Menu
Fetch open GitHub issues labeled "vulnerability" and open Dependabot alerts, prepare fixes for each, then present to the user for approval before committing and opening PRs.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Implement a feature from the plan that plan-feature produced under docs/plan/<feature>/, one reviewed sub-issue at a time. Use when the user wants to implement or build a feature from a docs/plan/<feature>/ plan or a planned GitHub issue.
Turn a GitHub issue into an implementation plan under docs/plan/<feature>/: a feature spec decomposed into context-window-sized sub-issues, committed as the first commit of the feature branch with a draft PR. Use when the user wants to plan a feature, decompose a GitHub issue into sub-issues, or produce an implementation plan from an issue.
Template and writing guidelines for a GitHub issue. Every issue is one of epic, feature, task, bug, or research task — the user decides the type, and each type has its own template. Non-epic types can suggest a parent epic from the project board.
Draft a GitHub issue, get explicit user approval, and file it via the `gh` CLI. TRIGGER when: user wants to file or "drop" a GitHub issue / ticket.
Check and align a repo's .claude/settings.json and CLAUDE.md with team conventions. Use when the user wants to standardize a repo, align conventions, check settings, or bootstrap Claude Code config in a new project.
Use this skill whenever writing, editing, reviewing, or refactoring TypeScript React code — components, custom hooks, state stores, forms, queries, mutations, API clients, or styling. Trigger it for any task touching a `.ts` or `.tsx` file in a React project, including when the user says "add a feature", "fix this bug", or "clean this up" inside a component or hook. Also use it for architectural questions about React codebases: where state should live, whether a component is too big, how to organize modules, when to reach for TanStack Query, Zustand, React Context, or React Hook Form.
| name | update-vulnerable-deps |
| description | Fetch open GitHub issues labeled "vulnerability" and open Dependabot alerts, prepare fixes for each, then present to the user for approval before committing and opening PRs. |
| allowed-tools | ["Bash","Read","Edit","Write","Agent","AskUserQuestion"] |
Run in parallel:
gh issue list --label vulnerability --state open --json number,title,body,labels,url --limit 50
gh api repos/$(gh repo view --json nameWithOwner --jq .nameWithOwner)/dependabot/alerts --method GET \
-q '[.[] | select(.state=="open")] | sort_by(.security_advisory.severity | if . == "critical" then 0 elif . == "high" then 1 elif . == "medium" then 2 else 3 end)'
If both sources return zero items, there is nothing to do, so stop.
Present a numbered summary table to the user, sorted by severity:
| # | Source | Severity | Title | Detail |
|---|
Ask the user which items to fix. Default suggestion: all of them.
Note: tools are configured to avoid releases younger than 7 days. Add an exclusion if necessary to install a fixed release. Review exclusions and remove ones that according to git blame were added more than 7 days ago.
By ecosystem:
mise use tool@version, use mise lock to update mise.lockpnpm, with overrides in top-level package.json if necessarypinactmise controller:scan:govulncheck to verify