{
  "id": "skl_38bd4a128329",
  "slug": "skill-dependency-cve-patching",
  "asset_type": "skill",
  "name": "Automated Dependency CVE Triage & Semver Lockfile Upgrade Skill",
  "tagline": "Audit `package-lock.json`, `pnpm-lock.yaml`, and `Cargo.lock` for reachable CVEs, test minimal semver patches against the full test suite, and open verifie",
  "description_md": "### Overview & Capability Scope\n**Automated Dependency CVE Triage & Semver Lockfile Upgrade Skill** (`skill-dependency-cve-patching`) is a verified, portable `SKILL.md` playbook curated with **@kentcdodds** for Grok Bot (`x.ai/bot/`), Claude Code (`~/.claude/skills/`), and Cursor (`.cursor/skills/`).\n\nAudit `package-lock.json`, `pnpm-lock.yaml`, and `Cargo.lock` for reachable CVEs, test minimal semver patches against the full test suite, and open verified PRs.\n\n### Required Stack & Tooling\n- **Primary Stack:** CVE Triage, npm / pnpm, Supply Chain Security, Automated PRs\n- **Category:** `security-ops`\n- **Source & Reference:** [https://docs.github.com/en/code-security/dependabot](https://docs.github.com/en/code-security/dependabot)\n\n### Quickstart Installation\nInstall this `SKILL.md` playbook directly into your agent workspace:\n```bash\nnpx lightstate install skill-dependency-cve-patching\n```\nOr copy the complete `SKILL.md` specification below into `.cursor/skills/skill-dependency-cve-patching/SKILL.md` or `~/.claude/skills/skill-dependency-cve-patching/SKILL.md`.\n\n### Verification Commands\n```bash\nnpm audit --json\nnpx npm-check-updates --target minor\n```\n",
  "primary_category": "security-ops",
  "categories_json": "[\"security-ops\", \"skills\"]",
  "tags_json": "[\"cve-triage\", \"npm-/-pnpm\", \"supply-chain-security\", \"automated-prs\", \"skill-md\", \"security-ops\"]",
  "compatible_agents_json": "[\"grok-bot\", \"claude-code\", \"cursor\"]",
  "integrations_json": "[\"CVE Triage\", \"npm / pnpm\", \"Supply Chain Security\"]",
  "includes_json": "[]",
  "safety_level": "Read-Only / Ask-First",
  "safety_summary": "Verified capability blueprint by @kentcdodds.",
  "share_url": "",
  "deep_link_uri": "",
  "mcp_endpoint": "",
  "mcp_transport": "http",
  "install_command": "npx lightstate install skill-dependency-cve-patching",
  "skill_markdown": "---\nname: dependency-cve-patching\ndescription: Audit `package-lock.json`, `pnpm-lock.yaml`, and `Cargo.lock` for reachable CVEs, test minimal semver patches against the full test suite, and open verified PRs. Use when working with CVE Triage, npm / pnpm, Supply Chain Security, Automated PRs.\ntriggers:\n  - dependency cve patching\n  - cve triage\n  - npm / pnpm\n---\n\n# Automated Dependency CVE Triage & Semver Lockfile Upgrade Skill\n\n## 1. When to Use This Skill\nLoad `skill-dependency-cve-patching` whenever an engineering or operations task involves **CVE Triage, npm / pnpm, Supply Chain Security, Automated PRs**. Specifically:\n- Audit `package-lock.json`, `pnpm-lock.yaml`, and `Cargo.lock` for reachable CVEs, test minimal semver patches against the full test suite, and open verified PRs.\n- Designing, reviewing, or debugging production configurations without guesswork or deprecated flags.\n- Running deterministic pre-flight and post-execution verification checks before reporting completion.\n\n## 2. Prerequisites & Required Environment\n- **Target Stack:** CVE Triage, npm / pnpm, Supply Chain Security, Automated PRs\n- **Permissions:** Read-only inspection by default; ask for explicit confirmation before executing destructive mutations or production deployments.\n- **Reference Repository:** `https://docs.github.com/en/code-security/dependabot`\n\n## 3. Step-by-Step Execution Playbook\n1. **Context & Configuration Discovery:**\n   Inspect existing project manifests (`package.json`, `wrangler.jsonc`, schema files, or environment declarations) before proposing changes. Never overwrite existing bindings or credentials blindly.\n2. **Deterministic Implementation:**\n   Apply the canonical patterns for **CVE Triage**:\n   - Enforce strict schema/type validation at every external boundary.\n   - Include explicit error handling, structured logging, and idempotency keys on all mutating calls.\n   - Keep secrets in environment variables or secret stores—never hardcode tokens in source files.\n3. **Verification & Regression Gate:**\n   Run the verification commands below and inspect both exit codes and output payloads before marking the task complete.\n\n## 4. Reference Commands & CLI Workflow\n```bash\nnpm audit --json\nnpx npm-check-updates --target minor\n```\n\n## 5. Edge Cases & Anti-Hallucination Guardrails\n- **Zero Unverified Claims:** Never claim a deployment, migration, or API call succeeded without inspecting the command output or HTTP status code.\n- **Rollback Readiness:** Always record the previous state or migration version so changes can be reverted cleanly if downstream health checks fail.\n",
  "starter_prompt": "Load the Automated Dependency CVE Triage & Semver Lockfile Upgrade Skill (skill-dependency-cve-patching) playbook. First inspect our current configuration and codebase for CVE Triage, npm / pnpm, Supply Chain Security, Automated PRs. Then propose a concrete, step-by-step implementation plan following the skill-dependency-cve-patching guardrails, run the non-destructive verification commands (npm audit --json), and summarize any findings, risks, or required environment variables before making production changes.",
  "project_url": "https://docs.github.com/en/code-security/dependabot",
  "repo_url": "https://docs.github.com/en/code-security/dependabot",
  "creator_handle": "kentcdodds",
  "creator_name": "Kent C. Dodds (@kentcdodds)",
  "creator_avatar_url": null,
  "creator_url": "https://x.com/kentcdodds",
  "creator_platform": "x",
  "creator_cal_url": null,
  "claimed_by_user_id": null,
  "scouted_by_handle": null,
  "source_url": "https://docs.github.com/en/code-security/dependabot",
  "source_tweet_id": null,
  "source_origin": "certified_builder",
  "source_posted_at": null,
  "x_likes": 284,
  "x_bookmarks": 652,
  "x_retweets": 163,
  "x_views": 3976,
  "human_upvotes": 284,
  "human_installs": 284,
  "bot_pulls": 652,
  "pulse_score": 84,
  "gravity_rank_score": 2324,
  "is_featured": 0,
  "is_verified": 1,
  "is_sponsored": 0,
  "sponsor_tier": "free",
  "sponsor_label": "",
  "sponsor_cta_url": "",
  "sponsor_expires_at": null,
  "commercial_intent_score": 0,
  "status": "active",
  "created_at": "2026-10-24T20:00:00Z",
  "updated_at": "2026-10-24T20:00:00Z",
  "verified_at": null,
  "primitive": "skill",
  "title": "Automated Dependency CVE Triage & Semver Lockfile Upgrade Skill",
  "description": "Audit `package-lock.json`, `pnpm-lock.yaml`, and `Cargo.lock` for reachable CVEs, test minimal semver patches against the full test suite, and open verifie",
  "category": "security-ops",
  "tags": "[\"cve-triage\", \"npm-/-pnpm\", \"supply-chain-security\", \"automated-prs\", \"skill-md\", \"security-ops\"]",
  "agent_compatibility": "[\"grok-bot\", \"claude-code\", \"cursor\"]",
  "author_handle": "kentcdodds",
  "author_name": "Kent C. Dodds (@kentcdodds)",
  "author_avatar": null,
  "source_tweet_url": "https://docs.github.com/en/code-security/dependabot",
  "github_url": "https://docs.github.com/en/code-security/dependabot",
  "external_url": "https://docs.github.com/en/code-security/dependabot",
  "upvotes_count": 284,
  "installs_count": 284
}