Menu
Handle Trivy CVE findings by adding entries to .trivyignore.yaml when no upstream fix is available. Do NOT use npm overrides to work around transitive dependency CVEs — they break cross-platform lockfile entries (e.g. rollup native binaries).
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Audit that docs/rbac-permission-matrix.md matches the RBAC catalog in code (roles, permissions, and grants in rbac.constants.ts and api-contracts permissions.ts). Reports every mismatch.
Generate CRUD boilerplate (backend NestJS controller/service/module/guard/policy/factory/routes/e2e + frontend Redux slice/thunks/selectors/middleware/spi/api) from a given entity file and a list of methods.
Run the last steps before ending a feature. Shows a form where you can check/uncheck which final steps to run — update changelog, create a branch, run tests-parallel, create a PR — then executes the selected steps in that order.
Create a GitHub issue on bayesimpact/bayes-platform from a free-text description. Drafts a clear title and structured body, picks appropriate labels, and posts it via the gh CLI, returning the issue URL. Optionally enriches the issue with context from the current codebase.
Suggest a Conventional Commits message for the last changes without committing. Analyzes the current diff and returns a ready-to-use commit name.
Run Trivy vulnerability scan on Docker images (API, CPU workers, GPU workers). Builds images, scans for CRITICAL/HIGH CVEs, and reports findings.
Based on SOC occupation classification
| name | trivy-ignore |
| description | Handle Trivy CVE findings by adding entries to .trivyignore.yaml when no upstream fix is available. Do NOT use npm overrides to work around transitive dependency CVEs — they break cross-platform lockfile entries (e.g. rollup native binaries). |
When Trivy (or a CI security scan) reports CVEs in JS dependencies with no clear upstream fix, add them to .trivyignore.yaml with a short expiry.
Never use npm overrides to force-patch transitive dependency versions. Overrides cause npm install to regenerate the lockfile for the current platform only, dropping cross-platform optional native binaries (e.g. @rollup/rollup-linux-x64-gnu). This breaks CI/Vercel builds on Linux.
Prefer .trivyignore.yaml with a short expiry (30-60 days) for CVEs blocked on upstream package maintainers.
Only apply direct fixes (e.g. npm audit fix without --force) if they don't introduce breaking changes.
Read the current .trivyignore.yaml file at the repo root.
For each CVE to ignore, add an entry with:
id: the CVE identifier (e.g. CVE-2026-33671)expired_at: 30-60 days from today (format: YYYY-MM-DD)reason: a short explanation — which package, why no fix is available, what's blocking upstreamUse the Edit tool to append the new entries under the vulnerabilities: key.
Verify the YAML is valid by checking indentation matches existing entries (2-space indent, dash-prefixed list items).
- id: CVE-2026-33671
expired_at: 2026-06-01
reason: "picomatch — no upstream fix available in transitive deps (jest, vite, angular-devkit)"