON, CSV
+
 ---
 
 ## Multi-Cluster Authentication
@@ -513,7 +601,33 @@ User: "Generate a health report for all my clusters"
 Result: Fleet-wide health summary with attention items
 ```
 
-### Workflow 4: Check Cluster Installation Progress
+### Workflow 4: Container CVE Validation
+
+```
+User: "Is CVE-2024-45490 a real issue in registry.redhat.io/ubi9/ubi:latest?"
+→ container-cve-validator skill:
+  - Extracts SBOM from image attestations
+  - Queries MITRE and OSV.dev for affected packages/versions
+  - Checks Red Hat VEX for product-specific status
+  - Scans for newer patched images if a fix exists
+
+Result: True/false positive determination with remediation guidance
+```
+
+### Workflow 5: CoreOS Vulnerability Check
+
+```
+User: "Does CVE-2025-61726 affect CoreOS in OCP 4.20.16?"
+→ coreos-cve-validator skill:
+  - Extracts RPM list from CoreOS image
+  - Matches affected package and checks version
+  - Validates against VEX under OCP and RHEL EUS CPEs
+  - Reports whether CoreOS has been rebuilt with the fix
+
+Result: CoreOS-specific vulnerability assessment with RHEL EUS stream awareness
+```
+
+### Workflow 6: Check Cluster Installation Progress
 
 ```
 User: "What's the status of my cluster installation?"
@@ -650,22 +764,41 @@ ocp-admin/
 ├── skills/
 │   ├── cluster-creator/SKILL.md      # End-to-end cluster deployment
 │   ├── cluster-inventory/SKILL.md    # Cluster discovery and status
-│   └── cluster-report/SKILL.md       # Multi-cluster health reporting
+│   ├── cluster-report/SKILL.md       # Multi-cluster health reporting
+│   ├── container-cve-validator/      # Container image CVE validation
+│   │   ├── SKILL.md
+│   │   └── references/
+│   │       ├── 01-vex-validation-procedure.md
+│   │       └── 02-report-template.md
+│   ├── coreos-cve-validator/SKILL.md # CoreOS CVE validation
+│   ├── cve-recon/SKILL.md            # CVE reconnaissance
+│   └── image-inspect/SKILL.md        # Container image metadata inspection
 └── scripts/
-    └── cluster-report/
-        ├── build-kubeconfig.py       # Multi-cluster authentication
-        ├── cluster-reporter-rbac.yaml
-        ├── assemble.py               # MCP output assembly
-        └── aggregate.py              # Metrics aggregation
+    ├── cluster-report/
+    │   ├── build-kubeconfig.py       # Multi-cluster authentication
+    │   ├── cluster-reporter-rbac.yaml
+    │   ├── assemble.py               # MCP output assembly
+    │   └── aggregate.py              # Metrics aggregation
+    └── security-validation/          # CVE validation helper scripts
+        ├── validate_input.py         # Input validation
+        ├── inspect_image.py          # Image metadata extraction
+        ├── fetch_cve_metadata.py     # MITRE/OSV.dev/Go vuln DB queries
+        ├── download_sbom.py          # SBOM attestation extraction
+        ├── generate_sbom_syft.py     # Fallback SBOM generation
+        ├── fetch_coreos_metadata.py  # CoreOS RPM extraction
+        ├── fetch_redhat_vex.py       # Red Hat VEX data fetching
+        ├── fetch_rhsa_advisory.py    # RHSA advisory resolution
+        └── scan_newer_images.py      # Patched image scanning
 ```
 
 *Optional:* `.claude-plugin/plugin.json` — only if publishing via Claude Code’s plugin format; not required for [Lola](https://github.com/RedHatProductSecurity/lola) install.
 
 ### Key Patterns
 
-- **Skills encapsulate operations** - Each skill handles one category of cluster tasks
-- **Complete lifecycle coverage** - Create → Configure → Monitor → Operate
+- **Skills encapsulate operations** - Each skill handles one category of cluster or security tasks
+- **Complete lifecycle coverage** - Create → Configure → Monitor → Operate → Validate Security
 - **Dual MCP integration** - Assisted Installer (creation) + OpenShift (operations)
+- **Script-based security validation** - Python helper scripts for CVE/SBOM/VEX data fetching (no MCP servers)
 - **Environment-based auth** - OFFLINE_TOKEN (Assisted Installer) + KUBECONFIG (cluster ops)
 - **Human-in-the-loop** - User approval required before critical operations
 - **Comprehensive documentation** - 17 reference docs covering all aspects
@@ -687,6 +820,12 @@ ocp-admin/
 - ServiceAccount-based authorization for multi-cluster
 - Read-only operations by default (cluster-report)
 
+**Security validation data sources**:
+- Official Red Hat SBOM attestations (build-time and release-time) — extracted via cosign
+- Red Hat VEX/CSAF data from https://security.access.redhat.com/data/csaf/v2/
+- MITRE CVE API, OSV.dev, Go vulnerability database — public APIs, no authentication required
+- No credential files accessed directly — pull secret path provided by user on auth failure only
+
 ---
 
 ## Development
@@ -712,4 +851,9 @@ See main repository [README.md](../README.md) for:
 - [Assisted Installer documentation](https://docs.redhat.com/en/documentation/assisted_installer_for_openshift_container_platform) - Documentation for Red Hat OpenShift Container Platform Assisted Installer
 - [Assisted Service MCP Server](https://github.com/openshift-assisted/assisted-service-mcp) - Documentation for Assisted Service MCP Server
 - [OpenShift MCP Server](https://github.com/openshift/openshift-mcp-server) - Documentation and details for the OpenShift MCP Server
-- [MCP Protocol Specification](https://modelcontextprotocol.io)
\ No newline at end of file
+- [MCP Protocol Specification](https://modelcontextprotocol.io)
+- [Red Hat Security Data](https://security.access.redhat.com/) - Official Red Hat VEX/CSAF data and security advisories
+- [MITRE CVE API](https://cveawg.mitre.org/) - Authoritative CVE metadata source
+- [OSV.dev](https://osv.dev/) - Open Source Vulnerability database
+- [Sigstore cosign](https://github.com/sigstore/cosign) - SBOM attestation extraction tool
+- [regclient](https://github.com/regclient/regclient) - Registry client for image metadata inspection
\ No newline at end of file
diff --git a/ocp-admin/scripts/security-validation/download_sbom.py b/ocp-admin/scripts/security-validation/download_sbom.py
new file mode 100644
index 00000000..fa583f87
--- /dev/null
+++ b/ocp-admin/scripts/security-validation/download_sbom.py
@@ -0,0 +1,173 @@
+#!/usr/bin/env python3
+"""Download SBOM from a container image via cosign. Returns the full raw SPDX JSON.
+
+Handles image index detection: if the SBOM is for a multi-arch image index,
+automatically extracts the linux/amd64 digest and re-fetches the
+architecture-specific SBOM.
+
+The output is a JSON envelope with metadata (sbom_source, image_ref, errors)
+and the complete raw SPDX document in the 'spdx' field. The LLM should read
+and interpret the full SPDX data — packages, relationships, PURLs, versions.
+"""
+
+import argparse
+import base64
+import json
+import re
+import shutil
+import subprocess
+import sys
+
+
+def run_cmd(cmd, timeout=120):
+    try:
+        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
+        return result.returncode, result.stdout, result.stderr
+    except subprocess.TimeoutExpired:
+        return -1, "", "command timed out"
+    except FileNotFoundError:
+        return -1, "", f"command not found: {cmd[0]}"
+
+
+def try_attestation_sbom(image_ref):
+    rc, stdout, stderr = run_cmd([
+        "cosign", "download", "attestation",
+        "--predicate-type=spdx", image_ref
+    ])
+    if rc != 0:
+        return None, f"attestation: {stderr.strip()}"
+
+    for line in stdout.strip().split("\n"):
+        if not line.strip():
+            continue
+        try:
+            envelope = json.loads(line)
+            payload = base64.b64decode(envelope.get("payload", ""))
+            att = json.loads(payload)
+            predicate = att.get("predicate", att)
+            if "spdxVersion" in predicate or "packages" in predicate:
+                return predicate, None
+        except (json.JSONDecodeError, KeyError, Exception):
+            continue
+
+    return None, "attestation: no valid SPDX predicate found"
+
+
+def try_buildtime_sbom(image_ref, platform="linux/amd64"):
+    rc, stdout, stderr = run_cmd([
+        "cosign", "download", "sbom",
+        "--platform", platform, image_ref
+    ])
+    if rc != 0:
+        return None, f"build-time: {stderr.strip()}"
+
+    try:
+        sbom = json.loads(stdout)
+        if "spdxVersion" in sbom or "packages" in sbom:
+            return sbom, None
+    except json.JSONDecodeError:
+        pass
+
+    return None, "build-time: no valid SPDX JSON found"
+
+
+def is_image_index_sbom(sbom):
+    packages = sbom.get("packages", [])
+    return bool(packages and packages[0].get("SPDXID") == "SPDXRef-image-index")
+
+
+def extract_amd64_digest(sbom):
+    for pkg in sbom.get("packages", []):
+        for ref in pkg.get("externalRefs", []):
+            locator = ref.get("referenceLocator", "")
+            if "arch=amd64" in locator or "arch=x86_64" in locator:
+                match = re.search(r"@sha256:([a-f0-9]{64})", locator)
+                if match:
+                    return f"sha256:{match.group(1)}"
+
+        for checksum in pkg.get("checksums", []):
+            if checksum.get("algorithm", "").upper() == "SHA256":
+                return f"sha256:{checksum['checksumValue']}"
+
+    for rel in sbom.get("relationships", []):
+        if rel.get("relationshipType") == "VARIANT_OF":
+            element = rel.get("relatedSpdxElement", "")
+            match = re.search(r"sha256-([a-f0-9]{64})", element)
+            if match:
+                return f"sha256:{match.group(1)}"
+
+    return None
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Download SBOM from a container image")
+    parser.add_argument("image_ref", help="Container image reference")
+    parser.add_argument("--platform", default="linux/amd64", help="Platform (default: linux/amd64)")
+    args = parser.parse_args()
+
+    if not shutil.which("cosign"):
+        json.dump({"error": "cosign not found in PATH"}, sys.stdout, indent=2)
+        sys.exit(1)
+
+    errors = []
+    sbom = None
+    sbom_source = ""
+
+    sbom, err = try_attestation_sbom(args.image_ref)
+    if sbom:
+        sbom_source = "attestation"
+    else:
+        if err:
+            errors.append(err)
+        sbom, err = try_buildtime_sbom(args.image_ref, args.platform)
+        if sbom:
+            sbom_source = "build_time"
+        else:
+            if err:
+                errors.append(err)
+
+    if sbom and is_image_index_sbom(sbom):
+        digest = extract_amd64_digest(sbom)
+        if digest:
+            registry_path = args.image_ref.split(":")[0].split("@")[0]
+            arch_ref = f"{registry_path}@{digest}"
+            errors.append(f"image index detected, re-fetched with {arch_ref}")
+
+            sbom2, err2 = try_attestation_sbom(arch_ref)
+            if sbom2:
+                sbom = sbom2
+                sbom_source = "attestation"
+            else:
+                sbom2, err2 = try_buildtime_sbom(arch_ref, args.platform)
+                if sbom2:
+                    sbom = sbom2
+                    sbom_source = "build_time"
+                else:
+                    if err2:
+                        errors.append(err2)
+        else:
+            errors.append("image index detected but could not extract amd64 digest")
+
+    if not sbom:
+        json.dump({
+            "image_ref": args.image_ref,
+            "sbom_source": "",
+            "spdx": None,
+            "errors": errors if errors else ["no SBOM found"],
+        }, sys.stdout, indent=2)
+        print()
+        sys.exit(0)
+
+    result = {
+        "image_ref": args.image_ref,
+        "sbom_source": sbom_source,
+        "spdx": sbom,
+        "errors": errors,
+    }
+
+    json.dump(result, sys.stdout, indent=2)
+    print()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/ocp-admin/scripts/security-validation/fetch_coreos_metadata.py b/ocp-admin/scripts/security-validation/fetch_coreos_metadata.py
new file mode 100644
index 00000000..5af314f0
--- /dev/null
+++ b/ocp-admin/scripts/security-validation/fetch_coreos_metadata.py
@@ -0,0 +1,291 @@
+#!/usr/bin/env python3
+"""Fetch OCP release metadata and extract CoreOS RPM package list."""
+
+import argparse
+import json
+import re
+import shutil
+import subprocess
+import sys
+
+OCP_VERSION_RE = re.compile(r"^4\.\d+\.\d+$")
+TIMEOUT_RELEASE = 60
+TIMEOUT_RPM = 300
+
+
+def run_cmd(cmd, timeout=60):
+    try:
+        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
+        return result.returncode, result.stdout, result.stderr
+    except subprocess.TimeoutExpired:
+        return -1, "", f"command timed out after {timeout}s"
+    except FileNotFoundError:
+        return -1, "", f"command not found: {cmd[0]}"
+
+
+def parse_release_info(stdout):
+    info = {
+        "created": "",
+        "machine_os": "",
+        "component_versions": {},
+        "coreos_pullspec": "",
+    }
+
+    for line in stdout.split("\n"):
+        line = line.strip()
+
+        if line.startswith("Created:"):
+            info["created"] = line.split("Created:", 1)[1].strip()
+
+        if "machine-os" in line.lower() and "Red Hat Enterprise Linux CoreOS" in line:
+            parts = line.split()
+            for i, p in enumerate(parts):
+                if p == "machine-os" and i + 1 < len(parts):
+                    info["machine_os"] = parts[i + 1]
+
+        for comp in ("kubernetes", "kubectl", "kubernetes-tests"):
+            if line.startswith(comp):
+                parts = line.split()
+                if len(parts) >= 2:
+                    info["component_versions"][comp] = parts[1]
+
+        if line.startswith("rhel-coreos ") or line.startswith("rhel-coreos\t"):
+            parts = line.split()
+            for p in parts:
+                if p.startswith("quay.io/"):
+                    info["coreos_pullspec"] = p
+                    break
+
+    return info
+
+
+def classify_rpm(name, evr):
+    name_lower = name.lower()
+    evr_lower = evr.lower()
+    combined = f"{name_lower} {evr_lower}"
+
+    if "rhaos4" in combined or "rhaos-4" in combined:
+        return "ocp"
+    if "fast-datapath" in combined or "fdp" in combined or "openvswitch" in name_lower:
+        return "fast_datapath"
+    return "rhel"
+
+
+def parse_coreos_version(machine_os, ocp_version):
+    """Parse CoreOS version string handling both versioning schemes.
+
+    OCP >= 4.19: RHEL-based versioning, e.g. "9.6.20250617-0"
+      - 9.6 = RHEL version, 20250617 = build date
+    OCP < 4.19: legacy versioning, e.g. "416.94.202410071428-0"
+      - 416 = OCP 4.16, 94 = RHEL 9.4, 202410071428 = build date+time
+
+    Returns dict with rhel_version, rhel_major, coreos_version_scheme, and
+    coreos_build_id (for version comparison).
+    """
+    result = {
+        "rhel_version": "",
+        "rhel_major": "",
+        "coreos_version_scheme": "",
+        "coreos_build_id": "",
+    }
+
+    if not machine_os:
+        return result
+
+    ocp_minor = int(ocp_version.split(".")[1]) if "." in ocp_version else 0
+
+    legacy_match = re.match(r"(\d{3})\.(\d{2})\.([\d]+)-?", machine_os)
+    new_match = re.match(r"(\d+)\.(\d+)\.([\d]+)-?", machine_os)
+
+    if legacy_match and ocp_minor < 19:
+        ocp_code = legacy_match.group(1)
+        rhel_code = legacy_match.group(2)
+        build_id = legacy_match.group(3)
+
+        rhel_major = rhel_code[0]
+        rhel_minor = rhel_code[1:]
+        result["rhel_version"] = f"{rhel_major}.{rhel_minor}"
+        result["rhel_major"] = rhel_major
+        result["coreos_version_scheme"] = "legacy"
+        result["coreos_build_id"] = build_id
+    elif new_match:
+        major = new_match.group(1)
+        minor = new_match.group(2)
+        build_id = new_match.group(3)
+
+        result["rhel_version"] = f"{major}.{minor}"
+        result["rhel_major"] = major
+        result["coreos_version_scheme"] = "rhel_based"
+        result["coreos_build_id"] = build_id
+    else:
+        first_dot = machine_os.find(".")
+        if first_dot > 0:
+            result["rhel_major"] = machine_os[0]
+
+    return result
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Fetch OCP release and CoreOS RPM metadata")
+    parser.add_argument("ocp_version", help="OCP version (e.g., 4.20.17)")
+    parser.add_argument("--cache-dir", default="", help="Directory to cache results per OCP version")
+    parser.add_argument("--authfile", default="", help="Path to pull secret file for podman authentication")
+    args = parser.parse_args()
+
+    if args.cache_dir:
+        import os
+        cache_file = os.path.join(args.cache_dir, f"coreos-{args.ocp_version}.json")
+        if os.path.isfile(cache_file):
+            with open(cache_file, "r") as f:
+                sys.stdout.write(f.read())
+            sys.exit(0)
+
+    if not OCP_VERSION_RE.match(args.ocp_version):
+        json.dump({
+            "ocp_version": args.ocp_version,
+            "error": f"Invalid OCP version format: '{args.ocp_version}'. Expected: 4.X.Y",
+            "errors": ["Invalid OCP version format"],
+        }, sys.stdout, indent=2)
+        print()
+        sys.exit(1)
+
+    errors = []
+
+    if not shutil.which("oc"):
+        json.dump({
+            "ocp_version": args.ocp_version,
+            "error": "oc CLI not found in PATH. Install from https://console.redhat.com/openshift/downloads",
+            "errors": ["oc not installed"],
+        }, sys.stdout, indent=2)
+        print()
+        sys.exit(1)
+
+    if not shutil.which("podman"):
+        json.dump({
+            "ocp_version": args.ocp_version,
+            "error": "podman not found in PATH. Install podman before running.",
+            "errors": ["podman not installed"],
+        }, sys.stdout, indent=2)
+        print()
+        sys.exit(1)
+
+    rc, stdout, stderr = run_cmd(
+        ["oc", "adm", "release", "info", args.ocp_version, "--pullspecs"],
+        timeout=TIMEOUT_RELEASE
+    )
+    if rc != 0:
+        json.dump({
+            "ocp_version": args.ocp_version,
+            "error": f"oc adm release info failed: {stderr.strip()}",
+            "errors": [f"oc failed (exit {rc}): {stderr.strip()[:300]}"],
+        }, sys.stdout, indent=2)
+        print()
+        sys.exit(1)
+
+    info = parse_release_info(stdout)
+
+    if not info["coreos_pullspec"]:
+        json.dump({
+            "ocp_version": args.ocp_version,
+            "error": "Could not find rhel-coreos pullspec in release info",
+            "errors": ["rhel-coreos image not found in release"],
+        }, sys.stdout, indent=2)
+        print()
+        sys.exit(1)
+
+    coreos_info = parse_coreos_version(info["machine_os"], args.ocp_version)
+    rhel_version = coreos_info["rhel_version"]
+    rhel_major = coreos_info["rhel_major"]
+    ocp_minor = ".".join(args.ocp_version.split(".")[:2])
+
+    podman_cmd = ["podman", "run", "--rm"]
+    if args.authfile:
+        podman_cmd += ["--authfile", args.authfile]
+    podman_cmd += ["--entrypoint", "/bin/rpm",
+         info["coreos_pullspec"],
+         "-qa", "--queryformat", "%{NAME}\\t%{EPOCH}:%{VERSION}-%{RELEASE}\\t%{ARCH}\\n"]
+
+    rc, stdout_rpm, stderr_rpm = run_cmd(podman_cmd, timeout=TIMEOUT_RPM)
+
+    if rc != 0:
+        if any(s in stderr_rpm.lower() for s in ("unauthorized", "authentication", "denied", "auth")):
+            json.dump({
+                "ocp_version": args.ocp_version,
+                "coreos_pullspec": info["coreos_pullspec"],
+                "error": "Authentication failed pulling CoreOS image. Download your pull secret from https://console.redhat.com/openshift/downloads and re-run with --authfile <path-to-pull-secret>",
+                "errors": ["Pull secret required for quay.io/openshift-release-dev/"],
+            }, sys.stdout, indent=2)
+            print()
+            sys.exit(1)
+
+        errors.append(f"podman rpm extraction failed (exit {rc}): {stderr_rpm.strip()[:300]}")
+        json.dump({
+            "ocp_version": args.ocp_version,
+            "coreos_pullspec": info["coreos_pullspec"],
+            "rpms": [],
+            "errors": errors,
+        }, sys.stdout, indent=2)
+        print()
+        sys.exit(1)
+
+    rpms = []
+    source_counts = {"rhel": 0, "ocp": 0, "fast_datapath": 0}
+
+    for line in stdout_rpm.strip().split("\n"):
+        if not line.strip():
+            continue
+        parts = line.split("\t")
+        if len(parts) < 3:
+            continue
+
+        name = parts[0]
+        evr = parts[1].replace("(none)", "0")
+        arch = parts[2]
+        source = classify_rpm(name, evr)
+        source_counts[source] = source_counts.get(source, 0) + 1
+
+        rpms.append({
+            "name": name,
+            "evr": evr,
+            "arch": arch,
+            "source": source,
+        })
+
+    rpms.sort(key=lambda r: r["name"])
+
+    result = {
+        "ocp_version": args.ocp_version,
+        "created": info["created"],
+        "machine_os": info["machine_os"],
+        "rhel_version": rhel_version,
+        "rhel_major": rhel_major,
+        "coreos_pullspec": info["coreos_pullspec"],
+        "coreos_version_scheme": coreos_info["coreos_version_scheme"],
+        "coreos_build_id": coreos_info["coreos_build_id"],
+        "cpes": {
+            "rhel": f"cpe:/o:redhat:enterprise_linux:{rhel_major}" if rhel_major else "",
+            "ocp": f"cpe:/a:redhat:openshift:{ocp_minor}",
+        },
+        "component_versions": info["component_versions"],
+        "rpms": rpms,
+        "rpm_count": len(rpms),
+        "rpm_by_source": source_counts,
+        "errors": errors,
+    }
+
+    output = json.dumps(result, indent=2)
+
+    if args.cache_dir and not result["errors"]:
+        import os
+        os.makedirs(args.cache_dir, exist_ok=True)
+        cache_file = os.path.join(args.cache_dir, f"coreos-{args.ocp_version}.json")
+        with open(cache_file, "w") as f:
+            f.write(output)
+            f.write("\n")
+
+    sys.stdout.write(output)
+    print()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/ocp-admin/scripts/security-validation/fetch_cve_metadata.py b/ocp-admin/scripts/security-validation/fetch_cve_metadata.py
new file mode 100644
index 00000000..eeae2a6f
--- /dev/null
+++ b/ocp-admin/scripts/security-validation/fetch_cve_metadata.py
@@ -0,0 +1,241 @@
+#!/usr/bin/env python3
+"""Fetch CVE metadata from MITRE, OSV.dev, and Go vulnerability database."""
+
+import argparse
+import json
+import re
+import sys
+
+import requests
+
+MITRE_API = "https://cveawg.mitre.org/api/cve/{cve_id}"
+OSV_API = "https://api.osv.dev/v1/vulns/{cve_id}"
+GO_VULN_DB = "https://vuln.go.dev/ID/{go_id}.json"
+TIMEOUT = 15
+
+
+def fetch_mitre(cve_id):
+    affected = []
+    description = ""
+    errors = []
+    try:
+        resp = requests.get(MITRE_API.format(cve_id=cve_id), timeout=TIMEOUT)
+        if resp.status_code == 404:
+            errors.append(f"MITRE: CVE {cve_id} not found (404)")
+            return affected, description, errors
+        if resp.status_code != 200:
+            errors.append(f"MITRE: HTTP {resp.status_code}")
+            return affected, description, errors
+
+        data = resp.json()
+        cna = data.get("containers", {}).get("cna", {})
+
+        descs = cna.get("descriptions", [])
+        for d in descs:
+            if d.get("lang", "").startswith("en"):
+                description = d.get("value", "")
+                break
+        if not description and descs:
+            description = descs[0].get("value", "")
+
+        for entry in cna.get("affected", []):
+            product = entry.get("product", "")
+            vendor = entry.get("vendor", "")
+            ecosystem = _guess_ecosystem(entry)
+
+            for ver_block in entry.get("versions", []):
+                version_info = {}
+                status = ver_block.get("status", "")
+                if status == "affected":
+                    version_info["introduced"] = ver_block.get("version", "")
+                    less_than = ver_block.get("lessThan", "")
+                    less_equal = ver_block.get("lessThanOrEqual", "")
+                    if less_than:
+                        version_info["fixed"] = less_than
+                    elif less_equal:
+                        version_info["last_affected"] = less_equal
+
+                affected.append({
+                    "ecosystem": ecosystem,
+                    "package": product,
+                    "vendor": vendor,
+                    "versions": version_info,
+                    "source": "mitre",
+                })
+
+            if not entry.get("versions"):
+                affected.append({
+                    "ecosystem": ecosystem,
+                    "package": product,
+                    "vendor": vendor,
+                    "versions": {},
+                    "source": "mitre",
+                })
+
+    except requests.RequestException as e:
+        errors.append(f"MITRE: request failed: {e}")
+    except (KeyError, ValueError) as e:
+        errors.append(f"MITRE: parse error: {e}")
+
+    return affected, description, errors
+
+
+def fetch_osv(cve_id):
+    affected = []
+    aliases = []
+    errors = []
+    go_ids = []
+    try:
+        resp = requests.get(OSV_API.format(cve_id=cve_id), timeout=TIMEOUT)
+        if resp.status_code == 404:
+            errors.append(f"OSV: CVE {cve_id} not found (404)")
+            return affected, aliases, go_ids, errors
+        if resp.status_code != 200:
+            errors.append(f"OSV: HTTP {resp.status_code}")
+            return affected, aliases, go_ids, errors
+
+        data = resp.json()
+        aliases = data.get("aliases", [])
+        go_ids = [a for a in aliases if a.startswith("GO-")]
+
+        for entry in data.get("affected", []):
+            pkg = entry.get("package", {})
+            ecosystem = pkg.get("ecosystem", "")
+            name = pkg.get("name", "")
+
+            for rng in entry.get("ranges", []):
+                version_info = {}
+                for evt in rng.get("events", []):
+                    if "introduced" in evt:
+                        version_info["introduced"] = evt["introduced"]
+                    if "fixed" in evt:
+                        version_info["fixed"] = evt["fixed"]
+
+                affected.append({
+                    "ecosystem": ecosystem,
+                    "package": name,
+                    "versions": version_info,
+                    "source": "osv",
+                })
+
+            if not entry.get("ranges"):
+                affected.append({
+                    "ecosystem": ecosystem,
+                    "package": name,
+                    "versions": {},
+                    "source": "osv",
+                })
+
+    except requests.RequestException as e:
+        errors.append(f"OSV: request failed: {e}")
+    except (KeyError, ValueError) as e:
+        errors.append(f"OSV: parse error: {e}")
+
+    return affected, aliases, go_ids, errors
+
+
+def fetch_go_vuln(go_id):
+    affected = []
+    errors = []
+    try:
+        resp = requests.get(GO_VULN_DB.format(go_id=go_id), timeout=TIMEOUT)
+        if resp.status_code != 200:
+            errors.append(f"Go vuln DB: HTTP {resp.status_code} for {go_id}")
+            return affected, errors
+
+        data = resp.json()
+        for module in data.get("modules", []):
+            mod_path = module.get("module", "")
+            for ver in module.get("versions", []):
+                version_info = {}
+                if "introduced" in ver:
+                    version_info["introduced"] = ver["introduced"]
+                if "fixed" in ver:
+                    version_info["fixed"] = ver["fixed"]
+
+                affected.append({
+                    "ecosystem": "Go",
+                    "package": mod_path,
+                    "versions": version_info,
+                    "source": "go_vuln_db",
+                    "go_id": go_id,
+                })
+
+            packages = module.get("packages", [])
+            if packages and not module.get("versions"):
+                for pkg in packages:
+                    affected.append({
+                        "ecosystem": "Go",
+                        "package": pkg.get("package", mod_path),
+                        "versions": {},
+                        "source": "go_vuln_db",
+                        "go_id": go_id,
+                    })
+
+    except requests.RequestException as e:
+        errors.append(f"Go vuln DB: request failed: {e}")
+    except (KeyError, ValueError) as e:
+        errors.append(f"Go vuln DB: parse error: {e}")
+
+    return affected, errors
+
+
+def _guess_ecosystem(mitre_entry):
+    product = mitre_entry.get("product", "").lower()
+    cpes = mitre_entry.get("cpes", [])
+    platforms = mitre_entry.get("platforms", [])
+
+    cpe_str = " ".join(cpes).lower() if cpes else ""
+    plat_str = " ".join(platforms).lower() if platforms else ""
+
+    if "golang" in product or "go" in plat_str or "/go/" in cpe_str:
+        return "Go"
+    if "python" in product or "pypi" in product or "python" in plat_str:
+        return "PyPI"
+    if "npm" in product or "node" in plat_str:
+        return "npm"
+    if "rpm" in cpe_str or "redhat" in cpe_str or "rhel" in cpe_str:
+        return "rpm"
+    return ""
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Fetch CVE metadata from multiple sources")
+    parser.add_argument("cve_id", help="CVE identifier (e.g., CVE-2024-45490)")
+    args = parser.parse_args()
+
+    cve_id = args.cve_id.upper()
+    if not re.match(r"^CVE-\d{4}-\d+$", cve_id):
+        json.dump({"cve_id": args.cve_id, "error": "Invalid CVE ID format"}, sys.stdout, indent=2)
+        sys.exit(1)
+
+    all_affected = []
+    all_errors = []
+
+    mitre_affected, description, mitre_errors = fetch_mitre(cve_id)
+    all_affected.extend(mitre_affected)
+    all_errors.extend(mitre_errors)
+
+    osv_affected, aliases, go_ids, osv_errors = fetch_osv(cve_id)
+    all_affected.extend(osv_affected)
+    all_errors.extend(osv_errors)
+
+    for go_id in go_ids:
+        go_affected, go_errors = fetch_go_vuln(go_id)
+        all_affected.extend(go_affected)
+        all_errors.extend(go_errors)
+
+    result = {
+        "cve_id": cve_id,
+        "description": description,
+        "affected": all_affected,
+        "aliases": aliases,
+        "errors": all_errors,
+    }
+
+    json.dump(result, sys.stdout, indent=2)
+    print()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/ocp-admin/scripts/security-validation/fetch_redhat_vex.py b/ocp-admin/scripts/security-validation/fetch_redhat_vex.py
new file mode 100644
index 00000000..22e00448
--- /dev/null
+++ b/ocp-admin/scripts/security-validation/fetch_redhat_vex.py
@@ -0,0 +1,214 @@
+#!/usr/bin/env python3
+"""Fetch Red Hat CSAF VEX data for a given CVE.
+
+Default mode: returns a structured summary of the VEX data — all products with
+their CPEs, component names, statuses, remediations, justifications, and severity.
+No interpretation or filtering — just the full VEX content in a readable format.
+
+With --raw: returns the complete raw CSAF VEX JSON document.
+"""
+
+import argparse
+import json
+import re
+import sys
+
+import requests
+
+VEX_API = "https://security.access.redhat.com/data/csaf/v2/vex/{year}/{cve_id_lower}.json"
+TIMEOUT = 15
+
+
+def fetch_vex(cve_id):
+    year = cve_id.split("-")[1]
+    url = VEX_API.format(year=year, cve_id_lower=cve_id.lower())
+    try:
+        resp = requests.get(url, timeout=TIMEOUT)
+        if resp.status_code == 404:
+            return None, 404, []
+        if resp.status_code != 200:
+            return None, resp.status_code, [f"HTTP {resp.status_code}"]
+        return resp.json(), 200, []
+    except requests.RequestException as e:
+        return None, 0, [f"Request failed: {e}"]
+    except ValueError as e:
+        return None, 0, [f"JSON parse error: {e}"]
+
+
+def build_product_map(vex_data):
+    """Build map: product_id -> {full_name, cpe, component_name} from branches."""
+    product_map = {}
+    tree = vex_data.get("product_tree", {})
+
+    for branch in tree.get("branches", []):
+        _walk_branches(branch, product_map)
+
+    for rel in tree.get("relationships", []):
+        fpn = rel.get("full_product_name", {})
+        pid = fpn.get("product_id", "")
+        name = fpn.get("name", "")
+        parent_pid = rel.get("relates_to_product_reference", "")
+        component_pid = rel.get("product_reference", "")
+
+        parent_info = product_map.get(parent_pid, {})
+        parent_cpe = parent_info.get("cpe", "")
+
+        comp_info = product_map.get(component_pid, {})
+        comp_name = comp_info.get("name", component_pid)
+
+        product_map[pid] = {
+            "full_name": name,
+            "cpe": parent_cpe,
+            "component": comp_name,
+            "parent_product": parent_pid,
+        }
+
+    return product_map
+
+
+def _walk_branches(branch, product_map):
+    fpn = branch.get("product", {})
+    if fpn:
+        pid = fpn.get("product_id", "")
+        name = fpn.get("name", "")
+        cpe = ""
+        helper = fpn.get("product_identification_helper", {})
+        if isinstance(helper, dict):
+            cpe = helper.get("cpe", "")
+        product_map[pid] = {"name": name, "cpe": cpe, "full_name": name}
+
+    for sub in branch.get("branches", []):
+        _walk_branches(sub, product_map)
+
+
+def extract_summary(vex_data, product_map):
+    """Extract a structured summary of all VEX entries — no filtering."""
+    products = []
+
+    for vuln in vex_data.get("vulnerabilities", []):
+        cve = vuln.get("cve", "")
+
+        # Severity
+        severity = ""
+        for threat in vuln.get("threats", []):
+            if threat.get("category") == "impact":
+                severity = threat.get("details", "")
+                break
+
+        # Remediations: product_id -> {category, details, url}
+        remediation_map = {}
+        for rem in vuln.get("remediations", []):
+            for pid in rem.get("product_ids", []):
+                remediation_map.setdefault(pid, []).append({
+                    "category": rem.get("category", ""),
+                    "details": rem.get("details", ""),
+                    "url": rem.get("url", ""),
+                })
+
+        # Flags: product_id -> justification label
+        flag_map = {}
+        for flag in vuln.get("flags", []):
+            for pid in flag.get("product_ids", []):
+                flag_map[pid] = flag.get("label", "")
+
+        # Walk product_status groups
+        for status_key, pids in vuln.get("product_status", {}).items():
+            for pid in pids:
+                info = product_map.get(pid, {})
+                entry = {
+                    "product_id": pid,
+                    "full_name": info.get("full_name", ""),
+                    "cpe": info.get("cpe", ""),
+                    "component": info.get("component", ""),
+                    "status": status_key,
+                }
+
+                if pid in flag_map:
+                    entry["justification"] = flag_map[pid]
+
+                if pid in remediation_map:
+                    entry["remediations"] = remediation_map[pid]
+
+                products.append(entry)
+
+        # Deduplicate: collapse arch variants and sub-packages into one entry per base package + CPE + status
+        deduped = {}
+        for p in products:
+            comp = p.get("component", "")
+            # Strip version-release and arch from component: "podman-6:5.6.0-14.el9_7.x86_64" -> "podman"
+            base_comp = re.split(r'-\d+:', comp)[0] if re.search(r'-\d+:', comp) else comp
+            base_comp = re.sub(r'\.(x86_64|aarch64|ppc64le|s390x|noarch|src|i686)$', '', base_comp)
+            # Strip sub-package suffixes: podman-debuginfo -> podman, podman-tests -> podman
+            base_comp = re.sub(r'-(debuginfo|debugsource|tests-debuginfo|tests|remote-debuginfo|remote|plugins-debuginfo|plugins|docker|catatonit|gvproxy|manpages|src)$', '', base_comp)
+            key = (base_comp, p["cpe"], p["status"])
+            if key not in deduped:
+                deduped[key] = p.copy()
+                deduped[key]["base_package"] = base_comp
+                deduped[key]["sub_packages"] = 1
+            else:
+                deduped[key]["sub_packages"] += 1
+
+        return {"cve": cve, "severity": severity, "products": list(deduped.values())}
+
+    return {"cve": "", "severity": "", "products": []}
+
+
+def detect_blanket_vex(products):
+    under_inv = [p for p in products if p["status"] == "under_investigation"]
+    return len(under_inv) > 20
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Fetch Red Hat VEX data")
+    parser.add_argument("cve_id", help="CVE identifier (e.g., CVE-2024-45490)")
+    parser.add_argument("--raw", action="store_true", help="Return full raw CSAF VEX JSON")
+    args = parser.parse_args()
+
+    cve_id = args.cve_id.upper()
+    if not re.match(r"^CVE-\d{4}-\d+$", cve_id):
+        json.dump({"cve_id": args.cve_id, "error": "Invalid CVE ID format"}, sys.stdout, indent=2)
+        sys.exit(1)
+
+    vex_data, http_status, errors = fetch_vex(cve_id)
+
+    if vex_data is None:
+        json.dump({
+            "cve_id": cve_id,
+            "http_status": http_status,
+            "vex": None,
+            "products": [],
+            "errors": errors if errors else [f"No VEX file (HTTP {http_status})"],
+        }, sys.stdout, indent=2)
+        print()
+        sys.exit(0 if http_status == 404 else 1)
+
+    if args.raw:
+        json.dump({
+            "cve_id": cve_id,
+            "http_status": 200,
+            "vex": vex_data,
+            "errors": [],
+        }, sys.stdout, indent=2)
+        print()
+        return
+
+    product_map = build_product_map(vex_data)
+    summary = extract_summary(vex_data, product_map)
+    is_blanket = detect_blanket_vex(summary.get("products", []))
+
+    result = {
+        "cve_id": cve_id,
+        "http_status": 200,
+        "severity": summary["severity"],
+        "is_blanket_vex": is_blanket,
+        "total_products": len(summary["products"]),
+        "products": summary["products"],
+        "errors": [],
+    }
+
+    json.dump(result, sys.stdout, indent=2)
+    print()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/ocp-admin/scripts/security-validation/fetch_rhsa_advisory.py b/ocp-admin/scripts/security-validation/fetch_rhsa_advisory.py
new file mode 100644
index 00000000..8be5f89b
--- /dev/null
+++ b/ocp-admin/scripts/security-validation/fetch_rhsa_advisory.py
@@ -0,0 +1,160 @@
+#!/usr/bin/env python3
+"""Fetch Red Hat Security Advisory (RHSA) CSAF data and extract CVE references."""
+
+import argparse
+import json
+import re
+import sys
+
+import requests
+
+ADVISORY_API = "https://security.access.redhat.com/data/csaf/v2/advisories/{year}/{advisory_id_normalized}.json"
+TIMEOUT = 15
+
+RHSA_RE = re.compile(r"^RHSA-(\d{4})[:\-](\d+)$", re.IGNORECASE)
+
+
+def normalize_advisory_id(raw_id):
+    """Normalize RHSA-YYYY:NNNNN or RHSA-YYYY-NNNNN to the URL format (underscore)."""
+    match = RHSA_RE.match(raw_id)
+    if not match:
+        return None, None, f"Invalid advisory ID format: '{raw_id}'. Expected: RHSA-YYYY:NNNNN"
+    year = match.group(1)
+    seq = match.group(2)
+    normalized = f"rhsa-{year}_{seq}"
+    return normalized, year, None
+
+
+def fetch_advisory(advisory_id):
+    normalized, year, err = normalize_advisory_id(advisory_id)
+    if err:
+        return None, 0, [err]
+
+    url = ADVISORY_API.format(year=year, advisory_id_normalized=normalized)
+    try:
+        resp = requests.get(url, timeout=TIMEOUT)
+        if resp.status_code == 404:
+            return None, 404, [f"Advisory not found: {advisory_id}"]
+        if resp.status_code != 200:
+            return None, resp.status_code, [f"HTTP {resp.status_code} fetching advisory"]
+        return resp.json(), 200, []
+    except requests.RequestException as e:
+        return None, 0, [f"Request failed: {e}"]
+    except ValueError as e:
+        return None, 0, [f"JSON parse error: {e}"]
+
+
+def extract_cves(advisory_data):
+    cves = []
+    for vuln in advisory_data.get("vulnerabilities", []):
+        cve_id = vuln.get("cve", "")
+        if not cve_id:
+            continue
+
+        title = vuln.get("title", "")
+
+        severity = ""
+        base_score = ""
+        for score_entry in vuln.get("scores", []):
+            cvss = score_entry.get("cvss_v3", {})
+            if cvss:
+                severity = cvss.get("baseSeverity", "")
+                base_score = str(cvss.get("baseScore", ""))
+                break
+
+        cves.append({
+            "cve_id": cve_id,
+            "title": title,
+            "severity": severity,
+            "cvss_score": base_score,
+        })
+
+    return cves
+
+
+def extract_advisory_metadata(advisory_data):
+    doc = advisory_data.get("document", {})
+    tracking = doc.get("tracking", {})
+    agg_sev = doc.get("aggregate_severity", {})
+
+    return {
+        "advisory_id": tracking.get("id", ""),
+        "title": doc.get("title", ""),
+        "initial_release_date": tracking.get("initial_release_date", ""),
+        "current_release_date": tracking.get("current_release_date", ""),
+        "aggregate_severity": agg_sev.get("text", ""),
+    }
+
+
+def extract_fixed_packages(advisory_data):
+    packages = []
+    tree = advisory_data.get("product_tree", {})
+
+    product_map = {}
+    for rel in tree.get("relationships", []):
+        fpn = rel.get("full_product_name", {})
+        pid = fpn.get("product_id", "")
+        name = fpn.get("name", "")
+        parent = rel.get("relates_to_product_reference", "")
+        product_map[pid] = {"name": name, "parent": parent}
+
+    for vuln in advisory_data.get("vulnerabilities", []):
+        status_groups = vuln.get("product_status", {})
+        fixed_pids = status_groups.get("fixed", [])
+        cve_id = vuln.get("cve", "")
+
+        for pid in fixed_pids:
+            info = product_map.get(pid, {})
+            if info:
+                packages.append({
+                    "product_id": pid,
+                    "name": info.get("name", ""),
+                    "cve_id": cve_id,
+                })
+
+    return packages
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Fetch Red Hat Security Advisory and extract CVEs")
+    parser.add_argument("advisory_id", help="Advisory ID (e.g., RHSA-2026:3337)")
+    parser.add_argument("--include-packages", action="store_true",
+                        help="Include list of fixed packages from product_tree")
+    args = parser.parse_args()
+
+    advisory_data, http_status, errors = fetch_advisory(args.advisory_id)
+
+    if advisory_data is None:
+        result = {
+            "advisory_id": args.advisory_id,
+            "http_status": http_status,
+            "metadata": {},
+            "cves": [],
+            "errors": errors,
+        }
+        json.dump(result, sys.stdout, indent=2)
+        print()
+        sys.exit(0 if http_status == 404 else 1)
+
+    metadata = extract_advisory_metadata(advisory_data)
+    cves = extract_cves(advisory_data)
+
+    result = {
+        "advisory_id": metadata["advisory_id"] or args.advisory_id.upper(),
+        "http_status": http_status,
+        "metadata": metadata,
+        "cves": cves,
+        "cve_ids": [c["cve_id"] for c in cves],
+        "cve_count": len(cves),
+        "errors": errors,
+    }
+
+    if args.include_packages:
+        result["fixed_packages"] = extract_fixed_packages(advisory_data)
+
+    json.dump(result, sys.stdout, indent=2)
+    print()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/ocp-admin/scripts/security-validation/generate_sbom_syft.py b/ocp-admin/scripts/security-validation/generate_sbom_syft.py
new file mode 100644
index 00000000..bfc94c7d
--- /dev/null
+++ b/ocp-admin/scripts/security-validation/generate_sbom_syft.py
@@ -0,0 +1,129 @@
+#!/usr/bin/env python3
+"""Generate an SBOM using syft for images without official SBOMs."""
+
+import argparse
+import json
+import re
+import shutil
+import subprocess
+import sys
+
+
+def run_cmd(cmd, timeout=300):
+    try:
+        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
+        return result.returncode, result.stdout, result.stderr
+    except subprocess.TimeoutExpired:
+        return -1, "", "command timed out (syft can be slow on large images)"
+    except FileNotFoundError:
+        return -1, "", f"command not found: {cmd[0]}"
+
+
+def parse_syft_sbom(sbom):
+    packages = []
+    for pkg in sbom.get("packages", []):
+        spdx_id = pkg.get("SPDXID", "")
+        if spdx_id == "SPDXRef-DOCUMENT":
+            continue
+
+        name = pkg.get("name", "")
+        version = pkg.get("versionInfo", "")
+        purl = ""
+        ecosystem = ""
+
+        for ref in pkg.get("externalRefs", []):
+            if ref.get("referenceType") == "purl":
+                purl = ref.get("referenceLocator", "")
+                ecosystem = _ecosystem_from_purl(purl)
+                break
+
+        packages.append({
+            "name": name,
+            "version": version,
+            "purl": purl,
+            "ecosystem": ecosystem,
+            "spdx_id": spdx_id,
+        })
+
+    return packages
+
+
+def _ecosystem_from_purl(purl):
+    if not purl:
+        return ""
+    match = re.match(r"pkg:([^/]+)/", purl)
+    return match.group(1) if match else ""
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Generate SBOM using syft")
+    parser.add_argument("image_ref", help="Container image reference")
+    parser.add_argument("--platform", default="linux/amd64", help="Platform (default: linux/amd64)")
+    args = parser.parse_args()
+
+    if not shutil.which("syft"):
+        json.dump({
+            "image_ref": args.image_ref,
+            "sbom_source": "syft_analyzed",
+            "error": "syft not found in PATH. Install from https://github.com/anchore/syft",
+            "packages": [],
+            "errors": ["syft not installed"],
+        }, sys.stdout, indent=2)
+        print()
+        sys.exit(1)
+
+    cmd = ["syft", args.image_ref, "-o", "spdx-json", "--platform", args.platform]
+    rc, stdout, stderr = run_cmd(cmd)
+
+    if rc != 0:
+        json.dump({
+            "image_ref": args.image_ref,
+            "sbom_source": "syft_analyzed",
+            "packages": [],
+            "errors": [f"syft failed (exit {rc}): {stderr.strip()}"],
+        }, sys.stdout, indent=2)
+        print()
+        sys.exit(1)
+
+    try:
+        sbom = json.loads(stdout)
+    except json.JSONDecodeError as e:
+        json.dump({
+            "image_ref": args.image_ref,
+            "sbom_source": "syft_analyzed",
+            "packages": [],
+            "errors": [f"syft output is not valid JSON: {e}"],
+        }, sys.stdout, indent=2)
+        print()
+        sys.exit(1)
+
+    packages = parse_syft_sbom(sbom)
+
+    relationships = []
+    for rel in sbom.get("relationships", []):
+        relationships.append({
+            "element": rel.get("spdxElementId", ""),
+            "type": rel.get("relationshipType", ""),
+            "related": rel.get("relatedSpdxElement", ""),
+        })
+
+    result = {
+        "image_ref": args.image_ref,
+        "sbom_source": "syft_analyzed",
+        "sbom_format": "spdx",
+        "packages": packages,
+        "image_metadata": {
+            "tag": "",
+            "digest": "",
+            "name_from_purl": "",
+        },
+        "relationships": relationships,
+        "errors": [],
+    }
+
+    json.dump(result, sys.stdout, indent=2)
+    print()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/ocp-admin/scripts/security-validation/inspect_image.py b/ocp-admin/scripts/security-validation/inspect_image.py
new file mode 100644
index 00000000..96622acf
--- /dev/null
+++ b/ocp-admin/scripts/security-validation/inspect_image.py
@@ -0,0 +1,111 @@
+#!/usr/bin/env python3
+"""Extract image metadata (labels, creation date, architecture) via regctl."""
+
+import argparse
+import json
+import shutil
+import subprocess
+import sys
+
+
+def run_cmd(cmd, timeout=30):
+    try:
+        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
+        return result.returncode, result.stdout, result.stderr
+    except subprocess.TimeoutExpired:
+        return -1, "", "command timed out"
+    except FileNotFoundError:
+        return -1, "", f"command not found: {cmd[0]}"
+
+
+def get_image_config(image_ref):
+    rc, stdout, stderr = run_cmd(["regctl", "image", "config", image_ref])
+    if rc != 0:
+        return None, f"regctl image config failed: {stderr.strip()}"
+    try:
+        return json.loads(stdout), None
+    except json.JSONDecodeError as e:
+        return None, f"regctl output is not valid JSON: {e}"
+
+
+def get_image_digest(image_ref):
+    rc, stdout, stderr = run_cmd(["regctl", "manifest", "digest", image_ref])
+    if rc != 0:
+        return "", f"regctl manifest digest failed: {stderr.strip()}"
+    return stdout.strip(), None
+
+
+LABEL_KEYS = [
+    "cpe",
+    "name",
+    "com.redhat.component",
+    "vendor",
+    "maintainer",
+    "org.opencontainers.image.created",
+    "org.opencontainers.image.title",
+    "org.opencontainers.image.description",
+    "org.opencontainers.image.vendor",
+    "io.k8s.display-name",
+    "url",
+    "version",
+    "release",
+]
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Extract image metadata via regctl")
+    parser.add_argument("image_ref", help="Container image reference")
+    args = parser.parse_args()
+
+    if not shutil.which("regctl"):
+        json.dump({
+            "image_ref": args.image_ref,
+            "error": "regctl not found in PATH",
+            "errors": ["regctl not installed"],
+        }, sys.stdout, indent=2)
+        print()
+        sys.exit(1)
+
+    errors = []
+
+    config, err = get_image_config(args.image_ref)
+    if err:
+        errors.append(err)
+
+    digest, err = get_image_digest(args.image_ref)
+    if err:
+        errors.append(err)
+
+    if not config:
+        json.dump({
+            "image_ref": args.image_ref,
+            "digest": digest,
+            "labels": {},
+            "architecture": "",
+            "errors": errors,
+        }, sys.stdout, indent=2)
+        print()
+        sys.exit(1)
+
+    all_labels = config.get("config", {}).get("Labels", {}) or {}
+    labels = {}
+    for key in LABEL_KEYS:
+        if key in all_labels:
+            labels[key] = all_labels[key]
+
+    architecture = config.get("architecture", "")
+
+    result = {
+        "image_ref": args.image_ref,
+        "digest": digest,
+        "labels": labels,
+        "architecture": architecture,
+        "errors": errors,
+    }
+
+    json.dump(result, sys.stdout, indent=2)
+    print()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/ocp-admin/scripts/security-validation/scan_newer_images.py b/ocp-admin/scripts/security-validation/scan_newer_images.py
new file mode 100644
index 00000000..445ea267
--- /dev/null
+++ b/ocp-admin/scripts/security-validation/scan_newer_images.py
@@ -0,0 +1,144 @@
+#!/usr/bin/env python3
+"""Scan a container image repository for images built after a given date.
+
+Lists image tags with their build dates, digests, and CPEs. Used to find
+newer images that may contain a patched RPM.
+"""
+
+import argparse
+import json
+import shutil
+import subprocess
+import sys
+
+
+def run_cmd(cmd, timeout=30):
+    try:
+        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
+        return result.returncode, result.stdout, result.stderr
+    except subprocess.TimeoutExpired:
+        return -1, "", "command timed out"
+    except FileNotFoundError:
+        return -1, "", f"command not found: {cmd[0]}"
+
+
+def list_tags(repo):
+    rc, stdout, stderr = run_cmd(["regctl", "tag", "ls", repo], timeout=60)
+    if rc != 0:
+        return [], f"regctl tag ls failed: {stderr.strip()}"
+    tags = []
+    for line in stdout.strip().split("\n"):
+        tag = line.strip()
+        if not tag:
+            continue
+        if tag.startswith("sha") or tag == "source" or tag == "latest":
+            continue
+        tags.append(tag)
+    return tags, None
+
+
+def inspect_tag(repo, tag):
+    ref = f"{repo}:{tag}"
+
+    rc, stdout, stderr = run_cmd(
+        ["regctl", "image", "config", ref, "--format",
+         "{{.Created}}|{{index .Config.Labels \"cpe\"}}|{{.Digest}}"],
+        timeout=15
+    )
+    if rc != 0:
+        return None
+
+    parts = stdout.strip().split("|")
+    if len(parts) < 3:
+        return None
+
+    return {
+        "tag": tag,
+        "created": parts[0],
+        "cpe": parts[1] if len(parts) > 1 else "",
+        "digest": parts[2] if len(parts) > 2 else "",
+    }
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Scan repository for newer images")
+    parser.add_argument("repo", help="Image repository (e.g., registry.redhat.io/ubi9/ubi)")
+    parser.add_argument("--since", required=True, help="ISO 8601 date — only show images built after this")
+    parser.add_argument("--max-results", type=int, default=10, help="Max results (default 10)")
+    parser.add_argument("--parallel", type=int, default=15, help="Parallel checks (default 15)")
+    args = parser.parse_args()
+
+    if not shutil.which("regctl"):
+        json.dump({
+            "repo": args.repo,
+            "error": "regctl not found in PATH",
+            "newer_images": [],
+            "errors": ["regctl not installed"],
+        }, sys.stdout, indent=2)
+        print()
+        sys.exit(1)
+
+    tags, err = list_tags(args.repo)
+    if err:
+        json.dump({
+            "repo": args.repo,
+            "since": args.since,
+            "newer_images": [],
+            "errors": [err],
+        }, sys.stdout, indent=2)
+        print()
+        sys.exit(1)
+
+    if not tags:
+        json.dump({
+            "repo": args.repo,
+            "since": args.since,
+            "newer_images": [],
+            "total_tags": 0,
+            "errors": [],
+        }, sys.stdout, indent=2)
+        print()
+        sys.exit(0)
+
+    # Check tags in batches using subprocess parallelism
+    import concurrent.futures
+
+    newer = []
+    errors = []
+
+    def check_tag(tag):
+        return inspect_tag(args.repo, tag)
+
+    with concurrent.futures.ThreadPoolExecutor(max_workers=args.parallel) as executor:
+        futures = {executor.submit(check_tag, tag): tag for tag in tags}
+        for future in concurrent.futures.as_completed(futures):
+            result = future.result()
+            if result and result["created"] > args.since:
+                newer.append(result)
+
+    # Sort by created date descending, deduplicate by digest
+    newer.sort(key=lambda x: x["created"], reverse=True)
+    seen_digests = set()
+    deduped = []
+    for img in newer:
+        if img["digest"] not in seen_digests:
+            seen_digests.add(img["digest"])
+            deduped.append(img)
+        if len(deduped) >= args.max_results:
+            break
+
+    result = {
+        "repo": args.repo,
+        "since": args.since,
+        "total_tags_checked": len(tags),
+        "newer_images": deduped,
+        "count": len(deduped),
+        "errors": errors,
+    }
+
+    json.dump(result, sys.stdout, indent=2)
+    print()
+
+
+if __name__ == "__main__":
+    main()
diff --git a/ocp-admin/scripts/security-validation/validate_input.py b/ocp-admin/scripts/security-validation/validate_input.py
new file mode 100644
index 00000000..e7e33307
--- /dev/null
+++ b/ocp-admin/scripts/security-validation/validate_input.py
@@ -0,0 +1,272 @@
+#!/usr/bin/env python3
+"""Validate CVE ID, image reference, and batch input file."""
+
+import argparse
+import json
+import os
+import re
+import sys
+
+CVE_RE = re.compile(r"^CVE-\d{4}-\d+$", re.IGNORECASE)
+RHSA_RE = re.compile(r"^RHSA-\d{4}[:\-]\d+$", re.IGNORECASE)
+
+IMAGE_REF_SAFE_CHARS = re.compile(r"^[a-zA-Z0-9._/:\-@]+$")
+IMAGE_REF_STRUCTURE = re.compile(
+    r"^[a-zA-Z0-9][a-zA-Z0-9._\-]*(?::\d+)?"
+    r"(?:/[a-zA-Z0-9._\-]+)+"
+    r"(?::[a-zA-Z0-9._\-]+|@sha256:[a-f0-9]{64})?$"
+)
+
+MAX_IMAGE_REF_LEN = 512
+MAX_FILE_ROWS = 500
+MAX_FILE_BYTES = 1 * 1024 * 1024
+
+OCP_VERSION_RE = re.compile(r"^4\.\d+\.\d+$")
+
+KNOWN_REDHAT_REGISTRIES = [
+    "registry.redhat.io",
+    "registry.access.redhat.com",
+]
+
+KNOWN_REDHAT_PREFIXES = [
+    "quay.io/openshift-release-dev/",
+    "quay.io/redhat-user-workloads/",
+]
+
+
+def validate_cve_id(cve_id):
+    if not cve_id:
+        return "CVE ID is empty"
+    if not CVE_RE.match(cve_id):
+        return f"Invalid CVE ID format: '{cve_id}'. Expected: CVE-YYYY-NNNNN"
+    return None
+
+
+def validate_advisory_id(advisory_id):
+    if not advisory_id:
+        return "Advisory ID is empty"
+    if not RHSA_RE.match(advisory_id):
+        return f"Invalid advisory ID format: '{advisory_id}'. Expected: RHSA-YYYY:NNNNN"
+    return None
+
+
+def is_rhsa_id(value):
+    return bool(RHSA_RE.match(value)) if value else False
+
+
+def validate_image_ref(ref):
+    if not ref:
+        return "image reference is empty"
+    if len(ref) > MAX_IMAGE_REF_LEN:
+        return f"image reference exceeds maximum length of {MAX_IMAGE_REF_LEN} characters"
+    if not IMAGE_REF_SAFE_CHARS.match(ref):
+        bad = sorted({c for c in ref if not re.match(r"[a-zA-Z0-9._/:\-@]", c)})
+        return f"image reference contains disallowed characters: {bad}"
+    if "/" not in ref:
+        return "image reference must include a registry hostname (no '/' found)"
+    if not IMAGE_REF_STRUCTURE.match(ref):
+        return "image reference does not match expected format: registry/namespace/image[:tag|@sha256:digest]"
+    return None
+
+
+def classify_registry(image_ref):
+    registry = image_ref.split("/")[0]
+
+    if registry in KNOWN_REDHAT_REGISTRIES:
+        return {"registry": registry, "is_redhat": True, "type": "official"}
+
+    for prefix in KNOWN_REDHAT_PREFIXES:
+        if image_ref.startswith(prefix):
+            return {"registry": registry, "is_redhat": True, "type": "mirror", "prefix": prefix}
+
+    return {"registry": registry, "is_redhat": False, "type": "unknown"}
+
+
+def classify_ref_format(image_ref):
+    if "@sha256:" in image_ref:
+        return "digest"
+    if ":" in image_ref.split("/")[-1]:
+        return "tag"
+    return "untagged"
+
+
+def validate_batch_file(path):
+    errors = []
+    entries = []
+
+    if not os.path.isfile(path):
+        return entries, [f"Input file not found: {path}"]
+
+    file_size = os.path.getsize(path)
+    if file_size > MAX_FILE_BYTES:
+        return entries, [f"Input file too large ({file_size} bytes, max {MAX_FILE_BYTES})"]
+
+    try:
+        with open(path, "r") as f:
+            lines = f.readlines()
+    except OSError as e:
+        return entries, [f"Cannot read input file: {e}"]
+
+    data_row_count = 0
+    header_skipped = False
+
+    for line_num, raw_line in enumerate(lines, start=1):
+        line = raw_line.strip()
+
+        if not line:
+            continue
+        if line.startswith("#"):
+            continue
+
+        if not header_skipped and "cve_id" in line.lower().split(",")[0]:
+            header_skipped = True
+            continue
+
+        parts = line.split(",")
+        if len(parts) != 2:
+            errors.append(f"Line {line_num}: expected 2 comma-separated values, got {len(parts)}")
+            continue
+
+        cve_id = parts[0].strip()
+        image_ref = parts[1].strip()
+
+        cve_err = validate_cve_id(cve_id)
+        if cve_err:
+            errors.append(f"Line {line_num}: {cve_err}")
+
+        img_err = validate_image_ref(image_ref)
+        if img_err:
+            errors.append(f"Line {line_num}: {img_err}")
+
+        data_row_count += 1
+        if data_row_count > MAX_FILE_ROWS:
+            errors.append(f"Line {line_num}: exceeds maximum of {MAX_FILE_ROWS} data rows")
+            break
+
+        if not cve_err and not img_err:
+            registry_info = classify_registry(image_ref)
+            entries.append({
+                "cve_id": cve_id.upper(),
+                "image_ref": image_ref,
+                "ref_format": classify_ref_format(image_ref),
+                "registry": registry_info,
+            })
+
+    return entries, errors
+
+
+def validate_ocp_version(version):
+    if not version:
+        return "OCP version is empty"
+    if not OCP_VERSION_RE.match(version):
+        return f"Invalid OCP version format: '{version}'. Expected: 4.X.Y (e.g., 4.20.17)"
+    return None
+
+
+def main():
+    parser = argparse.ArgumentParser(description="Validate CVE and image input")
+    parser.add_argument("--cve", default="", help="CVE identifier or RHSA advisory ID")
+    parser.add_argument("--image", default="", help="Container image reference")
+    parser.add_argument("--file", default="", help="Path to CSV batch input file")
+    parser.add_argument("--coreos", action="store_true", help="CoreOS validation mode")
+    parser.add_argument("--ocp-version", default="", help="OCP version for CoreOS mode (e.g., 4.20.17)")
+    args = parser.parse_args()
+
+    if args.coreos:
+        errors = []
+
+        input_type = "cve"
+        if is_rhsa_id(args.cve):
+            input_type = "rhsa"
+            adv_err = validate_advisory_id(args.cve)
+            if adv_err:
+                errors.append(adv_err)
+        else:
+            cve_err = validate_cve_id(args.cve)
+            if cve_err:
+                errors.append(cve_err)
+
+        ocp_err = validate_ocp_version(args.ocp_version)
+        if ocp_err:
+            errors.append(ocp_err)
+
+        entries = []
+        if not errors:
+            entry = {"ocp_version": args.ocp_version, "input_type": input_type}
+            if input_type == "rhsa":
+                entry["advisory_id"] = args.cve.upper()
+            else:
+                entry["cve_id"] = args.cve.upper()
+            entries.append(entry)
+
+        result = {
+            "valid": len(errors) == 0,
+            "mode": "coreos",
+            "entries": entries,
+            "errors": errors,
+        }
+    elif args.file:
+        entries, errors = validate_batch_file(args.file)
+        result = {
+            "valid": len(errors) == 0 and len(entries) > 0,
+            "mode": "batch",
+            "file": args.file,
+            "entry_count": len(entries),
+            "entries": entries,
+            "errors": errors,
+        }
+    elif args.cve or args.image:
+        errors = []
+
+        input_type = "cve"
+        if is_rhsa_id(args.cve):
+            input_type = "rhsa"
+            adv_err = validate_advisory_id(args.cve)
+            if adv_err:
+                errors.append(adv_err)
+        else:
+            cve_err = validate_cve_id(args.cve)
+            if cve_err:
+                errors.append(cve_err)
+
+        img_err = validate_image_ref(args.image)
+        if img_err:
+            errors.append(img_err)
+
+        registry_info = classify_registry(args.image) if not img_err else {}
+
+        entries = []
+        if not errors:
+            entry = {
+                "image_ref": args.image,
+                "ref_format": classify_ref_format(args.image),
+                "registry": registry_info,
+                "input_type": input_type,
+            }
+            if input_type == "rhsa":
+                entry["advisory_id"] = args.cve.upper()
+            else:
+                entry["cve_id"] = args.cve.upper()
+            entries.append(entry)
+
+        result = {
+            "valid": len(errors) == 0,
+            "mode": "single",
+            "entries": entries,
+            "errors": errors,
+        }
+    else:
+        result = {
+            "valid": False,
+            "mode": "",
+            "entries": [],
+            "errors": ["No input provided. Use --cve and --image, --file for batch, or --coreos with --ocp-version."],
+        }
+
+    json.dump(result, sys.stdout, indent=2)
+    print()
+    sys.exit(0 if result["valid"] else 1)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/ocp-admin/skills/container-cve-validator/SKILL.md b/ocp-admin/skills/container-cve-validator/SKILL.md
new file mode 100644
index 00000000..f0d74a14
--- /dev/null
+++ b/ocp-admin/skills/container-cve-validator/SKILL.md
@@ -0,0 +1,308 @@
+---
+name: container-cve-validator
+description: Validate a CVE against a Red Hat container image using official SBOM attestations, Red Hat VEX data, and CVE metadata from MITRE/OSV.dev.
+license: Apache-2.0
+user_invocable: true
+model: inherit
+color: red
+---
+
+# Red Hat Container Security Validator
+
+## When to Use This Skill
+Use this skill when the user asks you to check, validate, or analyze one or more CVEs against Red Hat container images. Input may be a single CVE ID + image reference, or a CSV file path containing multiple pairs.
+
+## Optional Output Flags
+
+The user may specify these optional flags. Parse them before extracting the required inputs.
+
+- `--format markdown` — (default) Markdown report; verbosity controlled by `--output`
+- `--format json` — machine-readable JSON with 6 structured fields
+- `--format csv` — single-row CSV with a header row (one row per scan in batch mode)
+- `--output full` — (default) complete Markdown report with all sections; only applies to `--format markdown`
+- `--output summary` — condensed Markdown: executive summary + recommended actions only; only applies to `--format markdown`
+- `--file PATH` — path to a CSV input file for batch scanning (mutually exclusive with positional CVE ID and image reference)
+
+Record the resolved values as `OUTPUT_FORMAT` (default: `markdown`), `OUTPUT_MODE` (default: `full`), and `INPUT_FILE` (default: empty). Strip all flag tokens before extracting remaining positional arguments.
+
+## Input Validation
+
+Use the `validate_input.py` script for all input validation — both single scan and batch mode.
+
+**Single scan:**
+```bash
+python $SCRIPTS_DIR/validate_input.py --cve [CVE-ID] --image [IMAGE_REFERENCE]
+```
+
+**Batch mode (when `--file` was provided):**
+```bash
+python $SCRIPTS_DIR/validate_input.py --file [PATH]
+```
+
+The script returns JSON with `valid` (boolean), `mode` ("single" or "batch"), `entries` (array of validated CVE/image pairs with registry classification), and `errors` (array of error messages with line numbers for batch mode).
+
+- If `valid` is `false`: print the errors and stop. Do not proceed to any execution step.
+- If `valid` is `true`: use the `entries` array to drive the pipeline. Each entry contains `image_ref`, `ref_format` ("tag" or "digest"), `registry` info, and `input_type`.
+- If `input_type` is `"rhsa"`: the user provided an RHSA advisory ID. Resolve it to individual CVEs using (**do NOT use WebFetch or curl to access access.redhat.com**):
+  ```bash
+  python $SCRIPTS_DIR/fetch_rhsa_advisory.py [RHSA-ID]
+  ```
+  Run the full validation pipeline for each CVE in the returned `cve_ids[]` list against the same image.
+- If `input_type` is `"cve"`: proceed directly with the single CVE ID.
+- For batch mode, run the full validation pipeline for each entry. Print a progress indicator: `[1/N] Scanning CVE-YYYY-NNNNN — registry.../image:tag`
+
+**Batch output aggregation:**
+- **`--format markdown`:** print each report separated by a `====` divider line
+- **`--format json`:** output a single JSON array `[{...}, {...}]` — one object per scan
+- **`--format csv`:** one header row followed by one data row per scan (no repeated headers)
+
+### Image Inspection
+
+Use the `inspect_image.py` script to fetch image metadata:
+```bash
+python $SCRIPTS_DIR/inspect_image.py [IMAGE_REFERENCE]
+```
+
+The script returns JSON with `labels` (cpe, name, com.redhat.component, vendor, maintainer, org.opencontainers.image.created), `digest`, `architecture`, and `errors`.
+
+If the script fails with an authentication error, log in first:
+```
+regctl registry login registry.redhat.io
+```
+Then re-run. If login fails, stop and inform the user.
+
+From the output, record:
+- `labels.cpe` → `product_cpe` — primary anchor for VEX product_tree matching
+- `labels.name` → public component name for VEX matching
+- `labels["com.redhat.component"]` → internal build name (secondary fallback only)
+- `labels.vendor` and `labels.maintainer` — for registry ownership validation
+- `labels["org.opencontainers.image.created"]` → image build timestamp
+
+**Registry ownership check:** The `validate_input.py` output already classifies the registry (`is_redhat`, `type`). For non-Red Hat registries:
+- If `vendor` or `maintainer` from inspect output is `"Red Hat, Inc."`: the image is a Red Hat image mirrored to an alternate registry. Record the canonical `registry.redhat.io` form for VEX matching.
+- Otherwise: stop and report that this skill only validates Red Hat-maintained images.
+
+**Input format classification:** The `validate_input.py` output provides `ref_format` ("tag" or "digest"). For digest-based references, the human-readable tag will be extracted from the SBOM in Step 2.
+
+Do NOT use `version` or `release` labels to reconstruct the image tag.
+
+## Prerequisites
+
+**Step 0 — Resolve scripts directory.** Before anything else, locate the helper scripts. They are at `../scripts/` relative to this project's root directory. Run:
+```bash
+SCRIPTS_DIR="$(git rev-parse --show-toplevel)/ocp-admin/scripts/security-validation"
+test -f "$SCRIPTS_DIR/validate_input.py" || { echo "Error: Scripts directory not found at $SCRIPTS_DIR"; exit 1; }
+```
+Use `$SCRIPTS_DIR` in all subsequent script calls. The scripts handle tool checks internally (regctl, cosign, syft) and return clear errors if tools are missing.
+
+## Workflow
+
+**MANDATORY EXECUTION CONTRACT — read before starting:**
+
+This skill requires completing ALL of the following steps in order. No step may be skipped, condensed, or replaced with an alternative approach — regardless of which model is executing.
+
+| # | Step | Required | May skip only when |
+|---|---|---|---|
+| 0 | Prerequisites check | Always | Never |
+| 0 | Input validation + image inspection | Always | Never |
+| 1 | CVE Reconnaissance (MITRE → OSV.dev → Go vuln DB) | Always | Never |
+| 2 | SBOM Extraction + package verification | Always | Never |
+| 3 | Red Hat VEX Validation | Always | Package NOT found in SBOM (Step 2) |
+| 4 | Newer Image Availability Scan | Conditional | Trigger conditions not met (see Step 4 header) |
+| 5 | Final Report | Always | Never |
+
+**Strict rules:**
+1. Execute each step using the helper scripts below. After each step, print: `✓ Step N complete — [key finding]`
+2. **FORBIDDEN COMMANDS — never use these, even inside loops or pipelines:**
+   - `grep` — do not grep through JSON data files
+   - `jq` — do not use jq filters on JSON data
+   - `curl` — do not fetch URLs directly, use the helper scripts
+   - `cosign` — do not call cosign directly, use `download_sbom.py`
+   - `for ... do ... done` loops that process tool-result files
+   - Any ad-hoc bash script, Python one-liner, or shell pipeline that parses or filters JSON data
+3. **The ONLY allowed bash commands are:** running the helper scripts (`python $SCRIPTS_DIR/...`), `SCRIPTS_DIR=...` resolution, `test -f`, and `cat` to read a file.
+4. **How to handle large VEX/SBOM data:** Read the raw JSON output directly in your context window. Analyze it in your reasoning, not with shell tools. Do NOT attempt to filter it with grep/jq.
+5. Do not combine, reorder, or parallelise steps. Each step depends on outputs from previous steps.
+6. If a step produces unexpected results, report them and continue — do not stop unless explicitly instructed.
+7. Every field in the final report must come from actual script outputs. Use `N/A — [reason]` for undetermined fields. Never fabricate values.
+8. The `fetch_redhat_vex.py` script takes ONLY a CVE-ID argument — no flags. It returns the full raw VEX document.
+
+---
+
+### Step 1: CVE Reconnaissance
+
+Run the `fetch_cve_metadata.py` script to query all CVE data sources in a single call:
+```bash
+python $SCRIPTS_DIR/fetch_cve_metadata.py [CVE-ID]
+```
+
+The script automatically queries MITRE CVE API, OSV.dev, and (if a GO-* alias is found) the Go vulnerability database. It returns merged JSON with:
+- `description` — CVE description
+- `affected[]` — all affected packages with `ecosystem`, `package`, `versions` (introduced/fixed), and `source` (mitre/osv/go_vuln_db)
+- `aliases[]` — cross-references (GO-*, GHSA-*, etc.)
+- `errors[]` — any API failures (non-fatal; the script continues with available data)
+
+From the output, identify:
+- The target package name and ecosystem for SBOM matching
+- For Go CVEs, the Go vuln DB module path is authoritative for SBOM matching
+- Vulnerable version ranges (use the union across all sources)
+- If `affected` is empty and errors indicate the CVE was not found: stop and report "CVE not found"
+
+Print: `✓ Step 1 complete — [package name], ecosystem: [ecosystem], sources: [list from affected[].source]`
+
+---
+
+### Step 2: SBOM Extraction
+
+Run the `download_sbom.py` script to handle all SBOM extraction logic in a single call:
+```bash
+python $SCRIPTS_DIR/download_sbom.py [IMAGE_REFERENCE]
+```
+
+The script handles attestation/build-time fallback and image index detection automatically. It returns JSON with:
+- `sbom_source` — "attestation" or "build_time"
+- `spdx` — the **full raw SPDX JSON document** with all packages, relationships, PURLs, and version info
+- `errors[]` — any issues encountered
+
+**Read and interpret the full raw SPDX document from the `spdx` field.** Analyze the SPDX data directly — packages (with `externalRefs` PURLs and `versionInfo`), relationships (for parent RPM linkage), checksums. Do NOT use grep or jq to search the SBOM.
+
+If `spdx` is null (no SBOM found), fall back to syft:
+```bash
+python $SCRIPTS_DIR/generate_sbom_syft.py [IMAGE_REFERENCE]
+```
+This generates an analyzed SBOM using syft. The output has the same JSON schema but `sbom_source` will be `"syft_analyzed"` — note this in the report as a generated SBOM, not an official one.
+
+If neither method produces an SBOM: stop and report "Unable to extract SBOM. Cannot determine package presence."
+
+**Package presence check and version confirmation:**
+
+Red Hat container image SBOMs contain both RPM packages and non-RPM content (Go modules, Python packages, Node.js packages, etc.), each identified by ecosystem-specific PURLs. A non-RPM package may exist as a standalone SBOM entry AND be linked via an SPDX relationship to the RPM package that delivers it. Use the following matching logic:
+
+1. **Identify the target package name and ecosystem from Step 1.** For Go, use the module path from the Go vuln DB as the authoritative name.
+
+2. **Search SBOM packages by PURL and name:**
+   - For each package in the SBOM, check its `externalRefs[]` for entries with `referenceType: purl`. Parse the PURL to extract ecosystem, name, and version.
+   - Match the ecosystem prefix against the CVE ecosystem (`pkg:rpm`, `pkg:golang`, `pkg:pypi`, `pkg:npm`, etc.).
+   - Match the package name case-insensitively. For Go, match against the full module path (e.g., `golang.org/x/net`).
+   - If found as a non-RPM package: also check its SPDX relationships — look for a `DYNAMIC_LINK`, `STATIC_LINK`, or `CONTAINED_BY` relationship to a parent RPM package entry. Record both the non-RPM package entry and its parent RPM if present.
+   - If found only as an RPM package: check `name` and `sourceName` fields (case-insensitive).
+
+3. **If the package is NOT found by any method:** skip Step 3 and go to Step 4 (Early Exit — package not in image).
+
+4. **If the package IS found:** record the installed version from the SPDX `versionInfo` field and proceed to version range confirmation.
+
+5. **Confirm the installed version falls within the vulnerable range:**
+   - Compare the installed version against the vulnerable version ranges from Step 1 (MITRE and, for Go, Go vuln DB).
+   - Version comparison rules by ecosystem:
+     - **RPM:** use RPM EVR ordering (`Epoch:Version-Release`). A higher EVR is a newer, potentially fixed version. If the installed version is within the `introduced`–`fixed` range from MITRE, it is vulnerable.
+     - **Go:** use semver ordering. Compare using the `introduced` and `fixed` boundaries from the Go vuln DB `ranges[].events[]`.
+     - **PyPI / npm:** use the version ordering rules of the respective ecosystem as documented in the CVE `versions[]` array.
+   - If the installed version is **within** the vulnerable range: record as **vulnerable — version confirmed**.
+   - If the installed version is **at or above** the fixed version: record as **not vulnerable — patched version installed**, skip Step 3, and go to Step 4.
+   - If version comparison is inconclusive (e.g., non-standard version string): record as **version comparison inconclusive** and proceed to Step 3 noting this uncertainty.
+
+Print: `✓ Step 2 complete — package [found|not found], version: [version], verdict: [vulnerable|patched|inconclusive], SBOM method: [attestation|build-time]`
+
+---
+
+### Step 3: Red Hat VEX Validation
+
+Run the `fetch_redhat_vex.py` script to fetch the full raw VEX document:
+```bash
+python $SCRIPTS_DIR/fetch_redhat_vex.py [CVE-ID]
+```
+
+The script returns JSON with:
+- `http_status` — 200, 404, or error code
+- `vex` — the **full raw CSAF VEX document** with `product_tree`, `vulnerabilities`, `remediations`, `flags`, `threats`
+- `errors[]` — any issues
+
+**Read and interpret the full VEX document from the `vex` field.** The LLM should analyze the `product_tree` (branches, relationships, CPEs, PURLs), `vulnerabilities` (product_status, remediations, flags, threats) directly to perform matching against the image CPE and component name from Step 0. This gives the LLM full context to:
+- Match the specific container component under its CPE
+- Search across all CPE versions for name-only matches
+- Check parent RPM status across all product streams (especially RHEL)
+- Extract all RHSA advisory URLs, justification flags, severity
+
+**Interpret the results:**
+
+- If `http_status` is 404: record "No Red Hat VEX data available for this CVE" and proceed to Step 4 (check VEX data gap Condition B).
+- If `vex.product_tree` contains only a generic blanket statement (all products under `cpe:/a:redhat`): treat as no analysis performed (check VEX data gap Condition C).
+
+**Read [references/01-vex-validation-procedure.md](references/01-vex-validation-procedure.md)** for the complete VEX matching procedure (sub-steps 3–9: generic blanket detection, product_tree matching, status determination, remediation/flags/severity extraction, and parent RPM patch check).
+
+Print: `✓ Step 3 complete — VEX status: [status], severity: [severity], gap condition: [A|B|C|none]`
+
+---
+
+### Step 4: Newer Image Availability Scan
+
+**Trigger — perform this step only when ALL of the following are true:**
+- The vulnerable package is an RPM, OR a non-RPM package delivered via a parent RPM (identified in Step 2 via SPDX relationship)
+- A fixed RPM version is known — from either:
+  - Red Hat VEX `product_status[].fixed` for the container (Step 3, sub-step 5), OR
+  - The parent RPM patch status check (Step 3, sub-step 9) finding the RPM `fixed` in RHEL
+- The RHSA release date is known (from the `vendor_fix` remediation URL or advisory metadata)
+
+If trigger conditions are NOT met, print `✓ Step 4 skipped — trigger conditions not met ([reason])` and proceed to Step 5.
+
+**Procedure:**
+
+1. Extract the image repository from the scanned image reference — strip tag or digest, keeping only registry + namespace + image name (e.g., `registry.redhat.io/multicluster-engine/cluster-proxy-addon-rhel9`).
+
+2. Run the `scan_newer_images.py` script:
+   ```bash
+   python $SCRIPTS_DIR/scan_newer_images.py [IMAGE_REPOSITORY] --since [SCANNED_IMAGE_CREATED_LABEL]
+   ```
+
+   The script returns JSON with `newer_images[]` — each entry has `tag`, `created`, `digest`, and `cpe`. Images are sorted by date (newest first), deduplicated by digest, capped at 10 results.
+
+   If `newer_images` is empty: no newer images exist yet. Record this and proceed to Step 5.
+
+3. For each newer image candidate, download its SBOM and search for the vulnerable RPM:
+   ```bash
+   python $SCRIPTS_DIR/download_sbom.py [IMAGE_REPOSITORY]:[TAG]
+   ```
+   - Find the RPM package by name in the SPDX data
+   - Compare its `versionInfo` against the known fixed version using RPM EVR ordering
+   - If installed version **≥ fixed version**: this image contains the fix — record it
+
+4. For each image found to contain the fix, compare its CPE against the scanned image's CPE:
+   - **Same CPE** (same product stream): "Patched image available in the same product stream: `[IMAGE_REPOSITORY]:[TAG]` (`[DIGEST]`, built `[CREATED]`)"
+   - **Different CPE** (different product stream): "Patched image available in a newer product stream (`[NEWER_CPE]`): `[IMAGE_REPOSITORY]:[TAG]` (`[DIGEST]`, built `[CREATED]`). Upgrading would change product stream from `[IMAGE_CPE]` to `[NEWER_CPE]`."
+
+5. If no newer image contains the fixed RPM: record "No patched container image released yet. The RPM fix exists but the container has not yet been rebuilt with the updated RPM."
+
+Print: `✓ Step 4 complete — [patched image found: REPO:TAG | no patched image found | skipped]`
+
+---
+
+### Step 5: Final Report
+
+**Read [references/02-report-template.md](references/02-report-template.md)** for VEX data gap condition evaluation (Conditions A/B/C), executive summary rules, upstream patch note logic, RHSA advisory assessment, the full report template (markdown/JSON/CSV), and field semantics.
+
+Print: `✓ Step 5 complete — report generated`
+
+## Dependencies
+
+### Required MCP Servers
+- None — this skill uses bundled Python scripts, not MCP tools
+
+### Required Helper Scripts
+- `validate_input` — validates CVE ID format and image reference
+- `inspect_image` — extracts container image metadata via regctl
+- `fetch_cve_metadata` — queries MITRE, OSV.dev, and Go vuln DB
+- `download_sbom` — fetches SBOM attestations and build-time SBOMs
+- `generate_sbom_syft` — fallback SBOM generation via syft (optional, used when attestations unavailable)
+- `fetch_redhat_vex` — retrieves Red Hat VEX security advisories
+- `fetch_rhsa_advisory` — resolves RHSA advisory IDs to CVE lists
+- `scan_newer_images` — lists and checks newer image tags for patched RPMs
+
+### Related Skills
+- `cve-recon` — standalone CVE reconnaissance (Step 1 only)
+- `image-inspect` — standalone image inspection (Input Validation only)
+- `coreos-cve-validator` — CVE validation for CoreOS/RHCOS images
+
+### Reference Documentation
+- [Red Hat CSAF VEX Data](https://security.access.redhat.com/data/csaf/v2/)
+- [MITRE CVE API](https://cveawg.mitre.org/api/cve/)
+- [OSV.dev API](https://api.osv.dev/v1/vulns/)
\ No newline at end of file
diff --git a/ocp-admin/skills/container-cve-validator/references/01-vex-validation-procedure.md b/ocp-admin/skills/container-cve-validator/references/01-vex-validation-procedure.md
new file mode 100644
index 00000000..6eab5589
--- /dev/null
+++ b/ocp-admin/skills/container-cve-validator/references/01-vex-validation-procedure.md
@@ -0,0 +1,98 @@
+# VEX Validation Procedure (Step 3 sub-steps 3–9)
+
+3. Before searching for the specific image, check whether the `product_tree` contains a generic Red Hat blanket statement. This is identified by an entry where:
+   - The `name` or description is `"All currently supported Red Hat products"` (or similar generic wording), AND
+   - The associated CPE is unqualified (e.g., exactly `cpe:/a:redhat` or `cpe:/a:redhat:*`)
+
+   When this blanket entry is present, it is always the only entry in the product tree — there are never specific product entries alongside it. This means Red Hat published the VEX file as a placeholder without performing any product-specific analysis for this CVE.
+
+   **If a generic blanket entry is found:**
+   - Record this as: `Generic Red Hat statement — CVE not individually reviewed`
+   - Treat it with the same weight as a missing VEX file. The existence of this VEX file does NOT mean Red Hat has analysed this CVE for any specific product or component.
+   - Do NOT use it to conclude the image is safe or unaffected.
+   - If Step 2 confirmed the vulnerable package IS present in the SBOM and the installed version falls within the vulnerable range: record the image as potentially affected AND set the VEX Data Gap flag — this should be reported to `secalert@redhat.com` (same action as Condition A and B in Step 4).
+   - Include a caution note in the report: "Red Hat published a VEX file for this CVE containing only a generic blanket statement covering all products under `cpe:/a:redhat`, with no product-specific analysis performed. This is equivalent to no VEX coverage and should not be treated as confirmation that this image is unaffected."
+   - Skip the remaining sub-steps of Step 3 (sub-steps 4 through 8 below) and proceed directly to Step 4 (Final Report).
+
+4. **Understand the `product_tree` structure before searching.**
+
+   The `product_tree` is a two-level hierarchy:
+
+   - **Products** represent Red Hat product streams (e.g., "Red Hat Advanced Cluster Management 2.10"). They are identified by a **CPE ID** (e.g., `cpe:/a:redhat:multicluster_engine:2.4`).
+   - **Components** represent individual container images or packages within a product stream. They are identified by a **PURL** (Package URL) found inside the `product_identification_helper` field of each `full_product_name` entry.
+
+   The linkage between a component and its parent product is expressed in `product_tree.relationships[]`, where each entry has:
+   - `category: default_component_of`
+   - `product_reference` — the component ID (the container image, matched by name or PURL)
+   - `relates_to_product_reference` — the parent product ID (matched by CPE)
+   - `full_product_name.product_id` — the combined ID used in `product_status`, `remediations`, `flags`, and `threats`
+
+   The `product_cpe` from the image's `cpe` label (collected in Input Validation Step A) identifies which product stream the scanned image belongs to. Use it as the primary anchor for matching. The `name` label is the public component name used in VEX metadata and is the primary field for component-level matching within that product stream.
+
+   **Matching procedure — execute in order using the raw VEX `product_tree`:**
+
+   **4a. Match by CPE + public name (primary):**
+   - Take the `product_cpe` from the image labels.
+   - Find entries in `product_tree.relationships[]` whose `relates_to_product_reference` CPE matches the image's `product_cpe`.
+   - Within those, find entries whose component name matches the image's `name` label (case-insensitive).
+   - If found: record the `full_product_name.product_id`. Proceed to step 5.
+
+   **4b. Name match with CPE version mismatch (patch in newer product stream):**
+   - If 4a found nothing, search ALL `product_tree.relationships[]` for component name matches regardless of CPE version.
+   - If found under a different CPE version: record the CPE, status, and any RHSA advisory URLs. Do NOT apply the newer stream's status to the scanned image.
+   - Record: `Mismatch — patch available in newer product stream only`
+
+   **4c. No match at all:**
+   - If neither 4a nor 4b found anything: record "Image not referenced in Red Hat VEX data". Proceed to Step 4 (Final Report).
+
+5. **Determine product status** from `vulnerabilities[].product_status[]`.
+
+   This section groups product IDs by their status. Check which status array contains the matched product ID:
+
+   | Status key in `product_status` | Meaning | Action |
+   |---|---|---|
+   | `fixed` | A vendor patch has been released for this product | Proceed to step 6 to extract RHSA URL |
+   | `known_affected` | The product is confirmed affected | Proceed to step 6 to extract remediation category |
+   | `known_not_affected` | The product is confirmed not affected | Proceed to step 7 to extract justification flag |
+   | `under_investigation` | Red Hat has not yet completed analysis | Record this status and note: "Red Hat is actively investigating this CVE for this product. The image may be affected. Check back for an updated VEX statement." If SBOM confirms the vulnerable package is present and the installed version falls within the vulnerable range, additionally flag this in the executive summary as "Potentially affected — Red Hat analysis ongoing". |
+
+   Record the matched status.
+
+6. **Extract remediation details** from `vulnerabilities[].remediations[]`.
+
+   Filter remediations to those whose `product_ids[]` includes the matched product ID. Then interpret by `category`:
+
+   - **If status is `fixed`:** look for ALL remediation entries with `category: vendor_fix` matching the product ID. Extract the `url` field from each — these are links to Red Hat Security Advisories (RHSAs) containing the patch. There may be more than one (e.g., separate advisories per product stream variant). Record all RHSA URLs as a list.
+   - **If status is `known_affected`:** look for remediations with:
+     - `category: no_fix_planned` — Red Hat will not release a security patch for this product.
+     - `category: none_available` — The product is affected and a patch timeline is unknown.
+   - **If status is `known_not_affected` or `under_investigation`:** remediations may be absent or informational only.
+
+7. **Extract justification for `known_not_affected`** from `vulnerabilities[].flags[]`.
+
+   If the product status is `known_not_affected`, find the entry in `flags[]` whose `product_ids[]` contains the matched product ID and read its `label` field. This is Red Hat's official justification for why the product is not affected (e.g., `component_not_present`, `vulnerable_code_not_present`, `inline_mitigations_already_exist`). Record this label and include it verbatim in the report.
+
+8. **Extract CVE severity** from `vulnerabilities[].threats[]`.
+
+   Search in this order:
+   1. Find an entry with `category: impact` whose `product_ids[]` includes the matched product ID. Extract its `details` field.
+   2. If no product-scoped entry exists, find a global entry with `category: impact` that has no `product_ids` field (or an empty one). Extract its `details` field.
+   3. If neither exists: record severity as `N/A — not specified in VEX`.
+
+   Valid severity values: `Critical`, `Important`, `Moderate`, `Low`.
+
+9. **Check parent RPM patch status (applies when vulnerable package is non-RPM linked to a parent RPM).**
+
+   This step is triggered when Step 2 SBOM analysis identified the vulnerable package as a non-RPM entry (e.g., a Go module, Python package, Node.js package) that is linked to a parent RPM package via an SPDX relationship (`DYNAMIC_LINK`, `STATIC_LINK`, or `CONTAINED_BY`).
+
+   The logic here addresses a critical gap: even if the container image has no VEX entry (gap conditions A/B/C), the parent RPM may already have been patched in a base product such as RHEL. If so, the situation is not simply an unreviewed CVE — Red Hat has patched the RPM but the container image has not yet been rebuilt to include the updated RPM.
+
+   **Procedure:**
+   - Take the parent RPM package name recorded in Step 2 (e.g., `grpc`, `golang-google-grpc`, `curl`).
+   - Search `product_tree.relationships[]` for entries whose `product_reference` name or PURL matches the parent RPM package name (case-insensitive), under ANY product CPE — not limited to the container's product stream. Pay particular attention to RHEL product streams (CPE patterns like `cpe:/o:redhat:enterprise_linux:*`, `cpe:/a:redhat:rhel_eus:*`, `cpe:/a:redhat:rhel_aus:*`).
+   - For each match found, check its status in `vulnerabilities[].product_status[]`.
+   - If the parent RPM is found with status `fixed` in any RHEL or base product stream:
+     - Extract the `vendor_fix` RHSA advisory URLs for that RPM from `vulnerabilities[].remediations[]`.
+     - Record: "Parent RPM `[RPM_NAME]` has been patched in `[RHEL_PRODUCT_CPE]` via `[RHSA_URLs]`. However, the container image `[IMAGE_NAME]` has not yet been rebuilt with the updated RPM version and therefore remains affected. The container will be fixed once Red Hat publishes a new image build that includes the patched RPM."
+   - If the parent RPM is found but with status `known_affected`, `under_investigation`, or `known_not_affected`: record that status and its justification.
+   - If the parent RPM is NOT found in the VEX product_tree at all: record "Parent RPM not referenced in VEX" and proceed.
diff --git a/ocp-admin/skills/container-cve-validator/references/02-report-template.md b/ocp-admin/skills/container-cve-validator/references/02-report-template.md
new file mode 100644
index 00000000..93eec687
--- /dev/null
+++ b/ocp-admin/skills/container-cve-validator/references/02-report-template.md
@@ -0,0 +1,213 @@
+# Final Report — VEX Gap Evaluation, Report Template, and Output Formats
+
+## VEX Data Gap Conditions
+
+Always produce a report regardless of which exit path was taken. Use `N/A` or a clear explanation for any field that could not be determined.
+
+**Before writing the report, evaluate the following VEX data gap conditions:**
+
+**Condition A — VEX file exists, but the component is absent from it:**
+Apply this when ALL of the following are true:
+- A Red Hat VEX file was successfully fetched for this CVE (HTTP 200)
+- The VEX file contains specific product entries (not a generic blanket statement)
+- Step 3-4c was reached: neither 4a (exact CPE + name match) nor 4b (name match under any CPE version) found any entry for this component — it is completely absent from the VEX product_tree. Note: if 4b found a name match under a different CPE version, Condition A does NOT apply — that is a version mismatch scenario reported separately via "Mismatch — patch in newer stream only".
+- SBOM analysis confirmed the vulnerable package IS present in the image
+- Version comparison in Step 2 confirmed the installed version falls within the vulnerable range (or version comparison was inconclusive)
+
+-> Record status as: `Potentially vulnerable — Red Hat VEX data gap`
+-> Note: Even though a VEX file exists for this CVE, Red Hat has not assessed this specific component. The SBOM evidence and CVE metadata together indicate the image is likely affected.
+-> Still report the Red Hat severity from `vulnerabilities[].threats[]` `category: impact` if it is present globally in the VEX file (it may apply even without a component-specific entry).
+-> Flag for reporting: "This appears to be a Red Hat VEX data gap. The component is not referenced in the Red Hat VEX file despite a VEX file existing for this CVE. This should be reported to the Red Hat Security Team at secalert@redhat.com."
+
+**Condition C — VEX file exists but contains only a generic blanket statement:**
+Apply this when ALL of the following are true:
+- A Red Hat VEX file was successfully fetched (HTTP 200) but its `product_tree` contained only a generic blanket entry (`"All currently supported Red Hat products"` under `cpe:/a:redhat`)
+- SBOM analysis confirmed the vulnerable package IS present in the image
+- Version comparison confirmed the installed version falls within the vulnerable range (or was inconclusive)
+
+-> Record status as: `Potentially vulnerable — Generic Red Hat VEX statement, CVE not individually reviewed`
+-> Note: The VEX file exists but represents no actual analysis. It is equivalent to having no VEX coverage for this component.
+-> Flag for reporting: "Red Hat published a generic placeholder VEX statement for this CVE with no product-specific analysis. Based on SBOM and CVE metadata, the image appears to be affected. This should be reported to the Red Hat Security Team at secalert@redhat.com."
+
+**Condition B — No VEX file exists at all:**
+Apply this when ALL of the following are true:
+- The Red Hat VEX endpoint returned HTTP `404` for this CVE
+- SBOM analysis confirmed the vulnerable package IS present in the image
+- MITRE CVE data (and Go vuln DB if applicable) confirms the installed version falls within the vulnerable range
+
+-> Record status as: `Potentially vulnerable — No Red Hat VEX data`
+-> Note: Red Hat has published no VEX statement for this CVE. The image appears affected based on SBOM and CVE metadata alone.
+-> Flag for reporting: "No Red Hat VEX file exists for this CVE. Based on SBOM and CVE metadata analysis, the image appears to be affected. This should be reported to the Red Hat Security Team at secalert@redhat.com."
+
+## Executive Summary Rules
+
+- If any VEX data gap condition (A, B, or C) is active: the Executive Summary MUST explicitly state the gap and include the secalert recommendation. Example: "The image appears potentially vulnerable to [CVE-ID] based on SBOM and CVE metadata analysis; Red Hat has not assessed this component [reason — no VEX / missing from VEX / generic placeholder]. This should be reported to the Red Hat Security Team at secalert@redhat.com."
+- For all other statuses, a single verdict sentence is sufficient.
+
+## Upstream Patch Note
+
+Check whether the upstream CVE metadata (MITRE `versions[]` fixed boundary, or Go vuln DB `ranges[].events[]` `fixed` entry) shows that a patch has already been released upstream for the vulnerable package.
+
+If an upstream patch EXISTS and the Red Hat VEX status is NOT `fixed` — specifically when the status is any of: gap condition A/B/C, `known_affected` (with `none_available` or `no_fix_planned`), `under_investigation`, or CPE version mismatch (patch in newer product stream only) — then add the following note to the report:
+
+> "An upstream patch exists for this package (see CVE Details for fixed version). However, this is a Red Hat container image and the vulnerable package is delivered as part of the Red Hat image build. Users must NOT attempt to patch the package independently inside the container. The fix must be delivered by Red Hat as a new image release. Monitor Red Hat Security Advisories (RHSA) and watch for an updated image version at registry.redhat.io."
+
+If no upstream patch exists yet (no `fixed` version in CVE metadata): omit this note.
+
+## RHSA Advisory Assessment
+
+When the user's original input was an RHSA advisory (resolved to CVEs in Step 1), the Executive Summary for each CVE MUST include an assessment of whether the reported RHSA is the correct remediation for the scanned image. Evaluate by comparing the RHSA from the user's input against the RHSA(s) found in the VEX data for this image:
+
+| Situation | Executive Summary addition |
+|---|---|
+| The user's RHSA appears in the VEX `remediations[]` as `vendor_fix` for this image's product ID | "The reported advisory **[RHSA-ID] is the correct fix** for this image. Apply this advisory to remediate [CVE-ID]." |
+| The user's RHSA is a `vendor_fix` but for a different CPE/product stream than the scanned image | "The reported advisory **[RHSA-ID] applies to a different product stream** ([OTHER_CPE]). Your image is on [IMAGE_CPE]. [If a different RHSA exists for the image's CPE: 'The correct advisory for your image is [CORRECT_RHSA].'] [If no advisory exists for the image's CPE: 'No advisory has been released yet for your product stream.']" |
+| A different RHSA is the correct fix for this image | "The reported advisory [RHSA-ID] is **not the correct fix** for this image. The applicable advisory is **[CORRECT_RHSA]** — apply this instead." |
+| No RHSA exists for any product stream (VEX gap, 404, or under_investigation) | "The reported advisory [RHSA-ID] **does not apply** to this image. No Red Hat patch is currently available for [IMAGE_CPE]. Monitor Red Hat Security Advisories for updates." |
+| The CVE does not affect this image (package not in SBOM, or VEX says `known_not_affected`) | "The reported advisory [RHSA-ID] is **not applicable** — this image is not affected by [CVE-ID]. [reason from VEX or SBOM analysis]." |
+
+Include this assessment prominently in the Executive Summary — it directly answers the user's question: "Is this RHSA relevant to my image?"
+
+## Full Report Template (Markdown)
+
+```markdown
+## CVE Validation Report
+
+- **CVE ID:** [CVE-ID]
+- **Image:** [IMAGE_REFERENCE]
+
+- **Executive Summary:** [For gap conditions: state the gap, vulnerability likelihood, and secalert@redhat.com recommendation. For RHSA input: include the RHSA assessment (correct fix / wrong product stream / different RHSA / not applicable). For all other statuses: 1 sentence verdict and key reason.]
+
+- **Image Metadata:**
+  - Registry: [registry hostname]
+  - Mirrored from canonical registry: [Yes — canonical reference: registry.redhat.io/... | No]
+  - Vendor: [vendor label value]
+  - Maintainer: [maintainer label value]
+  - Public name (`name` label): [value — used for VEX product_tree matching]
+  - Internal build name (`com.redhat.component`): [value — for reference only, not used for VEX matching]
+  - Product CPE (`cpe`): [CPE URI — used as primary VEX product stream anchor]
+  - Built: [org.opencontainers.image.created]
+  - Container tag(s): [tag(s) from input | tag(s) extracted from SBOM pkg:oci/ PURL (comma-separated if multiple)]
+  - Container digest: [sha256:... from input | sha256:... extracted from SBOM pkg:oci/ PURL]
+  - SBOM extraction method: [Attestation SBOM (architecture-specific) | Attestation SBOM (re-fetched after image index detection) | Build-time SBOM | Build-time SBOM (re-fetched after image index detection)]
+
+- **CVE Details:**
+  - Package: [name]
+  - Ecosystem: [ecosystem]
+  - Vulnerable versions: [version ranges from MITRE]
+  - Go module path: [module path from Go vuln DB | N/A — not a Go ecosystem CVE]
+  - Go vulnerability ID: [GO-YYYY-NNNN | N/A — not a Go ecosystem CVE]
+  - Go vuln DB affected versions: [version ranges from vuln.go.dev | N/A]
+
+- **SBOM Findings:**
+  - Package found in image: [Yes | No]
+  - Installed version: [version | N/A]
+  - Version in vulnerable range: [Yes | No — patched version installed | Inconclusive — non-standard version string]
+  - SPDX entry type: [RPM package | Non-RPM package (ecosystem: [Go|PyPI|npm|...]) | Non-RPM package linked to parent RPM: [parent RPM name] | N/A]
+
+- **Red Hat VEX Status:**
+  - Status: [fixed | known_affected | known_not_affected | under_investigation | Potentially vulnerable — Red Hat VEX data gap | Potentially vulnerable — No Red Hat VEX data | Image not in VEX | Generic statement — CVE not individually reviewed | N/A — package not in SBOM]
+  - Red Hat Severity: [Critical | Important | Moderate | Low | N/A — no VEX or not assessed]
+  - Matched product stream CPE: [CPE of the VEX entry that matched | N/A]
+  - Image product stream CPE: [CPE from image labels]
+  - Product stream version match: [Exact match | Mismatch — patch in newer stream only | No match | N/A]
+  - Remediation: [vendor_fix | no_fix_planned | none_available | N/A]
+  - RHSA Advisories: [List of URLs to Red Hat Security Advisories (one per line if multiple) | N/A — not applicable for this status]
+  - Patch availability note: [Include if version mismatch (4b): list each newer stream entry on its own line:
+      "Patch available in product stream [NEWER CPE] — Status: [status] — RHSA: [URL(s) or N/A]"
+    Then add: "Your image is on [IMAGE CPE], which has not been individually assessed for this CVE. Not all product streams receive patches for every CVE — backport decisions depend on CVE severity and the product stream lifecycle stage (Full Support / Maintenance / ELS). Monitor Red Hat Security Advisories for an update to your product stream." | Omit if no mismatch]
+  - Not-affected justification: [flags[].label value from VEX | N/A — not applicable for this status]
+  - Caution: [Include only if status is "Generic statement": "Red Hat issued a blanket VEX statement under cpe:/a:redhat covering all products without product-specific analysis. This does not confirm the image is unaffected. SBOM findings take precedence." | Omit this field otherwise]
+  - Upstream patch note: [Include if upstream CVE metadata (MITRE/Go vuln DB) shows a fixed version exists AND Red Hat VEX status is NOT fixed (gap/known_affected/under_investigation/mismatch): "An upstream patch exists for this package. However, this is a Red Hat container image and the package is delivered as part of the Red Hat image build. Users must NOT patch the package independently. The fix must be delivered by Red Hat as a new image release. Monitor Red Hat Security Advisories (RHSA) at access.redhat.com." | Omit if Red Hat has already released a fix or no upstream patch exists yet]
+
+- **Newer Image Availability:**
+  - Scan performed: [Yes | No — not applicable (non-RPM without parent RPM, or no fixed version known)]
+  - Repository scanned: [registry/namespace/image-name | N/A]
+  - Patched image in same product stream: [IMAGE_REPOSITORY:TAG (digest, built DATE) | None found yet]
+  - Patched image in newer product stream: [IMAGE_REPOSITORY:TAG (digest, built DATE, CPE) | None found | N/A]
+  - Recommendation: [Upgrade to IMAGE_REPOSITORY:TAG | No patched image available yet — monitor RHSA advisories | N/A]
+
+- **Parent RPM Patch Status:**
+  - Applies: [Yes — vulnerable package is non-RPM delivered via parent RPM | No — vulnerable package is an RPM itself | N/A — package not in SBOM]
+  - Parent RPM name: [RPM package name from SPDX relationship | N/A]
+  - RPM patch status in base product: [Fixed in [RHEL_PRODUCT_CPE] via [RHSA_URL(s)] | Known affected | Under investigation | Not referenced in VEX | N/A]
+  - Container image rebuild required: [Include if RPM is fixed but container not rebuilt: "The parent RPM has been patched in [PRODUCT] but the container image has not yet been rebuilt with the updated RPM. The container remains affected until Red Hat publishes a new image build." | Omit otherwise]
+
+- **VEX Data Gap:**
+  - Gap detected: [Yes — component missing from existing VEX file (Condition A) | Yes — generic placeholder VEX only, no analysis performed (Condition C) | Yes — no VEX file exists (Condition B) | No | N/A — package not in SBOM or version not vulnerable]
+  - Analysis basis: [Include if gap detected: "Conclusion based on SBOM evidence and CVE metadata (MITRE[, Go vuln DB]) — no Red Hat product-specific assessment available."]
+  - Action required: [Include if gap detected: "Report to Red Hat Security Team at secalert@redhat.com — provide CVE ID, image reference, and SBOM evidence." | Omit otherwise]
+
+- **Reported Advisory Assessment:** [Include ONLY when the original input was an RHSA advisory ID]
+  - Reported advisory: [RHSA-ID from user input]
+  - Assessment: [Correct fix for this image | Applies to different product stream ([CPE]) — not applicable to this image | Not applicable — image not affected | No patch available yet for this product stream]
+  - Correct advisory: [RHSA-ID if different from reported | Same as reported | N/A — no advisory available]
+```
+
+## Output Format Variants
+
+After completing the full analysis above, render the final output according to `OUTPUT_FORMAT` and `OUTPUT_MODE`.
+
+**If `OUTPUT_FORMAT` is `markdown` and `OUTPUT_MODE` is `full`:** produce the complete Markdown report template above.
+
+**If `OUTPUT_FORMAT` is `markdown` and `OUTPUT_MODE` is `summary`:** produce only this condensed format:
+
+```markdown
+## CVE Validation Summary
+
+- **CVE ID:** [CVE-ID]
+- **Image:** [IMAGE_REFERENCE]
+- **Status:** [True Positive — [brief reason] | False Positive — [brief reason] | Uncertain — [brief reason]]
+- **Vendor Patch Available:** [Yes — [advisory name] | No — no fix planned | No — false positive | Unknown]
+
+**Executive Summary:** [2-3 sentences: what the CVE is, whether this image is affected, what Red Hat has done or not done, and what the user should do next. For VEX data gap conditions include: "This should be reported to secalert@redhat.com."]
+
+## Recommended Actions
+
+[Numbered list of 2-5 concrete, specific action items based on the actual findings. Examples:
+1. Upgrade to [image:tag] which contains the fix via [RHSA-...]
+2. Report this CVE gap to secalert@redhat.com — provide CVE ID, image reference, and SBOM evidence
+3. Monitor Red Hat Security Advisories at access.redhat.com for a fix to your product stream
+4. No action required — image is confirmed not affected ([justification from VEX flags])
+Include only actions that apply; omit irrelevant items.]
+```
+
+**If `OUTPUT_FORMAT` is `json`:** produce only the following JSON block (no Markdown sections):
+
+```json
+{
+  "scanned_image": "[fully qualified image reference]",
+  "cve_id": "[CVE-ID]",
+  "status": "[true_positive|false_positive|uncertain]",
+  "status_source": "[vex_confirmed|sbom_analysis|vex_not_affected]",
+  "vendor_patch_available": "[true|false]",
+  "patch_path": {"advisory_name": "[RHSA-YYYY-NNNNN]", "advisory_url": "[https://access.redhat.com/errata/...]"},
+  "related_rpm_patch": {"advisory_name": "[RHSA-YYYY-NNNNN]", "advisory_url": "[https://access.redhat.com/errata/...]"},
+  "recommendation": "[concise 1-2 sentence action for the user]"
+}
+```
+
+**If `OUTPUT_FORMAT` is `csv`:** produce a two-line CSV (header + one data row), no Markdown:
+
+```
+scanned_image,cve_id,status,status_source,vendor_patch_available,advisory_name,advisory_url,related_rpm_advisory_name,related_rpm_advisory_url,recommendation
+[image ref],[CVE-ID],[status],[status_source],[true/false or empty],[advisory name or empty],[advisory url or empty],[rpm advisory name or empty],[rpm advisory url or empty],[recommendation]
+```
+
+**Missing values rule — applies to both JSON and CSV:**
+- **JSON:** when a value is not available, not applicable, or unknown, use an empty string `""` — never use `null`.
+- **CSV:** when a value is not available, not applicable, or unknown, leave the field empty — never write the literal word `null`.
+
+**Field semantics for JSON and CSV:**
+- `status`: whether the scanned image is affected by the CVE.
+  - `"true_positive"` = package present in SBOM AND version confirmed within the vulnerable range — regardless of whether this was determined via VEX or SBOM analysis. This includes VEX data gap scenarios (conditions A/B/C) where SBOM evidence confirms the vulnerability.
+  - `"false_positive"` = VEX `known_not_affected` (component_not_present, vulnerable_code_not_present, etc.)
+  - `"uncertain"` = genuinely inconclusive — version comparison failed (non-standard version string), VEX `under_investigation` with no SBOM confirmation, or package not found in SBOM but CVE may still apply
+- `status_source`: how the `status` was determined.
+  - `"vex_confirmed"` = status determined by direct VEX product_tree match (Step 3 sub-step 4a exact match). VEX explicitly states the product status.
+  - `"sbom_analysis"` = status determined by SBOM package presence + CVE version range comparison (Steps 1-2). Used when VEX has no coverage for this component (data gap conditions A/B/C), VEX file is missing (condition B), or VEX contains only a generic blanket statement (condition C).
+  - `"vex_not_affected"` = VEX explicitly states `known_not_affected` with a justification flag. Used only when `status` is `"false_positive"`.
+- `vendor_patch_available`: refers to whether a **container image fix** is available — not a base RPM fix. `"true"` = Red Hat has released a fixed container image (VEX status `fixed` for the container product, or Step 4 found a rebuilt image in the same product stream); `"false"` = `no_fix_planned` or false positive (no patch needed); `""` (empty) = unknown (gap/`under_investigation`/`none_available`, or only a base RPM patch exists but the container has not been rebuilt)
+- `patch_path`: the advisory that fixes the **container image**. Use the RHSA URL from VEX remediations only when the VEX status for the **container** (not the base RPM) is `fixed`. Set both fields to `""` if no container-level advisory is available. A base RPM advisory (e.g., from parent RPM patch status in Step 3 sub-step 9) does NOT qualify — users cannot apply base RPM patches to container images independently.
+- `related_rpm_patch`: when a base RPM patch exists (found in Step 3 sub-step 9 or VEX `vendor_fix` for the RPM in RHEL) but the container has NOT been rebuilt with it, populate this field with the RPM advisory name and URL. This is informational — the user cannot apply it directly. Set both fields to `""` if no related RPM patch exists or the container is already fixed.
+- `recommendation`: one or two sentences summarising the most important action the user should take
diff --git a/ocp-admin/skills/coreos-cve-validator/SKILL.md b/ocp-admin/skills/coreos-cve-validator/SKILL.md
new file mode 100644
index 00000000..1bd105d1
--- /dev/null
+++ b/ocp-admin/skills/coreos-cve-validator/SKILL.md
@@ -0,0 +1,271 @@
+---
+name: coreos-cve-validator
+description: Validate a CVE against Red Hat Enterprise Linux CoreOS (RHCOS) in a specific OCP release by extracting RPM packages and checking Red Hat VEX data.
+license: Apache-2.0
+user_invocable: true
+model: inherit
+color: red
+---
+
+# CoreOS (RHCOS) CVE Validator
+
+## When to Use This Skill
+Use this skill when the user asks you to check, validate, or analyze a CVE against Red Hat Enterprise Linux CoreOS (RHCOS) for a specific OpenShift Container Platform (OCP) version. CoreOS is the immutable OS running on OCP nodes.
+
+## Input
+
+Two required inputs:
+- **CVE ID** — format `CVE-YYYY-NNNNN`
+- **OCP version** — format `4.X.Y` (e.g., `4.20.17`)
+
+## Prerequisites
+
+**Resolve scripts directory** — the helper scripts are at `../scripts/` relative to this project's root:
+```bash
+SCRIPTS_DIR="$(git rev-parse --show-toplevel)/ocp-admin/scripts/security-validation"
+test -f "$SCRIPTS_DIR/validate_input.py" || { echo "Error: Scripts directory not found at $SCRIPTS_DIR"; exit 1; }
+```
+The scripts check internally for `oc` and `podman`.
+
+## Workflow
+
+**MANDATORY EXECUTION CONTRACT:**
+
+| # | Step | Required | May skip only when |
+|---|---|---|---|
+| 1 | Input validation | Always | Never |
+| 2 | CVE Reconnaissance | Always | Never |
+| 3 | CoreOS metadata extraction | Always | Never |
+| 4 | RPM package matching | Always | Never |
+| 5 | Red Hat VEX validation | Always | RPM NOT found in CoreOS (Step 4) |
+| 6 | Final Report | Always | Never |
+
+**Strict rules:**
+1. Execute each step using the scripts and procedures below. After each step, print: `✓ Step N complete — [key finding]`
+2. Every field in the final report must come from actual script outputs. Use `N/A — [reason]` for undetermined fields. Never fabricate values.
+3. **FORBIDDEN COMMANDS — never use these, even inside loops or pipelines:**
+   - `grep` — do not grep through JSON data files
+   - `jq` — do not use jq filters on JSON data
+   - `curl` — do not fetch URLs directly, use the helper scripts
+   - `cosign` — do not call cosign directly, use `download_sbom.py`
+   - `for ... do ... done` loops that process tool-result files
+   - Any ad-hoc bash script, Python one-liner, or shell pipeline that parses or filters JSON data
+4. **The ONLY allowed bash commands are:** running the helper scripts (`python $SCRIPTS_DIR/...`), `SCRIPTS_DIR=...` resolution, `test -f`, and `cat` to read a file.
+5. **How to handle large VEX/SBOM data:** Read the raw JSON output directly in your context window. The data IS your input — analyze it in your reasoning, not with shell tools. If the output is too large, focus on the relevant sections (product_tree entries matching the CPE/component, vulnerabilities section) from what you can see. Do NOT attempt to filter it with grep/jq.
+6. The `fetch_redhat_vex.py` script takes ONLY a CVE-ID argument — no flags. It returns the full raw VEX document.
+
+---
+
+### Step 1: Input Validation
+
+```bash
+python $SCRIPTS_DIR/validate_input.py --coreos --ocp-version [OCP_VERSION] --cve [CVE-ID]
+```
+
+If `valid` is false, print errors and stop.
+
+Check the `input_type` field in the response:
+- If `input_type` is `"rhsa"`: the user provided an RHSA advisory ID, not a CVE ID. Resolve it to individual CVEs first using the `fetch_rhsa_advisory.py` script (**do NOT use WebFetch or curl to access access.redhat.com**):
+  ```bash
+  python $SCRIPTS_DIR/fetch_rhsa_advisory.py [RHSA-ID]
+  ```
+  The script returns `cve_ids[]` — a list of CVE IDs covered by this advisory. Run Steps 2-6 for **each** CVE in the list against the same OCP version.
+
+- If `input_type` is `"cve"`: proceed directly to Step 2 with the single CVE ID.
+
+Print: `✓ Step 1 complete — input validated: [CVE-ID or RHSA-ID] against OCP [OCP_VERSION]`
+
+---
+
+### Step 2: CVE Reconnaissance
+
+```bash
+python $SCRIPTS_DIR/fetch_cve_metadata.py [CVE-ID]
+```
+
+From the output, identify the target package name, ecosystem, and vulnerable version ranges. For CoreOS, the primary ecosystem is `rpm`. If the CVE affects a Go module or Python package, check whether it's delivered via an RPM in CoreOS (the RPM name may differ from the upstream package name).
+
+If `affected` is empty with errors indicating CVE not found: stop and report.
+
+Print: `✓ Step 2 complete — [package name], ecosystem: [ecosystem]`
+
+---
+
+### Step 3: CoreOS Metadata Extraction
+
+```bash
+python $SCRIPTS_DIR/fetch_coreos_metadata.py [OCP_VERSION] --cache-dir /tmp/coreos-cache
+```
+
+**Caching:** The `--cache-dir` flag stores the result per OCP version. When validating multiple CVEs against the same OCP version, the CoreOS RPM list is fetched once and reused from cache for all subsequent CVEs. Always pass the same cache dir for all scans in a session.
+
+This fetches OCP release info via `oc adm release info` (read-only query against public Red Hat release metadata — does not access the user's cluster) and runs `podman` to extract the RPM package list from the CoreOS image. It returns:
+- `ocp_version`, `created`, `machine_os` (RHEL version), `rhel_version`, `rhel_major`
+- `coreos_pullspec` — the exact CoreOS image digest
+- `cpes` — `rhel` and `ocp` CPE strings for VEX matching
+- `rpms[]` — all RPMs with `name`, `evr` (epoch:version-release), `arch`, `source` (rhel/ocp/fast_datapath)
+- `rpm_count`, `rpm_by_source` — summary counts
+
+Record the `cpes` for VEX matching in Step 5.
+
+**Authentication failure handling:** If the script fails with an authentication error, it will return an error message indicating that a pull secret is required. In that case:
+1. Report the error to the user and ask them to provide the path to their Red Hat pull secret file (downloadable from https://console.redhat.com/openshift/downloads).
+2. Once the user provides the path, re-run the script with `--authfile`:
+   ```bash
+   python $SCRIPTS_DIR/fetch_coreos_metadata.py [OCP_VERSION] --cache-dir /tmp/coreos-cache --authfile [USER_PROVIDED_PATH]
+   ```
+
+Print: `✓ Step 3 complete — OCP [version], RHEL [rhel_version], [rpm_count] RPMs ([rhel] RHEL, [ocp] OCP, [fdp] Fast Datapath)`
+
+---
+
+### Step 4: RPM Package Matching
+
+Search the `rpms[]` array from Step 3 for the affected package identified in Step 2.
+
+**Matching rules:**
+1. Match by RPM name (case-insensitive) against the CVE-affected package name
+2. For Go/Python CVEs: the upstream package name (e.g., `golang.org/x/net`) won't match directly. Search for RPMs that could deliver the upstream package:
+   - Go: search for RPMs containing `golang` or the module name component (e.g., `golang-x-net` for `golang.org/x/net`)
+   - Python: search for `python3-<package>` or `python-<package>`
+3. If found: record the installed `evr`, `source` (rhel/ocp/fast_datapath), and `arch`
+
+**Version comparison:**
+- Compare the installed RPM EVR against the vulnerable version range from Step 2 using RPM EVR ordering
+- If installed version is within the vulnerable range: **vulnerable — version confirmed**
+- If installed version is at or above the fixed version: **not vulnerable — patched version installed** — skip Step 5
+- If comparison is inconclusive: **version comparison inconclusive** — proceed to Step 5
+
+**If RPM NOT found:** record "Package not found in CoreOS RPM list" and skip to Step 6 (report as not applicable).
+
+Print: `✓ Step 4 complete — RPM [found|not found], name: [rpm_name], version: [evr], source: [rhel|ocp|fast_datapath], verdict: [vulnerable|patched|inconclusive]`
+
+---
+
+### Step 5: Red Hat VEX Validation
+
+Fetch the VEX summary for each CVE:
+```bash
+python $SCRIPTS_DIR/fetch_redhat_vex.py [CVE-ID]
+```
+
+The script returns a deduped summary with every product entry showing: `status`, `cpe`, `component` (base package name), and `remediations` (RHSA URLs). Read this output carefully.
+
+**CRITICAL: The `cpe` field tells you EXACTLY which RHEL version the fix applies to. Do NOT confuse RHEL streams:**
+- `cpe:/a:redhat:enterprise_linux:9::appstream` = RHEL 9.7 (latest, NOT EUS)
+- `cpe:/a:redhat:rhel_eus:9.6::appstream` = RHEL 9.6 EUS
+- `cpe:/a:redhat:rhel_eus:9.4::appstream` = RHEL 9.4 EUS
+- `cpe:/a:redhat:openshift:4` = OCP 4 (all versions)
+- `cpe:/o:redhat:enterprise_linux:8` = RHEL 8
+
+**CoreOS uses RHEL EUS streams**, not the latest RHEL. From Step 3, `rhel_version` tells you which RHEL version CoreOS is based on (e.g., 9.6). Match against the EUS CPE for that version (e.g., `cpe:/a:redhat:rhel_eus:9.6`), NOT `cpe:/a:redhat:enterprise_linux:9`.
+
+**Step 5a — Search for RHCOS/CoreOS entry under OCP CPE:**
+In the VEX products list, look for entries where `component` contains `rhcos` or `coreos` AND `cpe` matches `cpe:/a:redhat:openshift:4` or the specific OCP version CPE. Record its status.
+
+**Step 5b — Search for the RPM under the CORRECT CPE:**
+In the VEX products list, find entries where `base_package` matches the RPM name from Step 4. Record entries for ALL CPEs, but mark which one matches the CoreOS RHEL version:
+
+1. Check `cpe:/a:redhat:openshift:4` — this is the OCP product stream status
+2. Check `cpe:/a:redhat:rhel_eus:[RHEL_VERSION]` — this is the RHEL EUS stream matching CoreOS
+3. Check `cpe:/a:redhat:enterprise_linux:9` — this is the latest RHEL 9 (NOT the same as EUS)
+
+For each match, record: `status`, `cpe`, and `remediations` (RHSA URL).
+
+**Step 5c — Determine the assessment:**
+
+| RHCOS entry | RPM under OCP CPE | RPM under RHEL EUS CPE | Assessment |
+|---|---|---|---|
+| Found (fixed) | — | — | CoreOS assessed and fixed |
+| Found (known_affected) | — | Fixed | RPM patched in RHEL EUS but CoreOS not rebuilt |
+| Missing | known_affected | Fixed | **VEX discrepancy** — RHCOS missing, RPM assessed |
+| Missing | known_affected | Not found | known_affected under OCP, no EUS fix yet |
+| Missing | Missing | Fixed | **VEX discrepancy** — RPM fixed in RHEL EUS but not tracked under OCP |
+| Missing | Missing | Missing | **VEX data gap** |
+| HTTP 404 | — | — | **No VEX coverage** |
+
+**RHSA advisory matching (when input was RHSA):**
+Compare the user-reported RHSA against the RHSA URLs in the VEX remediations:
+- If the user's RHSA appears under the RHEL EUS CPE matching CoreOS: correct fix for this CoreOS
+- If the user's RHSA appears under a DIFFERENT CPE (e.g., RHEL 9.7 instead of 9.6 EUS): wrong stream — report the correct RHSA from the matching EUS CPE
+- If no RHSA exists under the matching EUS CPE: no fix available for this CoreOS's RHEL stream
+
+Print: `✓ Step 5 complete — RHCOS VEX: [status|missing], RPM OCP: [status|missing], RPM RHEL EUS: [status|missing], severity: [severity]`
+
+---
+
+### Step 6: Final Report
+
+```markdown
+## CoreOS CVE Validation Report
+
+- **CVE ID:** [CVE-ID]
+- **OCP Version:** [OCP_VERSION]
+- **CoreOS Image:** [coreos_pullspec]
+
+- **Executive Summary:** [1-3 sentences: whether this OCP release's CoreOS is affected, VEX status, recommended action. For VEX gaps/discrepancies, include secalert@redhat.com recommendation. **When input was an RHSA:** state whether the reported RHSA is the correct fix for this CoreOS version, applies to a different version, or is not applicable.]
+
+- **OCP Release Metadata:**
+  - OCP Version: [version]
+  - Release Date: [created]
+  - Machine OS: [machine_os]
+  - CoreOS Version Scheme: [rhel_based (OCP >= 4.19) | legacy (OCP < 4.19)]
+  - CoreOS Build ID: [build_id — used for version comparison]
+  - RHEL Base: [rhel_version]
+  - Kubernetes Version: [kubernetes version]
+  - CoreOS Image: [coreos_pullspec]
+
+- **CVE Details:**
+  - Package: [name]
+  - Ecosystem: [ecosystem]
+  - Vulnerable versions: [version ranges]
+  - Sources: [MITRE, OSV, Go vuln DB]
+
+- **CoreOS RPM Analysis:**
+  - RPM found: [Yes | No — package not in CoreOS]
+  - RPM name: [name]
+  - Installed version: [evr]
+  - RPM source: [RHEL repository | OCP repository (rhaos4) | Fast Datapath]
+  - Version in vulnerable range: [Yes | No — patched | Inconclusive]
+  - Total RPMs in CoreOS: [count] ([rhel] RHEL, [ocp] OCP, [fdp] Fast Datapath)
+
+- **Red Hat VEX Status:**
+  - RHCOS component status: [fixed | known_affected | known_not_affected | under_investigation | Not assessed — missing from VEX]
+  - RHCOS CPE matched: [OCP CPE | N/A]
+  - RPM package status: [status | Not assessed]
+  - RPM CPE matched: [RHEL/OCP CPE | N/A]
+  - Red Hat Severity: [Critical | Important | Moderate | Low | N/A]
+  - RHSA Advisories: [URLs | N/A]
+  - Not-affected justification: [flag label | N/A]
+
+- **VEX Data Assessment:**
+  - VEX discrepancy: [Yes — RHCOS entry missing but RPM assessed | No]
+  - VEX data gap: [Yes — no VEX coverage | Yes — no RHCOS or RPM entry | No]
+  - Action required: [Report to secalert@redhat.com | Monitor advisories | No action | N/A]
+
+- **Reported Advisory Assessment:** [Include ONLY when the original input was an RHSA advisory ID]
+  - Reported advisory: [RHSA-ID from user input]
+  - Assessment: [Correct fix for this CoreOS version | Applies to different OCP/RHEL version — not applicable | Not applicable — CoreOS not affected | No patch available yet]
+  - Correct advisory: [RHSA-ID if different | Same as reported | N/A]
+```
+
+## Dependencies
+
+### Required MCP Servers
+- None — this skill uses bundled Python scripts, not MCP tools
+
+### Required Helper Scripts
+- `validate_input` — validates CVE ID format and OCP version
+- `fetch_cve_metadata` — queries MITRE, OSV.dev, and Go vuln DB
+- `fetch_coreos_metadata` — extracts RPM list from RHCOS release image
+- `fetch_redhat_vex` — retrieves Red Hat VEX security advisories
+- `fetch_rhsa_advisory` — resolves RHSA advisory IDs to CVE lists
+
+### Related Skills
+- `container-cve-validator` — CVE validation for standard container images
+- `cve-recon` — standalone CVE reconnaissance
+
+### Reference Documentation
+- [Red Hat CSAF VEX Data](https://security.access.redhat.com/data/csaf/v2/)
+- [MITRE CVE API](https://cveawg.mitre.org/api/cve/)
+- [OSV.dev API](https://api.osv.dev/v1/vulns/)
diff --git a/ocp-admin/skills/cve-recon/SKILL.md b/ocp-admin/skills/cve-recon/SKILL.md
new file mode 100644
index 00000000..9cd0b5f4
--- /dev/null
+++ b/ocp-admin/skills/cve-recon/SKILL.md
@@ -0,0 +1,237 @@
+---
+name: cve-recon
+description: Query MITRE, OSV.dev, and Go vulnerability database to produce a structured report of affected packages, ecosystems, and vulnerable version ranges for a CVE.
+license: Apache-2.0
+user_invocable: true
+model: inherit
+color: cyan
+---
+
+# CVE Reconnaissance
+
+## When to Use This Skill
+
+Use this skill when the user asks you to look up, describe, explain, or get details about a specific CVE — its affected packages, ecosystem, version ranges, or severity. Input is a CVE ID taken from conversation context.
+
+## Optional Output Flags
+
+The user may specify an optional output format flag:
+
+- `--format markdown` — (default) Markdown report
+- `--format json` — machine-readable JSON object
+- `--format csv` — single-row CSV with a header row
+
+Record the resolved value as `OUTPUT_FORMAT` (default: `markdown`).
+
+## Input Validation
+
+Confirm you have a CVE ID in the format `CVE-YYYY-NNNNN` (e.g., CVE-2023-38039).
+
+If the CVE ID is missing or does not match the format, ask the user to provide it. Do not proceed.
+
+## Prerequisites
+
+**Resolve scripts directory** — the helper scripts are at `../scripts/` relative to this project's root:
+```bash
+SCRIPTS_DIR="$(git rev-parse --show-toplevel)/ocp-admin/scripts/security-validation"
+test -f "$SCRIPTS_DIR/fetch_cve_metadata.py" || { echo "Error: Scripts directory not found at $SCRIPTS_DIR"; exit 1; }
+```
+
+## Workflow
+
+Do not hallucinate data — rely strictly on script outputs. If a script produces an unexpected error, report it verbatim and stop.
+
+### Steps 1-3 — Fetch CVE Metadata (single script call)
+
+Run the `fetch_cve_metadata.py` script to query all sources in one call:
+```bash
+python $SCRIPTS_DIR/fetch_cve_metadata.py [CVE-ID]
+```
+
+The script automatically queries MITRE CVE API, OSV.dev, and (if a GO-* alias is found) the Go vulnerability database. It returns merged JSON with:
+- `cve_id` — the CVE identifier
+- `description` — English CVE description from MITRE
+- `affected[]` — all affected packages, each with:
+  - `ecosystem` — Go, PyPI, npm, rpm, etc.
+  - `package` — package/module name
+  - `versions` — object with `introduced` and/or `fixed` boundaries
+  - `source` — which database provided this entry (mitre, osv, go_vuln_db)
+  - `vendor` — vendor name (from MITRE entries)
+  - `go_id` — Go vulnerability ID (from go_vuln_db entries only)
+- `aliases[]` — cross-references (GO-*, GHSA-*, etc.)
+- `errors[]` — any API failures (non-fatal; the script continues with available data)
+
+**Error handling:**
+- If `affected` is empty and `errors` contains "not found (404)": stop and report "CVE not found"
+- If `affected` is empty but no 404 error: report "No affected package data available"
+- If some sources failed but others succeeded: proceed with available data, note the errors
+
+### Step 4 — Produce output
+
+Always produce a report. Use `N/A` for any field that could not be determined.
+
+**If `OUTPUT_FORMAT` is `markdown`:**
+
+```markdown
+## CVE Reconnaissance Report
+
+- **CVE ID:** [CVE-ID]
+- **Description:** [English description from MITRE cna.descriptions; supplemented by OSV summary if MITRE description is sparse]
+
+### Data Sources
+
+| Source | Status | Record ID |
+|---|---|---|
+| MITRE CVE | [Fetched \| Error] | [CVE-ID] |
+| OSV.dev | [Fetched \| Not found \| Error] | [OSV record ID or N/A] |
+| Go vuln DB | [Fetched \| Not applicable \| Not found] | [GO-YYYY-NNNN or N/A] |
+
+**Cross-references (from OSV aliases):** [comma-separated list of aliases: GO-YYYY-NNNN, GHSA-*, etc. | None found]
+
+### Affected Packages
+
+[For each affected entry — merged from MITRE and OSV, deduplicated by package name + ecosystem:]
+
+#### [vendor] / [product]
+
+| Field | Value |
+|---|---|
+| Package name | [packageName] |
+| Ecosystem | [Go \| RPM \| PyPI \| npm \| Rust \| PHP \| Maven \| NuGet \| Unknown] |
+| Collection URL | [collectionURL or N/A] |
+| Source(s) | [MITRE \| OSV.dev \| MITRE + OSV.dev] |
+
+**Vulnerable version ranges (MITRE):**
+
+| Version | Status | Upper bound | Bound type | Version type |
+|---|---|---|---|---|
+| [version] | [affected\|unaffected] | [lessThan / lessThanOrEqual value or —] | [< \| <=] | [semver\|rpm\|custom] |
+
+Default status for unlisted versions: [defaultStatus]
+
+[If OSV provided version ranges for this package:]
+
+**Vulnerable version ranges (OSV.dev):**
+
+| Introduced | Fixed |
+|---|---|
+| [version or "0"] | [version or "not yet fixed"] |
+
+[If version ranges differ between MITRE and OSV: "Note: MITRE and OSV.dev report different version boundaries for this package. The union of both ranges is treated as the vulnerable range."]
+
+[If Go vuln DB entry was found (GO-* alias detected in OSV):]
+
+**Go vulnerability database enrichment:**
+
+- **Go vuln ID:** [GO-YYYY-NNNN]
+- **Authoritative module path:** [affected[].package.name]
+- **Vulnerable ranges (Go vuln DB):**
+
+  | Introduced | Fixed |
+  |---|---|
+  | [version or "0"] | [version or "not yet fixed"] |
+
+- **Affected packages within module:**
+  [List from ecosystem_specific.imports[].path, or N/A if absent]
+
+- **Affected symbols:**
+  [List from ecosystem_specific.imports[].symbols[], or "All exported symbols" if absent]
+
+- **Go vuln DB last modified:** [modified timestamp]
+
+### CVSS
+
+| Source | Version | Score | Severity |
+|---|---|---|---|
+| MITRE | [3.1 \| 3.0] | [baseScore] | [baseSeverity] |
+| OSV.dev | [version or —] | [score or —] | [severity or —] |
+
+[If scores differ: "Note: MITRE and OSV.dev report different CVSS scores. The higher score ([X]) is highlighted."]
+[If no CVSS data from either source: "No CVSS data available from MITRE or OSV.dev."]
+
+### References
+
+[Numbered list of deduplicated URLs from both MITRE cna.references[].url and OSV references[].url, with source noted in parentheses: (MITRE), (OSV), or (both)]
+```
+
+**Missing values rule — applies to both JSON and CSV:**
+- **JSON:** when a value is not available, not applicable, or unknown, use an empty string `""` — never use `null`.
+- **CSV:** when a value is not available, not applicable, or unknown, leave the field empty — never write the literal word `null`.
+
+**If `OUTPUT_FORMAT` is `json`:**
+
+```json
+{
+  "cve_id": "[CVE-ID]",
+  "description": "[English description]",
+  "sources": {
+    "mitre": {"status": "fetched | error", "record_id": "[CVE-ID]"},
+    "osv": {"status": "fetched | not_found | error", "record_id": "[OSV ID or empty string]", "aliases": ["GO-YYYY-NNNN", "GHSA-*"]},
+    "go_vuln_db": {"status": "fetched | not_applicable | not_found", "record_id": "GO-YYYY-NNNN | empty"}
+  },
+  "cvss": {
+    "mitre": {"version": "3.1 | 3.0 | empty", "score": 7.5, "severity": "High | empty"},
+    "osv": {"version": "3.1 | 3.0 | empty", "score": 7.5, "severity": "High | empty"}
+  },
+  "affected": [
+    {
+      "vendor": "[vendor]",
+      "product": "[product]",
+      "package_name": "[packageName]",
+      "ecosystem": "Go | RPM | PyPI | npm | Rust | PHP | Maven | NuGet | Unknown",
+      "collection_url": "[url or empty string]",
+      "source": "mitre | osv | both",
+      "default_status": "affected | unaffected",
+      "versions_mitre": [
+        {
+          "version": "[version]",
+          "status": "affected | unaffected",
+          "less_than": "[version or empty string]",
+          "less_than_or_equal": "[version or empty string]",
+          "version_type": "semver | rpm | custom"
+        }
+      ],
+      "versions_osv": [
+        {"introduced": "[ver]", "fixed": "[ver or empty string]"}
+      ],
+      "go_enrichment": {
+        "go_vuln_id": "GO-YYYY-NNNN | empty",
+        "module_path": "[authoritative module path or empty string]",
+        "ranges": [{"introduced": "[ver]", "fixed": "[ver or empty string]"}],
+        "affected_packages": ["[pkg/path]"],
+        "affected_symbols": ["[Symbol]"],
+        "last_modified": "[timestamp or empty string]"
+      }
+    }
+  ],
+  "references": [
+    {"url": "[url]", "source": "mitre | osv | both"}
+  ]
+}
+```
+
+**If `OUTPUT_FORMAT` is `csv`:**
+
+One header row followed by one data row per affected package entry:
+
+```
+cve_id,description,cvss_score_mitre,cvss_severity_mitre,cvss_score_osv,cvss_severity_osv,vendor,product,package_name,ecosystem,collection_url,source,vulnerable_versions_mitre,vulnerable_versions_osv,go_vuln_id,go_module_path,go_fixed_versions,osv_aliases
+[values — version ranges as semicolon-separated strings; description truncated to 200 chars; osv_aliases as space-separated list]
+```
+
+## Dependencies
+
+### Required MCP Servers
+- None — this skill uses a bundled Python script, not MCP tools
+
+### Required Helper Scripts
+- `fetch_cve_metadata` — queries MITRE CVE API, OSV.dev, and Go vuln DB in a single call
+
+### Related Skills
+- `container-cve-validator` — full CVE validation pipeline (uses this as Step 1)
+- `coreos-cve-validator` — CoreOS CVE validation (uses this as Step 2)
+
+### Reference Documentation
+- [MITRE CVE API](https://cveawg.mitre.org/api/cve/)
+- [OSV.dev API](https://api.osv.dev/v1/vulns/)
+- [Go Vulnerability Database](https://vuln.go.dev/)
diff --git a/ocp-admin/skills/image-inspect/SKILL.md b/ocp-admin/skills/image-inspect/SKILL.md
new file mode 100644
index 00000000..e3ec99db
--- /dev/null
+++ b/ocp-admin/skills/image-inspect/SKILL.md
@@ -0,0 +1,196 @@
+---
+name: image-inspect
+description: Fetch container image labels, validate registry ownership, resolve tag/digest via SBOM, and report the SBOM artifact reference for a Red Hat container image.
+license: Apache-2.0
+user_invocable: true
+model: inherit
+color: cyan
+---
+
+# Red Hat Container Image Inspector
+
+## When to Use This Skill
+
+Use this skill when the user asks you to inspect, describe, check metadata for, or get information about a Red Hat container image. The user may provide a tag-based or digest-based image reference. Input is taken from conversation context.
+
+## Optional Output Flags
+
+The user may specify an optional output format flag:
+
+- `--format markdown` — (default) Markdown report
+- `--format json` — machine-readable JSON object
+- `--format csv` — single-row CSV with a header row
+
+Record the resolved value as `OUTPUT_FORMAT` (default: `markdown`). Strip this flag before identifying the image reference.
+
+## Input Validation
+
+Confirm you have a fully qualified container image reference including registry, image name, and tag or digest. It must:
+- Contain at least one `/`
+- Contain only letters, digits, `.`, `-`, `_`, `/`, `:`, `@` — no spaces or shell metacharacters
+
+If the image reference is missing or invalid, ask the user to provide it. Do not proceed.
+
+## Prerequisites
+
+**Resolve scripts directory:**
+```bash
+SCRIPTS_DIR="$(git rev-parse --show-toplevel)/ocp-admin/scripts/security-validation"
+test -f "$SCRIPTS_DIR/inspect_image.py" || { echo "Error: Scripts directory not found at $SCRIPTS_DIR"; exit 1; }
+```
+The scripts handle tool checks internally (regctl, cosign) and return clear errors if tools are missing.
+
+## Workflow
+
+### Step 1 — Inspect image metadata
+
+Run the `inspect_image.py` script:
+```bash
+python $SCRIPTS_DIR/inspect_image.py [IMAGE_REFERENCE]
+```
+
+Returns JSON with `labels` (cpe, name, com.redhat.component, vendor, maintainer, org.opencontainers.image.created), `digest`, `architecture`, and `errors`.
+
+If authentication fails, run `regctl registry login registry.redhat.io` and retry.
+
+From the output, record:
+- `labels.cpe` → `product_cpe` — CPE URI identifying the Red Hat product stream
+- `labels.name` → public component name for VEX matching
+- `labels["com.redhat.component"]` → internal build name (secondary only)
+- `labels.vendor` and `labels.maintainer` → for registry ownership validation
+- `labels["org.opencontainers.image.created"]` → image build timestamp
+
+Do NOT use `version` or `release` labels to reconstruct the image tag.
+
+### Step 2 — Registry ownership check
+
+Use the `validate_input.py` output for initial classification. For non-Red Hat registries, verify `vendor` or `maintainer` from Step 1 is "Red Hat, Inc." If yes: mirrored image. If no: non-Red Hat image.
+
+### Step 3 — Input format classification
+
+The `validate_input.py` output provides `ref_format` ("tag" or "digest"). For digest-based references, tag(s) will be resolved from the SBOM.
+
+### Step 4 — SBOM extraction and tag/digest resolution
+
+Run the `download_sbom.py` script:
+```bash
+python $SCRIPTS_DIR/download_sbom.py [IMAGE_REFERENCE]
+```
+
+Returns JSON with `sbom_source` ("attestation" or "build_time"), `spdx` (full SPDX document), and `errors[]`.
+
+If SBOM is found, extract tag and digest from the `pkg:oci/` PURL in the SPDX packages. Record `SBOM_METHOD` as the `sbom_source` value.
+
+**If no SBOM found** (empty `sbom_source` or `spdx` is null): do NOT run syft — it cannot provide image tag/digest information. Instead, fall back to image labels as a **best-effort approximation**:
+- Read `version` and `release` labels from the Step 1 inspect output
+- Construct an approximate tag as `[version]-[release]`
+- Record `SBOM_METHOD` as `unavailable — tag estimated from labels (may be inaccurate)`
+- Add a caution note: "SBOM not available. Tag reconstructed from image labels which may contain inherited base image metadata. Verify against the registry."
+
+**SBOM artifact OCI reference:**
+Construct from the manifest digest:
+- Attestation: `[IMAGE_REPOSITORY]:sha256-[MANIFEST_DIGEST_HEX].att`
+- Build-time: `[IMAGE_REPOSITORY]:sha256-[MANIFEST_DIGEST_HEX].sbom`
+
+### Step 5 — Produce output
+
+Always produce a report. Use `N/A` for any label that was absent or any value that could not be resolved.
+
+**If `OUTPUT_FORMAT` is `markdown`:**
+
+```markdown
+## Red Hat Image Inspection Report
+
+- **Image Reference:** [input image reference]
+- **Registry:** [registry hostname]
+- **Registry Ownership:** [Official Red Hat registry | Red Hat image mirrored on [REGISTRY] | Non-Red-Hat image]
+- **Canonical Reference:** [registry.redhat.io/... | Same as input — already on official registry]
+- **Reference Type:** [Tag-based | Digest-based]
+- **Tag(s):** [tag from input | tag(s) resolved from SBOM pkg:oci/ PURL: [tag1, tag2, ...] | N/A — SBOM unavailable]
+- **Architecture-specific manifest digest:** [sha256:... from input | sha256:... resolved from SBOM pkg:oci/ PURL | N/A — SBOM unavailable]
+- **Image index detected:** [Yes — re-fetched linux/amd64 manifest (digest: sha256:...) | No]
+
+### Image Labels
+
+| Label | Key | Value |
+|---|---|---|
+| Public name | `name` | [value] |
+| Product CPE | `cpe` | [value] |
+| Internal build name | `com.redhat.component` | [value] |
+| Vendor | `vendor` | [value] |
+| Maintainer | `maintainer` | [value] |
+| Build timestamp | `org.opencontainers.image.created` | [value] |
+
+### SBOM
+
+- **Extraction method:** [Attestation SBOM (linux/amd64) | Attestation SBOM (re-fetched after image index detection) | Build-time SBOM (linux/amd64) | Build-time SBOM (re-fetched after image index detection) | Unavailable]
+- **SBOM artifact reference (OCI):** `[IMAGE_REPOSITORY]:sha256-[MANIFEST_DIGEST_HEX].att` (attestation) | `[IMAGE_REPOSITORY]:sha256-[MANIFEST_DIGEST_HEX].sbom` (build-time) | N/A
+- **Fetch command:**
+  ```
+  cosign download attestation --predicate-type=spdx [IMAGE_REPOSITORY]@[SBOM_DIGEST]
+  ```
+  _(substitute `cosign download sbom` if attestation is unavailable)_
+
+### Notes for CVE Validation
+
+- **VEX product stream anchor:** use the `cpe` label value as the primary product stream identifier when querying Red Hat VEX data.
+- **VEX component match field:** use the `name` label value for component-level matching in `product_tree.relationships[]`.
+- **Do NOT use** `com.redhat.component` for VEX matching — it is an internal build system name not present in VEX metadata.
+- **Do NOT use** `version` or `release` labels to reconstruct the tag — they contain base image metadata and may not reflect the actual container tag; use the tag resolved from the SBOM `pkg:oci/` PURL instead.
+```
+
+**Missing values rule — applies to both JSON and CSV:**
+- **JSON:** when a value is not available, not applicable, or unknown, use an empty string `""` — never use `null`.
+- **CSV:** when a value is not available, not applicable, or unknown, leave the field empty — never write the literal word `null`.
+
+**If `OUTPUT_FORMAT` is `json`:**
+
+```json
+{
+  "image_reference": "[input image reference]",
+  "registry": "[registry hostname]",
+  "registry_ownership": "official | mirrored | non-red-hat",
+  "canonical_reference": "[registry.redhat.io/... or same as input]",
+  "reference_type": "tag-based | digest-based",
+  "tags": ["[tag1]", "[tag2]"],
+  "digest": "[sha256:... or empty string]",
+  "image_index_detected": true,
+  "amd64_digest": "[sha256:... resolved from image index, or empty string if not applicable]",
+  "labels": {
+    "name": "[value or empty string]",
+    "cpe": "[value or empty string]",
+    "com.redhat.component": "[value or empty string]",
+    "vendor": "[value or empty string]",
+    "maintainer": "[value or empty string]",
+    "org.opencontainers.image.created": "[value or empty string]"
+  },
+  "sbom": {
+    "method": "attestation | build-time | unavailable",
+    "artifact_ref": "[IMAGE_REPOSITORY]:sha256-[MANIFEST_DIGEST_HEX].att or empty",
+    "fetch_command": "cosign download attestation --predicate-type=spdx [IMAGE_REPOSITORY]@[SBOM_DIGEST] or empty"
+  }
+}
+```
+
+**If `OUTPUT_FORMAT` is `csv`:**
+
+```
+image_reference,registry,registry_ownership,canonical_reference,reference_type,tags,digest,image_index_detected,amd64_digest,name,cpe,component,vendor,maintainer,created,sbom_method,sbom_artifact_ref,sbom_fetch_command
+[values — tags as space-separated list; sbom_fetch_command quoted if it contains commas]
+```
+
+## Dependencies
+
+### Required MCP Servers
+- None — this skill uses bundled Python scripts, not MCP tools
+
+### Required Helper Scripts
+- `inspect_image` — extracts container image metadata via regctl
+- `download_sbom` — fetches SBOM attestations from registry
+
+### Related Skills
+- `container-cve-validator` — full CVE validation pipeline (uses this for Input Validation)
+
+### Reference Documentation
+- [regctl Documentation](https://github.com/regclient/regclient)
+- [SPDX SBOM Specification](https://spdx.dev/)