Menú
Scans dependencies for CVEs, ranks by severity/reachability, drafts the smallest credible patch. Read-only — never applies a patch or accepts risk on its own.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
| name | dependency-cve-burndown |
| description | Scans dependencies for CVEs, ranks by severity/reachability, drafts the smallest credible patch. Read-only — never applies a patch or accepts risk on its own. |
The prompt carries intent; this skill carries the procedure — keep it a checklist, not an essay. Adapted from Forward Future Loop Library #7 (hungtv27) to this library's L1-first, report-only shape.
cve-burndown-report.md: CVE, reachability evidence, drafted
patch, verification result — or, if the only fix is a major/breaking
upgrade, touches production, or requires accepting risk, a flagged
decision point instead of a drafted patch.dependency-cve-burndown-state.md's per-CVE status,
append one line to loop-run-log.md, commit both. Discard the throwaway
worktree.Reviews pending PRs, excludes stale/unfinished work, combines the rest into a release batch built from main. Read-only — reports the batch, never actually releases.
Writes a scoped spec packet for one ticket, reviewed by a genuinely independent adversarial pass that also regression-checks prior findings. Read-only outside the draft — never writes the canonical spec.
Defines every required outcome and its evidence before acting on long-running work, then audits each requirement as proved/weak/missing/ contradicted. Only run when explicitly asked for a completion audit.
General-purpose harness for scheduled repo work — stage in an isolated worktree, verify with a genuinely separate second session, ship only after a pass. Read-only — reports, never delivers.
Runs an adversarial review cycle against a PR (Claude implements/fixes, Codex or a subagent stand-in reviews), up to 5 iterations. Read-only on the real PR — drafts fixes, never pushes them.
Turns a ticket or bug report into a review-ready patch. Read-only — reproduces, roots out the cause, drafts a fix, reports it. Never opens a PR, never folds in unrelated refactors.