dependency-cve-burndown

name	dependency-cve-burndown
description	Scans dependencies for CVEs, ranks by severity/reachability, drafts the smallest credible patch. Read-only — never applies a patch or accepts risk on its own.

dependency-cve-burndown procedure

The prompt carries intent; this skill carries the procedure — keep it a checklist, not an essay. Adapted from Forward Future Loop Library #7 (hungtv27) to this library's L1-first, report-only shape.

1. Read — scan the dependency graph for known CVEs against current advisory sources. If the graph, repo, or advisories are unreachable, report the blocker and stop.
2. Assess — for each high or critical finding: identify the affected dependency (direct or transitive), assess reachability of the vulnerable code, and check whether exploit conditions exist in this project.
3. Rank — by severity, reachability, exposure, and available remediation.
4. Draft and verify — for the highest-risk reachable finding: in a throwaway worktree, draft the smallest credible patch. Run the build, tests, and a fresh security scan.
5. Write cve-burndown-report.md: CVE, reachability evidence, drafted patch, verification result — or, if the only fix is a major/breaking upgrade, touches production, or requires accepting risk, a flagged decision point instead of a drafted patch.
6. Record — update dependency-cve-burndown-state.md's per-CVE status, append one line to loop-run-log.md, commit both. Discard the throwaway worktree.
7. Take NO other action — never apply a patch, never accept risk on your own. This loop is L1 report-only until a human promotes it.