Menu
Plan a multi-file Rust refactor safely: investigate, plan, confirm, implement. Use before any multi-file refactor.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Write the next version entry at the top of CHANGELOG.md by summarizing all changes since the last tagged release. Use when preparing release notes.
Audit GitHub Actions workflows for efficiency and recommend fixes to reduce CI minutes and costs. Use when asked to improve CI performance.
Fix CI failures in a loop until all GitHub workflow runs on the current branch are green. Use when CI is failing and needs automated repair.
AI-powered security scanner — OWASP Top 10, CWE Top 25, KMIP authorization, FIPS gating, memory safety, side-channel, supply chain, and 20 vulnerability families. Use when asked to review code security, audit KMIP access control, or scan for vulnerabilities.
Comprehensive cryptographic audit: FIPS 140-3, BSI TR-02102, ANSSI, NIST SP 800-series compliance, algorithm allow-list, key sizes, feature-flag gating, OpenSSL provider init, key lifecycle, multi-standard matrix, and academic cryptanalysis cross-check. Use when touching crate/crypto/, algorithm selection, or key management code.
Comprehensive security audit orchestrator: invokes /security-review, /cryptography-review, /threat-model, and /standards-review in sequence. Produces a unified go/no-go report. Use for full security audit before release or after significant changes.
| name | refactor-plan |
| description | Plan a multi-file Rust refactor safely: investigate, plan, confirm, implement. Use before any multi-file refactor. |
Create a detailed, safe plan before making any code changes in this Rust codebase.
cargo commands.If the request is too ambiguous to plan safely, ask concise clarifying questions instead of editing files.
Use these at each phase checkpoint:
cargo clippy-all # zero warnings required
cargo fmt --all # formatting
cargo test -p <crate> # targeted test (preferred)
cargo test-fips # full FIPS test suite (only if needed)
cargo test-non-fips # full non-FIPS suite (only if needed)
Use cargo test -p <crate> <test_name> to run the narrowest scope first.
## Refactor Plan: [title]
### Current State
[How things work now — be specific to this codebase]
### Target State
[How things will work after — measurable outcome]
### Affected Files
| File | Change Type | Dependencies |
|------|-------------|--------------|
| `crate/foo/src/bar.rs` | modify | blocks `baz.rs`, blocked by `qux.rs` |
### Execution Plan
#### Phase 1: Types and Traits
- [ ] Step 1.1: [action] in `crate/foo/src/bar.rs`
- [ ] Verify: `cargo clippy -p foo` passes
#### Phase 2: Implementations
- [ ] Step 2.1: [action] in `crate/foo/src/impl.rs`
- [ ] Verify: `cargo test -p foo test_name`
#### Phase 3: Callers
- [ ] Step 3.1: Update callers in `crate/server/src/...`
- [ ] Verify: `cargo build --workspace`
#### Phase 4: Tests
- [ ] Step 4.1: Update unit tests
- [ ] Verify: `cargo test -p foo`
#### Phase 5: Cleanup
- [ ] Remove deprecated code
- [ ] Run `cargo fmt --all` and `cargo clippy-all`
- [ ] Final verify: `git diff --stat` — every hunk explainable by the task
### Rollback Plan
If Phase N fails:
1. `git checkout crate/foo/src/bar.rs` — restore original
2. `git stash` — save partial work for inspection
### Risks
- [Potential issue]: [mitigation]
- Trait object overhead: prefer generics if the type set is closed
- Public API change: run `rg "fn_name" --type rust` across workspace before deleting
After the plan, ask: "Shall I proceed with Phase 1?"