forkless/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-08-17 09:29:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

docs(skills): skipped symbol search must be disclosed in reachability evidence

Browse Source
This commit is contained in:
Ahmed Allam
2026-08-06 17:06:00 +03:00
committed by Ahmed Allam
parent ec07f0f68f
commit 709a7a1b39
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
strix/skills/custom/dependency_cve_scanning.md
+6 -3
View File
@@ -168,9 +168,12 @@ fi
Cheap-first budgeting: the import check is one search per package — always do
it. Do the per-CVE symbol match for every CVE whose advisory names affected
symbols (they can be batched into one multi-pattern search per package);
prioritize `critical`/`high`/KEV when the budget is tight and leave the rest
at `imported`. Never let this analysis stall reporting — `unknown` with a
reason beats an unverified claim.
prioritize `critical`/`high`/KEV when the budget is tight; a CVE whose symbol
search was skipped may still be reported as `imported` (the import check is
real evidence), but its `reachability_evidence` must state that the
affected-symbol check was not performed, so a skipped search is never
mistaken for a completed one with no hits. Never let this analysis stall
reporting — `unknown` with a reason beats an unverified claim.
Anti-overclaim rules: