From 0b7800268654dd63651321bc0680d3756598cbfd Mon Sep 17 00:00:00 2001 From: yoni Date: Sun, 8 Nov 2026 19:27:15 +0000 Subject: [PATCH] fix(skill): walk every introducing chain before not_reached For a transitive package the caller of the affected API is the package one hop above it on each chain (body-parser for express > body-parser > qs), not the direct dependency. Inspect that package on every chain; any chain left unclear keeps the finding at imported. --- strix/skills/custom/dependency_cve_scanning.md | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/strix/skills/custom/dependency_cve_scanning.md b/strix/skills/custom/dependency_cve_scanning.md index 0e0c0702d..bc7b0a8cc 100644 --- a/strix/skills/custom/dependency_cve_scanning.md +++ b/strix/skills/custom/dependency_cve_scanning.md @@ -152,12 +152,15 @@ fi `PyYAML` → `yaml`). No hits ⇒ `not_imported`, with the search scope stated in `reachability_evidence`. For a **transitive** dependency, the check is whether application code imports it directly; if not, it is reachable only - through the direct dependency — inspect the direct dependency's own code - (its installed sources, or the class references of its jar) for the - affected API. Never referenced ⇒ `not_reached` (below), citing the - artifact you inspected; referenced ⇒ the direct dependency's call is the - usage site, continue with the symbol match from there; unclear ⇒ - `imported` when the direct dep is used at all. + through the packages that depend on it — walk every introducing chain + from the lockfile (e.g. `express > body-parser > qs`) and inspect the code + of the package one hop above the vulnerable one on each chain + (`body-parser`, not just `express`; its installed sources, or the class + references of its jar) for the affected API. No chain references it ⇒ + `not_reached` (below), citing every artifact you inspected; referenced ⇒ + that package's call is the usage site, continue the trace upward from + there; any chain unclear or not inspected ⇒ `imported` when the direct + dep is used at all. 2. **Symbol match — per CVE, not per package.** Read each CVE's own advisory (GHSA/NVD/OSV `affected[].ecosystem_specific.imports` or the advisory text) for the affected functions/classes/APIs. Search application code for