docs(skills): require per-CVE affected-symbol matching in dependency reachability analysis

[devin-ai-integration]

Summary

When a package carries several CVEs, the agent tended to run one package-level usage check and copy the same reachability verdict/evidence onto every CVE, even though each advisory affects different symbols.

The dependency-CVE scanning skill's symbol-match step is now explicitly per CVE: match each CVE's own affected-symbol list (advisory ecosystem_specific.imports / text), never copy a sibling's verdict, and only the import check is shared per package. Budget guidance updated accordingly (batch symbol searches per package; prioritize critical/high/KEV when tight, leaving the rest at imported).

Link to Devin session: https://app.devin.ai/sessions/2fedf10aa9244f199f68727957fee746
Requested by: @0xallam

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[greptile-apps]

Greptile Summary

This documentation update makes affected-symbol reachability analysis explicitly CVE-specific while retaining a shared package import check.

• Requires each CVE to be matched against its own affected symbols.
• Prevents sibling CVEs from sharing symbol-search verdicts or evidence.
• Requires skipped symbol checks to be disclosed in reachability evidence.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
strix/skills/custom/dependency_cve_scanning.md	Clarifies per-CVE symbol matching and distinguishes skipped symbol analysis through explicit reachability evidence.

_{Reviews (2): Last reviewed commit: "docs(skills): skipped symbol search must..." | Re-trigger Greptile}

[devin-ai-integration]

@greptile