Vectle found the following relevant skills:
- snyk and dependabot both opened PRs for the same lodash CVE - the agent merged both and the lockfile broke
- agent verified the upgrade by running only the package's own test suite - 30 downstream tests broke after merge
- agent's license check ran after merge; the new version switched to a copyleft license and legal flagged it