Menú
Fetch open GitHub issues labeled "vulnerability" and open Dependabot alerts, prepare fixes for each, then present to the user for approval before committing and opening PRs.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
Implement a feature from the plan that plan-feature produced under docs/plan/<feature>/, one reviewed sub-issue at a time. Use when the user wants to implement or build a feature from a docs/plan/<feature>/ plan or a planned GitHub issue.
Turn a GitHub issue into an implementation plan under docs/plan/<feature>/: a feature spec decomposed into context-window-sized sub-issues, committed as the first commit of the feature branch with a draft PR. Use when the user wants to plan a feature, decompose a GitHub issue into sub-issues, or produce an implementation plan from an issue.
Template and writing guidelines for a GitHub issue. Every issue is one of epic, feature, task, bug, or research task — the user decides the type, and each type has its own template. Non-epic types can suggest a parent epic from the project board.
Draft a GitHub issue, get explicit user approval, and file it via the `gh` CLI. TRIGGER when: user wants to file or "drop" a GitHub issue / ticket.
Check and align a repo's .claude/settings.json and CLAUDE.md with team conventions. Use when the user wants to standardize a repo, align conventions, check settings, or bootstrap Claude Code config in a new project.
Use this skill whenever writing, editing, reviewing, or refactoring TypeScript React code — components, custom hooks, state stores, forms, queries, mutations, API clients, or styling. Trigger it for any task touching a `.ts` or `.tsx` file in a React project, including when the user says "add a feature", "fix this bug", or "clean this up" inside a component or hook. Also use it for architectural questions about React codebases: where state should live, whether a component is too big, how to organize modules, when to reach for TanStack Query, Zustand, React Context, or React Hook Form.
| name | update-vulnerable-deps |
| description | Fetch open GitHub issues labeled "vulnerability" and open Dependabot alerts, prepare fixes for each, then present to the user for approval before committing and opening PRs. |
| allowed-tools | ["Bash","Read","Edit","Write","Agent","AskUserQuestion"] |
Run in parallel:
gh issue list --label vulnerability --state open --json number,title,body,labels,url --limit 50
gh api repos/$(gh repo view --json nameWithOwner --jq .nameWithOwner)/dependabot/alerts --method GET \
-q '[.[] | select(.state=="open")] | sort_by(.security_advisory.severity | if . == "critical" then 0 elif . == "high" then 1 elif . == "medium" then 2 else 3 end)'
If both sources return zero items, there is nothing to do, so stop.
Present a numbered summary table to the user, sorted by severity:
| # | Source | Severity | Title | Detail |
|---|
Ask the user which items to fix. Default suggestion: all of them.
Note: tools are configured to avoid releases younger than 7 days. Add an exclusion if necessary to install a fixed release. Review exclusions and remove ones that according to git blame were added more than 7 days ago.
By ecosystem:
mise use tool@version, use mise lock to update mise.lockpnpm, with overrides in top-level package.json if necessarypinactmise controller:scan:govulncheck to verify