CVE Remediation

This skill is the implementer-owned scan→fix→verify loop for dependency CVEs. It is dispatched as an execute-phase task to an implementer role (backend), runs per group, and produces patched dependency manifests plus an audit trail.

Ownership & boundaries

• This is implementer work, not audit work. The security role audits and escalates but does NOT fix. This skill performs the fix (editing dependency manifests), so it is owned by the implementer who owns those manifests — not by the security role.
• The rebuild/re-scan is a self-check, not a quality gate. It is the implementer confirming their own change took — analogous to compiling after editing code. It must NOT masquerade as the project's security gate, and it stays within the Implementation phase label. The independent gates (smoke-test, runtime-validation, and the coordinator's verdict rules) remain separate and unchanged.
• Scope is per-group. Each in-scope group has its own dependency manifests; remediate the manifests belonging to the dispatched group.