Walk through the gotchas properly. Sharp surviving a Next.js bump and the advisories npm audit misses both read like things found by getting it wrong first. Did any of those turn up after you'd started trusting the checker's exit code?
Thanks, Adam. Both came before the skill existed. I hit them while writing my Next.js security update guide, and the skill just packages what I learned there. npm audit didn't flag the October advisories for me, which is why the skill compares installed versions against the advisory table instead of trusting it. The sharp one showed up when I patched a 15.x app to 15.5.28: the lockfile kept sharp on 0.34.x, so the image optimizer was still exposed until I ran npm update sharp. That's the whole case for a Gotchas section. If the agent can't guess it and you only learn it by getting it wrong, it belongs in the skill.