Root-causes and genuinely fixes GitHub Dependabot security alerts in Gradle/JVM projects (Android, Kotlin, Java) — not by dismissing them, but by tracing WHY the vulnerable version is still resolving and forcing a real fix. Use this whenever the user mentions Dependabot alerts, GitHub security warnings, "N vulnerabilities" on a repo, CVEs in dependencies, the GitHub security tab, dependency-graph/SBOM weirdness, or asks why alerts "won't close" / "won't refresh" / "won't auto-dismiss" even though a version bump was already made. Also use it when a fix was already attempted (e.g. a buildscript or version-catalog pin) but alerts remain open — that's the classic symptom this skill is built to diagnose.
2026-07-17