# Dependency Vulnerability Triage

> Triage a stream of Dependabot / Snyk / GitHub advisory alerts: filter by reachability and exploitability, decide upgrade vs mitigate vs accept, and route through the normal PR + approval flow.

- Skill: `poly-gents/dependency-vulnerability-triage` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add poly-gents/dependency-vulnerability-triage`
- Raw SKILL.md: https://api.skillmd.com/api/skills/poly-gents/dependency-vulnerability-triage/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: poly-gents (https://skillmd.com/u/poly-gents)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/poly-gents/dependency-vulnerability-triage

---


# Dependency vulnerability triage

Most dependency alerts are noise. Some are five-alarm fires. Triage them with this loop so neither extreme dominates your week.

## When to run

- A new Dependabot alert lands.
- A scheduled Snyk scan reports new findings.
- A GitHub advisory references a dependency you ship.
- A customer or security partner files a CVE-shaped ticket.

## The triage loop

1. **Identify.** Pull the alert (`github_dependabot_alerts` or `snyk_list_issues`). Record CVE id, package, installed version, fixed version (if any), CVSS, and affected repos.
2. **Filter by reachability.** Is the vulnerable code path called from your runtime? Use `agent_filesystem_search` to find imports. Unreachable = lower priority.
3. **Filter by exploitability.** Is the input an attacker can actually reach (HTTP body, file upload, third-party callback)? Or is it internal-only?
4. **Decide.**
   - **Upgrade** when a fixed version exists and the upgrade is low-risk. Open a PR via `github_create_pull_request` and run `production-validation`.
   - **Mitigate** when no fix exists but you can sandbox / WAF-rule / disable the feature. Document the mitigation.
   - **Accept** when reachability + exploitability are both low. Write the acceptance with reasoning into the security log; auto-snooze the alert with the same reasoning, never blind-snooze.
5. **Track.** File a planning task (`jira_create_task`) per finding so the decision is auditable later.

## Severity policy (defaults)

- Critical, reachable, exploitable: page on-call via `pagerduty`, fix-forward within 24h.
- High, reachable: PR within 5 business days.
- Medium / low: batch into a weekly upgrade PR.
- Anything in customer-data or auth paths is one severity higher than the CVSS says.

## Anti-patterns

- Auto-merging Dependabot PRs without `production-validation`.
- Snoozing alerts without a written acceptance rationale.
- Treating a reachability-unknown alert as "no big deal".