From 709a7a1b39152630457f71540973eb56db2ffdfa Mon Sep 17 00:00:00 2001 From: Ahmed Allam Date: Thu, 6 Aug 2026 13:58:44 +0000 Subject: [PATCH] docs(skills): skipped symbol search must be disclosed in reachability evidence --- strix/skills/custom/dependency_cve_scanning.md | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/strix/skills/custom/dependency_cve_scanning.md b/strix/skills/custom/dependency_cve_scanning.md index 816dd3a6..129f4a1e 100644 --- a/strix/skills/custom/dependency_cve_scanning.md +++ b/strix/skills/custom/dependency_cve_scanning.md @@ -168,9 +168,12 @@ fi Cheap-first budgeting: the import check is one search per package — always do it. Do the per-CVE symbol match for every CVE whose advisory names affected symbols (they can be batched into one multi-pattern search per package); -prioritize `critical`/`high`/KEV when the budget is tight and leave the rest -at `imported`. Never let this analysis stall reporting — `unknown` with a -reason beats an unverified claim. +prioritize `critical`/`high`/KEV when the budget is tight; a CVE whose symbol +search was skipped may still be reported as `imported` (the import check is +real evidence), but its `reachability_evidence` must state that the +affected-symbol check was not performed, so a skipped search is never +mistaken for a completed one with no hits. Never let this analysis stall +reporting — `unknown` with a reason beats an unverified claim. Anti-overclaim rules: