scriptoriumadmin/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-08-28 05:25:00 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

docs(skills): skipped symbol search must be disclosed in reachability evidence

Browse source
This commit is contained in:
Ahmed Allam 2026-08-06 13:58:44 +00:00 • committed by Ahmed Allam
parent ec07f0f68f
commit 709a7a1b39
1 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
strix/skills/custom/dependency_cve_scanning.md
View file

@ -168,9 +168,12 @@ fi
Cheap-first budgeting: the import check is one search per package — always do
it. Do the per-CVE symbol match for every CVE whose advisory names affected
symbols (they can be batched into one multi-pattern search per package);
prioritize `critical`/`high`/KEV when the budget is tight and leave the rest
at `imported`. Never let this analysis stall reporting — `unknown` with a
reason beats an unverified claim.
prioritize `critical`/`high`/KEV when the budget is tight; a CVE whose symbol
search was skipped may still be reported as `imported` (the import check is
real evidence), but its `reachability_evidence` must state that the
affected-symbol check was not performed, so a skipped search is never
mistaken for a completed one with no hits. Never let this analysis stall
reporting — `unknown` with a reason beats an unverified claim.
Anti-overclaim rules: