scriptoriumadmin/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-11-14 09:01:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

docs(skill): plain wording for the unclear-chain case

Browse source
This commit is contained in:
yoni 2026-11-08 19:36:51 +00:00
parent 0b78002686
commit ba5cab24c2
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
strix/skills/custom/dependency_cve_scanning.md
View file

@ -159,8 +159,9 @@ fi
references of its jar) for the affected API. No chain references it ⇒
`not_reached` (below), citing every artifact you inspected; referenced ⇒
that package's call is the usage site, continue the trace upward from
there; any chain unclear or not inspected ⇒ `imported` when the direct
dep is used at all.
there. If you could not inspect every chain, or one of them is unclear,
the package is still loaded, so the level is `imported`, never
`not_reached`.
2. **Symbol match — per CVE, not per package.** Read each CVE's own advisory
(GHSA/NVD/OSV `affected[].ecosystem_specific.imports` or the advisory
text) for the affected functions/classes/APIs. Search application code for