scriptoriumadmin/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-11-14 09:01:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

skills: a loaded package is never not_applicable

Browse source
This commit is contained in:
yoni 2026-11-09 02:25:28 +00:00 • committed by Ahmed Allam
parent 4b19046320
commit 9ebeffbc74
1 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
strix/skills/custom/dependency_cve_scanning.md
View file

@ -141,6 +141,13 @@ so finish the analysis before you file.
blob, a private bundle with no source) and nothing you can inspect reaches
it. Evidence: the search scope and the negative result.
A loaded package is never `not_applicable`: once the shipped code imports or
links it, each advisory is `reachable` or `not_reachable` by its own path
(an unused server mode of a client-only `ws` import is `not_reachable`). The
only `not_applicable` cases for a loaded package are a patched or unaffected
installed copy and a platform this code does not run on. Sibling advisories
on one package share the "loaded or not" fact and differ only in the symbol.
The verdict is per CVE, not per package. Sibling CVEs on one package usually
affect different symbols or modes (one hits a parser, another a header
check): run the check against each advisory's own affected functions and