skillx-dependency-vulnerability-check-skill

name	skillx-dependency-vulnerability-check-skill
description	skillx family-level skill for SkillLearnBench task family dependency-vulnerability-check.
allowed-tools	["list_dir","read_file","write_file","python","shell"]
metadata	{"benchmark":"skilllearnbench","source_method":"skillx","source_dir":"<SOURCE_DIR>","family":"dependency-vulnerability-check","tool_profile":"qs_no_tests","disclosure":"family_input","artifact_fallback_mode":"strict","provenance":"extracted_skill_artifacts","functional_skill_count":0,"generated_at":"2026-05-22T16:07:55Z"}

SkillLearnBench Family Context

Instance-memory boundary: distill only reusable procedures. Do not write concrete task IDs, sample IDs, training filenames or paths, final answers, option mappings, URLs, named entities, dates, numeric constants, or verbatim question text from the source trajectory into any generated SKILL.md. Use placeholders such as , , , and when a rule needs a slot.

Task family: dependency-vulnerability-check

Use this skill only for this task family. Read the current instruction and visible local files before acting. Treat every rule below as a reusable procedure with placeholders tied to the current instance.

Family Plan

step 1: Read the visible instruction and inspect the workspace to identify the dependency lockfile, the required output path, the exact CSV header order, and any filtering rule on severity or CVSS. This fixes the target schema and policy before analysis.

step 2: Parse the lockfile with a dependency-aware tool to extract installed package names and resolved versions. This gives the exact third-party components that must be checked.

step 3: Run an offline package vulnerability audit and, for each reported finding, look up detailed advisory metadata in a vulnerability database. This is needed to collect standardized fields such as package, affected version, CVE, severity, CVSS, title, reference URL, and fixed version.

step 4: Normalize each finding into one row per vulnerability using the installed version from the lockfile and a fixed-version value from the advisory; use a placeholder when no fix is available. This converts mixed tool outputs into the required table format.

step 5: Filter the rows according to the instance policy, such as restricting to selected severity levels or requiring CVSS above a threshold. This ensures the report includes only vulnerabilities allowed by the prompt.

step 6: Write the final rows to the requested CSV path with the exact header sequence specified in the instruction. This produces the grading artifact in the required format.

step 7: Sanity-check that the file exists, the columns match exactly, and every row has populated evidence fields consistent with the applied filter; then repair any first concrete mismatch. This catches formatting or policy errors before finishing.

Extracted Functional Procedures

No functional SkillX procedure was recovered for this family. Follow the family plan and visible verifier contract directly.

Completion Contract

Create the artifact requested by the current instance using the visible instruction and local files. Do a lightweight local sanity check when useful. Finish with the exact completion marker required by the task.