Triage dependency findings by verified affected versions, exposure, exploit conditions, impact, and available fixes.
Instructions your experts follow when using this skill.
Use this for scanner results or a list of advisories.
For every finding capture the advisory ID, package and ecosystem, installed version, affected and fixed ranges, advisory publisher, source URL, and check time. Prefer the package maintainer or vendor advisory, then a recognised vulnerability database. Keep disputed or incomplete data marked as such.
Check whether the package is present in the shipped artifact, which service loads it, whether the vulnerable feature is enabled, who can reach the path, what data or privilege it exposes, and which controls reduce the risk. Mark unproven points unknown.
Return these fields: relevance, urgency, reason, safe target version, workaround, affected owner, validation steps, and deadline basis. Use confirmed, likely, not affected, or unknown for relevance. Severity is an input, not the result.
Never close a finding because the package is transitive or the score is low. Never call it exploitable without the required path evidence. Do not suppress or accept risk; prepare the evidence for the authorised owner.
Phrases that help your experts find this skill.