القائمة
Fix Python package vulnerabilities for a single uv.lock file by updating pyproject.toml and tool.uv constraint-dependencies, then regenerating the lockfile.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Generate YAML schema and documentation for dbt models, ensuring alignment with best practices and automated testing.
Review a pull request and rate it /10 on bugs, security, improvements, technical quality, and consistency with adjacent code.
Migrate Airflow DAGs from GCE (SSHGCEOperator) to GKE (CustomKubernetesPodOperator). Use when the user wants to migrate a DAG from VM-based to Kubernetes-based execution, replace SSHGCEOperator with CustomKubernetesPodOperator, convert GCE tasks to KPO tasks, or mentions GCE-to-GKE migration. Also trigger when they mention removing StartGCEOperator, DeleteGCEOperator, InstallDependenciesOperator in favor of pod-based execution.
Create pull requests that follow data team standards with proper naming conventions, commit validation, and squash-and-merge workflow. Use this skill when the user wants to create a PR, mentions pull requests, needs help with commit naming, wants to clean up commits before review, or talks about submitting work for review. Also trigger when they mention tickets like DE-XXX, HF-XXX, or BSR, or when they're working with dbt, bq_jobs, ml_jobs, or analytics code and need to get their changes reviewed.
| name | vulnerability-fix |
| description | Fix Python package vulnerabilities for a single uv.lock file by updating pyproject.toml and tool.uv constraint-dependencies, then regenerating the lockfile. |
Use this skill when you need to resolve dependency vulnerabilities within a specific path or microservice in a Python monorepo using the uv package manager.
Follow these steps exactly when this skill is activated:
pyproject.toml or uv.lock files.uv audit --output-format json > audit.json || true (or uv audit > audit.txt || true as a fallback) in the target directory.
uv audit returns exit code 1, which might raise terminal execution errors unless bypassed with || true. Redirecting to a file also prevents terminal truncation of long outputs.audit.json or audit.txt) using the view_file tool to inspect the full list of vulnerabilities.dependency.name in JSON).dependency.version in JSON).id and aliases in JSON).fix_versions in JSON).rm audit.json or rm audit.txt) once you have extracted the necessary information.For each vulnerable package, check pyproject.toml in the target directory:
If the package is listed directly in the dependencies list under [project] or [project.dependencies]:
~=), keep the original ~= constraint and append , >= FIX_VERSION (e.g., if the constraint was ~= 6.5 and the fix is 6.5.5, update it to ~= 6.5, >= 6.5.5). Do NOT update it to ~= 6.5.5 directly, as that restricts the upper bound (preventing upgrades to 6.6) and changes the developer's intended compatibility range.>= FIX_VERSION (e.g., tornado>=6.5.5).pyproject.toml to keep the project configuration clean.If the package is NOT listed directly in the dependencies list:
[tool.uv] table in pyproject.toml. If the table does not exist, create it.[tool.uv] table, locate or create the constraint-dependencies list.constraint-dependencies list in the format:
"package_name >= FIX_VERSION", # CVE-ID-1, CVE-ID-2
uv lock in the target directory to regenerate the uv.lock file with the updated constraints.uv lock fails due to dependency conflicts (or if you identify a conflict beforehand that makes the upgrade impossible to satisfy):
uv lock error output).uv audit --output-format json > audit_verify.json || true (or uv audit > audit_verify.txt || true as a fallback) in the target directory.0).rm audit_verify.json or rm audit_verify.txt).