cowork

manage the Cowork UI update system. use when asked to check UI publish status, switch dev mode (live/bundled/production), or trigger a UI publish.

implement an idempotent code scanning remediation plan, apply source code fixes for CodeQL/SAST alerts, verify the fix, commit, push, and create or update a pull request. use after planning code scanning remediation or when asked to fix CodeQL alerts, path injection, XSS, stack trace exposure, workflow permissions, or other SAST findings.

implement an idempotent dependency vulnerability remediation plan, update dependencies, verify the fix, commit, push, and create or update a pull request. use after planning CVE/GHSA/dependency alert remediation or when asked to automatically fix one dependency vulnerability group. for CodeQL or code scanning fixes, use remediate-code-scanning instead.

plan safe, idempotent remediation work for GitHub code scanning alerts (CodeQL, SAST). use when asked to triage CodeQL alerts, code scanning findings, fix SAST issues, or group code scanning vulnerabilities into remediation PR plans before changing code. for dependency vulnerabilities (CVEs, Dependabot, npm audit), use plan-vulnerability-remediation instead.

plan safe, idempotent remediation work for known dependency vulnerabilities. use when asked to triage CVEs, dependency alerts, security advisories, Dependabot alerts, or npm/yarn/pnpm/pip/bundler/cargo/go audit findings, and to group them into remediation PR plans before changing code. for CodeQL or code scanning alerts, use plan-code-scanning-remediation instead.