---
name: kesekit-fix
description: Auto-fix security vulnerabilities found in CII, AI, robot, space, and supply chain systems. Generates hardening scripts and SBOM-based vulnerability remediation. Use when "fix vulnerabilities", "apply hardening", "server hardening", "AI security fix", "robot security fix", "space security fix", "satellite hardening", "GSaaS hardening", "supply chain fix", "SBOM fix", "공급망 수정", "취약점 조치".
---

# KESE Vulnerability Auto-Fix

Generate and apply fixes based on vulnerability assessment results. Auto-selects guideline.

## Guideline Selection

| # | Guideline | Description |
|---|-----------|-------------|
| 1 | **CII Hardening** | Platform-specific hardening scripts |
| 2 | **AI Security Fixes** | AI system security hardening |
| 3 | **Robot Security Fixes** | Robot system hardening (IEC 62443, CRA, RED) |
| 4 | **Space Security Fixes** | Space system hardening (CMMC, K-RMF, NIS2, NIST IR 8401) |
| 5 | **Secure Coding Fixes** | Auto-fix vulnerable code patterns (JS/Python, 46 CWE) |
| 6 | **Zero Trust Fixes** | Zero Trust gap remediation (8 elements, 4 maturity levels, ~396 items) |
| 7 | **SW Supply Chain Fixes** | SBOM generation, vulnerability scanning, remediation (29 items) |

Zero Trust, ZTA, ZTNA, 제로트러스트, 마이크로세그멘테이션, microsegmentation, SDP, SASE, PEP/PDP, never trust always verify → **Zero Trust**
SBOM, supply chain, 공급망, C-SCRM, SCA, CycloneDX, SPDX, npm audit, pip-audit → **SW Supply Chain**

## CII Branch

Load reference from `templates/cii/` → generate hardening scripts saved to `scripts/kese-hardening/`. Check commands available in `scripts/cii/` directory.

## AI Security Branch

Load from `references/ai-security/` for overview and guidance, and `templates/ai-security/` for assessment checklists → generate security hardening code for AI pipelines, model security, API protection, LLM guardrails.

## Robot Security Branch

Load from `templates/robot-security/` → generate robot security remediation guidance for secure development, supply chain controls, IEC 62443 controls, cyber resilience planning, and wireless security.

## Space Security Branch

Load from `references/space-security/` for overview and supply chain guidance, and `templates/space-security/` for assessment checklists → generate space system hardening guidance. Fix scripts in `scripts/space-security/access-control-fix.md`, `scripts/space-security/system-security-fix.md`, `scripts/space-security/operations-fix.md`.

## Secure Coding Branch

Load from `references/secure-coding/pseudocode.md` for UNSAFE→SAFE pattern pairs. Use `templates/secure-coding/javascript.md` or `templates/secure-coding/python.md` for framework-specific fixes. Each item provides the exact code transformation (UNSAFE → SAFE) to apply.

---

## Zero Trust Branch

Load from `references/zero-trust/` for maturity model and architecture, and `templates/zero-trust/` for element-specific checklists. Generate remediation guidance based on gap analysis between current and target maturity levels. If OT/ICS detected, also load `templates/zero-trust/ot-environment.md` and `references/zero-trust/ot-guide.md`.

| Topic | Reference File |
|-------|---------------|
| Overview | `templates/zero-trust/overview.md` |
| Identity & Device | `templates/zero-trust/identity-device.md` |
| Network & System | `templates/zero-trust/network-system.md` |
| Application & Data | `templates/zero-trust/app-data.md` |
| Visibility & Automation | `templates/zero-trust/visibility-automation.md` |
| OT/ICS Environment | `templates/zero-trust/ot-environment.md` |
| ZT Architecture Reference | `references/zero-trust/overview.md` |
| Maturity Model Details | `references/zero-trust/maturity-model.md` |
| OT Deployment Guide | `references/zero-trust/ot-guide.md` |

8 core elements, ~396 items across 4 maturity levels. Standards: KISA ZT Guideline 2.0, NIST SP 800-207, CISA ZT Maturity Model.

---

## SW Supply Chain Branch

Load from `references/supply-chain/overview.md` for C-SCRM/SBOM context. Use `scripts/supply-chain/sbom-generate.md` for SBOM generation commands (Syft, CycloneDX, language-specific tools). Use `scripts/supply-chain/sbom-vuln-scan.md` for vulnerability scanning (Grype, npm audit, pip-audit, govulncheck) and license compliance checks. Reference `templates/supply-chain/sbom-checklist.md` for the 29-item remediation checklist.

Fix workflow: Generate SBOM → Scan vulnerabilities → Prioritize by CVSS → Apply patches → Verify → Update SBOM.

---

## Notes
- Always backup before applying fixes
- Test in non-production first
- Document all changes for compliance audit