Calypso security alerts

Use this skill to guide a dependency-security scan for Automattic/wp-calypso.

This is an advisory workflow. Do not run shell commands from this skill. Read the playbook, explain the scan steps, and report the exact commands an operator should run.

Inputs

Accept any of these:

• no input: scan the current queue
• PR URL or PR number: inspect that PR against the alert state
• alert number, GHSA, CVE, or package name: start from that alert or dependency

Run from the repository root.

Workflow