task-from-snyklisted

# Task from Snyk ## When to use this skill The user typed `/tcgflow-task-from-snyk` or said: *"create tasks from Snyk"*, *"what's new in Snyk?"*, *"process the latest vulnerabilities"*. Requires the Snyk MCP to be configured (see `.tcgstackflow/config.yaml` `mcp.optional` and Snyk's MCP setup docs). ## Procedure 1. **Query the Snyk MCP** for current findings on this project (or each `projects[].path` for multi-project workspaces). Default filter: - **CRITICAL + HIGH severity** are auto-tasked. - **MEDIUM + LOW** are listed in the task's `Open Questions` section but not auto-subtasked unless the user says "include all". 2. **Dedup against existing tasks.** Search `tasks/active/`, `tasks/completed/`, and `tasks/archive/` for prior Snyk-derived tasks (look for `SEC-…` or `SNYK-…` IDs). If a finding maps to an archived task with an `accepted-risk` decision recorded in `governance.md`, do **not** recreate — surface the existing decision and ask whether to revisit. 3. **Group findings** by **vulnerable package** — one task per package, not per advisory. A single package often has multiple CVEs that resolve with the same upgrade; bundling them as subtasks of one task matches reality. 4. **Generate one task per group:** - **Task ID:** `SEC-{YYYY-MM-DD}-{package-slug}` (e.g. `SEC-2026-05-31-axios`). Use kebab-case for `{package-slug}`. - **Status:** `PLANNED`. - **Risk section:** any CRITICAL finding → list as `CRITICAL` (upgrade requires rollback plan per `gover