What problem does it solve? Dependency vulnerability alerts from Dependabot, audit tools, and security advisories arrive scattered and unverified, making it hard to turn them into safe, reviewable remediation work without duplicating existing PRs or mixing unrelated upgrades. ## Core Features & Use Cases - Finding Normalization and Verification: Collects CVE/GHSA findings from Dependabot alerts or audit tools (npm, pip, cargo, go, bundler) and checks manifests and lockfiles to confirm each vulnerability is still present. - Idempotent Grouping: Groups findings into coherent remediation units with stable group IDs, branch names, and PR markers, while detecting existing Dependabot/Renovate/manual PRs that already cover a finding. - Epic Generation: Creates or updates a standard vulnerability remediation epic in docs/epics/ with a remediation inventory table, success criteria, and child feature checklist. - Use Case: After a Dependabot alert flags a vulnerable lodash version, run this Skill to verify the lockfile state, check for an open fix PR, and produce an epic grouping all npm findings into focused remediation features. ## Quick Start Plan remediation for the current Dependabot alerts in this repository and create a vulnerability remediation epic under docs/epics.
