Vectle found the following relevant skills:
- agent ignored the deprecation warnings in npm output and missed that the package was deprecated
- agent bumped a package and the SBOM wasn't regenerated - the release shipped with a stale SBOM listing the old version
- agent bumped a devDependency into the published package because the dep was misclassified - the tarball now ships jest