palarran-security-cve

原文涵盖的主题

• CVE applicability audit

Read the profile guide, dated sources and retrieval gaps, shared audit/evidence contract, domain contracts, decision memory, global memory and context retrieval. Resolve actual target AGENTS, private INDEX/ADRs and languages.docs before generated artifacts. /palarran:security:cve {scope?} produces a finite inventory/advisory review; use actual project context for omitted scope. --plan is offline local inspection and inert planning only, without search-provider/remote/application/scanner execution. Default audit reads existing local evidence and public primary sources. No scanner installs/runs, dependency resolution/hooks, image pulls, fixes, exploits, paid enrollment/calls or source uploads are implied. 1. Inventory first. Pin revision/dirty snapshot and lockfile hashes; distinguish declared/locked/built/installed/deployed versions and direct/transitive/optional/dev contexts. Capture exact ecosystem/package, runtime/toolchain, image digest/platform and full OS/vendor build/backport evidence where available. A range, checksum, import name, floating tag or Dockerfile does not establish running identity. Missing data stays unknown. 2. Fresh search. Discover actual tools. Use callable

这里只展示节选，请以完整原文和当前要求为准。