Menu
Review Dependabot PRs updating GitHub Actions workflows/actions, with a security-focused upstream diff check before commenting.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Comprehensive knowledge of Fedi's testing infrastructure for UI code (utilities, mock builders, conventions, and patterns) — use this when reading, writing or running unit/integration/e2e tests
Use when changing, adding, or consuming Fedi remote feature flags across the bridge runtime and web API. Covers crates/runtime/src/features.rs, ui/web/src/pages/api/features.ts, TypeScript bindings, local testing, and selector usage.
Pre-submit checklist for PRs that change Rust or bridge code (`crates/`) in the Fedi project. Use before opening or updating a Rust or bridge PR to run the right local checks and structure the description. Not for UI (`ui/`), docs, or config-only changes, which have their own conventions.
Review a UI pull request or diff in the `ui/` workspace (web, native, shared `common`) for regressions and scope creep, weighing each finding by cost and blocking only on a named cost. Use whenever asked to review a UI or frontend PR or diff, or to check a web or native change before merge, even if the user does not say "code review". Not for Rust, bridge, or infra changes.
Review Dependabot PRs updating Rust/Cargo crates with a security-focused crates.io tarball diff before commenting.
Triage stale GitHub issues. Use when asked to review old, inactive, least-recently-updated, obsolete, already-done, or closeable issues; research whether they are still relevant; comment with a short summary; and close issues that are clearly done or no longer needed.
| name | github-actions-dependabot-review |
| description | Review Dependabot PRs updating GitHub Actions workflows/actions, with a security-focused upstream diff check before commenting. |
Use when asked to review Dependabot PRs for GitHub Actions updates.
Target PRs usually have github_actions in the branch name or a title like bump OWNER/ACTION from OLD to NEW.
For each target PR:
package-lock.json, Cargo.lock, etc.), review each dependency update similarly. If the dependency diff is too large or infeasible, at least check registry metadata and verify the new version is at least a week old. Raise anything not clearly safe as a concern.OK to merge / not OK to merge recommendation.Summarize PR link, whether it was already reviewed, whether a comment was posted, and the recommendation.