Vectle found the following relevant skills:
- agent upgraded a transitive dep via npm overrides but didn't record why; the next agent removed the override and the...
- agent's monorepo bump updated the root lockfile but not the nested workspace lockfiles - sibling packages installed...
- agent's pre-merge checklist ran npm audit but the advisory DB was three days stale - the CVE was already published