daily-cve-digestlisted

# daily-cve-digest A weekday Category 2 agent. Closes the gap between "Dependabot already covers our advisories" and "actually, Dependabot misses N entire classes of signal." This skill brings the full advisory surface into view, scoped to the org's stack. ## Agent config (consumed by `scheduled-agent-runner`) ```yaml agent_name: daily-cve-digest cadence: daily schedule_hint: "weekday 07:00 local; skip weekends" source_filter: custom: cve-feeds feeds: - https://github.com/advisories/feed - https://osv.dev/list/atom - https://services.nvd.nist.gov/rest/json/cves/2.0 stack_config: ./stack.yml max_items_per_feed: 100 # daily volume; severity filtering trims verify_loadbearing: false # advisory text from NVD/GHSA is authoritative curate_findings: true # critical/high findings stage facts for memory-curator digest_template_overrides: template: cve-digest why_you_care_extra: | Per item: 1. Direct match against critical_libraries OR ecosystem-level signal? 2. Will Dependabot surface this automatically? (yes/no/partial) 3. SLA for first response + remediation per severity_actions in stack.yml ``` ## Matching logic For each incoming advisory: 1. **Ecosystem check**: does the advisory's package belong to an `ecosystem` declared `in_production: true`? 2. **Critical library check**: does the advisory's package name match an entry in `critical_libraries`? If yes, **always include** regardless of severity. 3. **Ecosystem-wide signal che