Perform a Linux package vulnerability audit using SecDB.
## What this tool does
Analyzes the installed packages of a Linux system-identified by OS and OS version-and returns vulnerability information plus a Markdown summary.
The audit results are based exclusively on the package list provided by the user.
## When to use this tool
Use this tool when the user wants to determine:
- whether installed packages contain known vulnerabilities
- whether a host, VM, container, or base image is affected by security advisories
- which packages require patching or upgrading
If the user does not know the valid values for `os` or `version`, first call the `linux_os` tool to retrieve the exact supported combinations.
## Inputs
- **os**: Linux distribution identifier supported by SecDB (use `linux_os` to obtain allowed values).
- **version**: OS version or codename corresponding to the selected distribution.
- **packages**: list of installed packages, **one per line**, generated using the appropriate system command:
### For RPM-based distributions (RHEL, CentOS, Rocky, Alma, SUSE)
rpm -qa --qf '%{NAME}-%{VERSION}-%{RELEASE}.%{ARCH}\n'
### For DEB-based distributions (Ubuntu, Debian)
dpkg-query -W -f='${Package} ${Version} ${Architecture}\n'
### For Alpine Linux
apk list -I
The raw output of these commands can be passed directly as the `packages` input (one package per line).
...
python3 3.12.3-0ubuntu2.1 amd64
systemd 255.4-1ubuntu8.10 amd64
tmux 3.4-1ubuntu0.1 amd64
...
## Outputs
- **report**: structured objects describing the advisories affecting the audited packages.
- **summary**: Markdown summary including total vulnerabilities, severity breakdown, and key findings.
## LLM usage guidelines
- Never guess whether a package is vulnerable-always call this tool for Linux audits.
- If `os` or `version` is unclear or missing, call `linux_os` and ask the user to choose a valid combination.
- Normalize the package list to “one entry per line” if the user provides unstructured output.
- The `summary` is already Markdown and can be shown directly.
- Use `report` when deeper technical analysis is required.
Connector
