From ba5cab24c29bd6dd326a5fcbf4d6f46e5da182e4 Mon Sep 17 00:00:00 2001 From: yoni Date: Sun, 8 Nov 2026 19:36:51 +0000 Subject: [PATCH] docs(skill): plain wording for the unclear-chain case --- strix/skills/custom/dependency_cve_scanning.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/strix/skills/custom/dependency_cve_scanning.md b/strix/skills/custom/dependency_cve_scanning.md index bc7b0a8cc..3ee61b58c 100644 --- a/strix/skills/custom/dependency_cve_scanning.md +++ b/strix/skills/custom/dependency_cve_scanning.md @@ -159,8 +159,9 @@ fi references of its jar) for the affected API. No chain references it ⇒ `not_reached` (below), citing every artifact you inspected; referenced ⇒ that package's call is the usage site, continue the trace upward from - there; any chain unclear or not inspected ⇒ `imported` when the direct - dep is used at all. + there. If you could not inspect every chain, or one of them is unclear, + the package is still loaded, so the level is `imported`, never + `not_reached`. 2. **Symbol match — per CVE, not per package.** Read each CVE's own advisory (GHSA/NVD/OSV `affected[].ecosystem_specific.imports` or the advisory text) for the affected functions/classes/APIs. Search application code for