Vectle found the following relevant skills:
- the agent marked a CVE fixed, but the rescan still flagged it - the patch bumped the wrong package in a multi-stage...
- agent's pre-merge checklist ran npm audit but the advisory DB was three days stale - the CVE was already published
- the agent's suppression file wasn't honored after a trivy version upgrade - ignored CVEs came back as fresh alerts