// Use a validated tooling downgrade when Dependabot flags an unpatchable transitive vulnerability in build-only dependencies.
Excel CLI automation skill for Windows workbooks. Use when a coding agent needs token-efficient, scriptable, or unattended Excel automation via excelcli commands. Best for CI/CD, scheduled jobs, batch processing, PowerShell workflows, and bulk workbook edits. Supports Power Query, DAX, PivotTables, Tables, Ranges, Charts, VBA, Data Models, screenshots, and formatting. Triggers: excelcli, Excel CLI, command line, batch, script, automation, CI/CD, scheduled, PowerShell, unattended, coding agent, workbook processing.
Excel MCP Server skill for Windows workbook automation. Use when an assistant needs rich MCP tools to create, inspect, modify, format, or analyze Excel files. Supports Power Query (M), Data Model/DAX, PivotTables, Tables, Ranges, Charts, Slicers, formatting, screenshots, VBA macros, connections, and calculation mode. Triggers: Excel, spreadsheet, workbook, xlsx, xlsm, Power Query, DAX, PivotTable, chart, dashboard, VBA, MCP.
{what this skill teaches agents}
{what this skill teaches agents}
Catch packaging-script regressions by asserting the real script exit path and current overlay surface.
Keep generated MCP schemas strict-client compatible by avoiding nullable enum signatures.
| name | dependabot-tooling-downgrade |
| description | Use a validated tooling downgrade when Dependabot flags an unpatchable transitive vulnerability in build-only dependencies. |
| domain | dependency-management |
| confidence | medium |
| source | earned |
Use this when a Dependabot or npm audit failure comes from a dev-only packaging/build tool and the current major line has no viable patched transitive path.
npm install or npm audit.vscode-extension moved from @vscode/vsce ^3.7.1 to ^2.25.0 after Dependabot showed the 3.x line was stuck on @azure/msal-node -> uuid@^8.3.0; npm audit and npm run package both passed afterward.@vscode/vsce 3.9.1 still reopened the same vulnerable @azure/identity -> @azure/msal-node -> uuid chain. The correct move was to keep ^2.25.0, refresh the lockfile, and prove npm audit plus npm run package still passed.npm audit while skipping the real release/package command.