Menu
Use when handling Dependabot PRs, CodeQL/Trivy alerts, or doing a routine dependency/CVE sweep for this repo.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use when `make ci-local` fails locally or a GitHub Actions run reports a CI failure (format, lint, line-budget, typecheck, or test errors).
Use when reviewing a diff, PR, or change set for correctness and quality before merge or handoff. For a deep security-only pass, use security-review instead.
Use when bringing this repo into compliance with a GeneFoundry fleet standard (tool-naming, response-envelope, container-hardening, versioning, MCP transport, or logging) or closing its tracking issue.
Use when preparing to tag, publish, or deploy a genefoundry-router build.
Use when reviewing genefoundry-router security before deploy, when touching auth/proxy/logging/limits config, or when answering an infosec/DSB question.
Use when changing the router's authentication or authorization — JWT/OAuth modes, verifiers, resource/audience metadata, the secure-by-default bind guard, or the no-token-passthrough boundary.
| name | dependency-cve-sweep |
| description | Use when handling Dependabot PRs, CodeQL/Trivy alerts, or doing a routine dependency/CVE sweep for this repo. |
Follow AGENTS.md first. Consolidate a repo's open Dependabot PRs into one clean PR rather than merging many.
uv lock --upgrade-package <name> (targeted) or uv lock --upgrade (full); keep uv.lock committed and --frozen in the build.uses: owner/action@<40-char-sha> # vX.Y.Z), never floating tags.py/incomplete-url-substring-sanitization test-assertion false positive, switch to exact-match assertions.severity: CRITICAL,HIGH + ignore-unfixed: true + exit-code: "1") and retain the SBOM (docs/CONTAINER-HARDENING-STANDARD-v1.md).make ci-local; patch-bump the app version; squash-merge only on green.When bumping FastMCP, verify validation-error wrapping: some 3.4.x releases re-raise argument-validation errors as fastmcp.exceptions.ValidationError, so a test asserting on a Pydantic ValidationError must walk __cause__. A version/catalog guard test may also need regenerating.
exit-code: "1" without ignore-unfixed: true — gates on unfixable base-image CVEs → self-inflicted outage.