Starter kits

dependency-cve-burndown — the reachability-ranked CVE fixer

Scans dependencies for known CVEs, ranks by severity, reachability, exposure, and available remediation, and drafts the smallest credible patch for the…

Scans dependencies for known CVEs, ranks by severity, reachability, exposure, and available remediation, and drafts the smallest credible patch for the highest-risk reachable one. Never applies a major/breaking upgrade, touches production, or accepts risk without asking first.

Category: F · Security · Heartbeat: schedule (daily) · Level: L1 (report-only, drafts-not-applies) · Cost: Medium

Source: Loop #7, "The dependency-CVE burndown loop," from Forward Future's Loop Library, original prompt by hungtv27 (@hungtv27).

Quickstart

1. Read LOOP.md — the six parts, the prompt, the limits, the three stops,
   and the source's verbatim prompt.
2. dependency-cve-burndown-state.md is your spine — already committed with
   an empty per-CVE register.
3. Claude Code: point a daily Routine at .claude/skills/loop-task/SKILL.md.
   OpenCode: rename opencode.json.example → opencode.json, add the
   AGENTS.md line, wire skills/loop-task.md into a cron + wrapper script.
4. Rehearse once, by hand, before the schedule ever fires:
   "Run the dependency-cve-burndown skill now, exactly as the schedule
   would."
5. Grade the rehearsal with the loop-verifier agent — it re-runs build,
   tests, and the security scan itself, and confirms the reachability
   assessment is evidence-backed. PASS → arm the schedule. FAIL → fix the
   skill, never the report.

What's in this kit

File	Role
`LOOP.md`	the definition — six parts, prompt, limits, ownership, three stops
`dependency-cve-burndown-state.md`	the spine — per-CVE reachability, patch drafts, verification results, decision points
`loop-budget.md`	caps: 20 runs/day, 300k tokens/day — added by this library; the source specified none
`loop-constraints.md`	the constitution — never applies a patch, never accepts risk alone
`loop-run-log.md`	append-only, one line per beat
`.claude/skills/loop-task/SKILL.md`	the procedure (Claude Code)
`.claude/agents/loop-verifier.md`	the read-only reviewer — re-verifies patches and reachability claims
`opencode.json.example` · `skills/loop-task.md`	the OpenCode twin — same skill text, cron + wrapper heartbeat

Loop Ready checklist

Provable success condition — the source's own spec, verbatim: "no exploitable high or critical dependency CVE remains without an explicit decision"
Run limit — 20 runs/day (added by this library)
Spine written first, committed empty
Report-only (L1) start — drafts patches in a throwaway worktree, applies nothing
Human gate placed — named directly in the source: "ask before major or breaking upgrades, production changes, or accepting risk"
One log line per beat, no silent runs
Kill switch — loop-pause-all in loop-budget.md

How this relates to the course

This kit uses Forward Future's Loop #7 almost unmodified — its own prompt already specifies a stopping condition as a spec, a rank-then-patch-then- verify body, and an explicit human gate ("ask before major or breaking upgrades, production changes, or accepting risk"), which is exactly this course's own principle that guarantees belong in the harness where the model must choose to follow a rule (safety). This library's only real additions are worktree isolation for candidate patches (Step 8) and L1-first shipping (kit-state.md; CLAUDE.md rule 4).

Full attribution: resources/sources.md.