ce-probe-depslisted

# Probe Deps **Invocation input:** scan scope and flags: $ARGUMENTS Statically audit the repository's dependency pins for **known vulnerabilities**: every exactly-pinned package the deterministic floor can parse is checked against the OSV.dev advisory database, and each hit is triaged into an evidence-bound finding. This is the SCA probe — the standard automated security control a serious team expects to exist. It complements, never duplicates, the neighbors: `/ce-probe-infra` audits manifest *misconfiguration*; `dep-guard.py` (inside the implement lane) gates *new undeclared* dependencies entering a change. This probe asks a third question: **are the versions already pinned here publicly known-bad?** ## Runtime Inputs - **Scope path** (optional): subtree to scan; default repo root. - **`--offline`** (optional): never touch the network — the floor degrades loudly and the report is explicitly labeled not-scanned. - **Repository manifests:** `requirements*.txt`, `requirements/*.txt`, `package-lock.json`, `package.json` (exact pins only). ## Execution Contract 0. **Session write lease (structural, first act).** `python3 "${CLAUDE_SKILL_DIR}/scripts/write-lease.py" --set --skill ce-probe-deps --allow 'docs/dep-audits/**'` — only the dated report + evidence are writable, and the write guard now enforces that. Last act: `python3 "${CLAUDE_SKILL_DIR}/scripts/write-lease.py" --restore-baseline`. A denied write mid-session means this contract and the action disagree — recon