What problem does it solve? Vulnerability scans produce findings that are hard to track over time: the same advisory gets re-reported, safe fixes are mixed with risky major upgrades, and prior accept-or-fix decisions get lost. This Skill runs osv-scanner against your repository, auto-applies only safe non-breaking fixes, files deduplicated GitHub issues for the rest, and records every decision in a committed ledger so repeat runs never re-file the same vulnerability. ## Core Features & Use Cases - Automated safe fixes: Applies patch/minor version bumps that resolve a finding, re-scans to confirm, and runs the repository validation gate before keeping the change. - Deduplicated issue filing: Searches existing open and closed GitHub issues before creating one per vulnerability ID, with severity mapped to priority labels. - Persistent triage ledger: Tracks accepted, fixed, workaround, and open statuses in memories/osv-scan-ledger.json with dated rationale notes, so decisions survive across runs. - Use Case: Run an OSV scan on an npm monorepo; two findings are auto-fixed with minor bumps, one major-only fix becomes a labeled GitHub issue, and a previously accepted advisory is skipped because its review date has not passed. ## Quick Start Use the osv-scan skill to scan this repository's dependencies for vulnerabilities, apply safe fixes, and file issues for anything unresolved.
