MoonshotAI
Featured
Kimi-K3
Kimi K3 is an open-weight, 2.8T-parameter native multimodal agentic model with a 1M-token context window, designed for frontier coding, knowledge work, and reasoning tasks.
AI repository intelligence
FR-AI / ANALYSISWhy it is worth attention
It focuses on human decision-making for dependency alerts by judging reachability and blast radius in the context of your own application, and it deliberately avoids exploit recipes.
Who it is for
- Developers evaluating dependency alerts
- Security engineers triaging scanner or advisory findings
- Engineering managers who need dependency risk explained clearly
- Teams using skills-based automation for dependency review
Use cases
- Triage scanner or advisory findings for a specific application context
- Decide whether to upgrade, defer, or mitigate a dependency risk
- Explain dependency risk and residual risk to an engineering manager
- Plan whether a major version bump or a patch is appropriate
Strengths
- Judges reachability and blast radius in the app's context, not just raw CVSS scores
- Supports multiple ecosystems and language options via configurable parameters
- Produces a one-page risk card with exposure, severity, fix path, decision, residual risk, and test plan
- Explicitly omits exploit recipes, making it safer for defensible reporting
Considerations
- It triages existing scanner or advisory findings rather than discovering new vulnerabilities itself
- It is not intended for blind auto-merge workflows or for writing attack PoCs
- Full GHSA authoring is not a primary goal, so deeper vulnerability-database editing is out of scope
README quick start
Dependency Risk Brief
Dependency upgrade risk card: CVSS/severity, exposure, blast radius, upgrade-vs-defer.
中文简介： 依赖升级风险简报（CVSS、暴露面、升或缓）。 — 详见 README.zh.md.
What this skill does
- Triages scanner/advisory findings for your app context
- Judges reachability and blast radius
- Recommends upgrade, defer (with date), or mitigate
- Never includes exploit recipes
Install
npx skills add / --skill dependency-risk-brief
Local monorepo: skills/dependency-risk-brief/.
Options
| Option | Values | Default |
|---|---|---|
lang | en · zh · bilingual | en |
ecosystem | npm · pip · go · maven · cargo · other · multi | multi |
decision | upgrade · defer · mitigate · investigate · auto | auto |
depth | lite · standard · strict | standard |
When to use
| Use | Don't |
|---|---|
| Human decision on a dependency alert | Blind auto-merge all bots |
| Explain risk to eng manager | Write attack PoCs |
| Plan major-bump vs patch | Full GHSA authoring as main goal |
Deliverable
One-page risk card: exposure, severity, fix path, decision, residual risk, test plan.
See SKILL.md.
Example
../../output/samples/dependency-risk-brief-example-01.md
License
MIT — see LICENSE.
Related repositories
Similar projects matched by category, topics, and programming language.
xuchonglang
Featured
investing-for-beginners
A structured investing guide for Chinese beginners covering US stocks, options, and cryptocurrency, with focus on foundational concepts and risk awareness.
Krishnagangwal
Featured
CS-Fundamentals
A curated collection of Computer Science fundamentals (PDFs, notes, cheatsheets, interview question banks) for placement preparation, covering seven core subjects plus general resources.