dependency-auditlisted

Run the ecosystem's vulnerability audit, then do the part the scanner won't: separate exploitable, reachable advisories from transitive noise and propose the minimal upgrade that closes the real risk. The skill reads the actual lockfile, runs the native audit tool, traces each flagged package to how it's used in the codebase, and rewrites the severity in context — so a critical-rated advisory in a build-only dependency you never call doesn't outrank a moderate one on the request path. ## When to use this skill - An audit (`npm audit`, `pip-audit`, `cargo audit`, …) prints a wall of advisories and you need to know which ones to act on first. - A specific CVE or GitHub advisory landed and you want to confirm whether your usage is actually reachable. - You want the smallest safe set of version bumps — not a blanket `npm audit fix --force` that breaks the build. - A security gate is failing CI and you need to justify a documented downgrade or suppression. > [!WARNING] > A vulnerability's CVSS score rates the flaw in the abstract, not your exposure to it. Never act on severity alone — an unreachable "critical" is lower priority than a reachable "moderate" on your request path. This skill exists to make that distinction explicit. ## Instructions 1. **Locate the manifest and lockfile.** Find the dependency files (`package.json` + `package-lock.json`/`pnpm-lock.yaml`/`yarn.lock`, `requirements.txt`/`poetry.lock`/`Pipfile.lock`, `Cargo.lock`, `go.mod`/`go.sum`, `Gemfile.lock`). T