メニュー
Audits third-party dependencies for CVEs, abandoned packages, license risk, and supply-chain hygiene indicators. Load when adding new packages, reviewing a lockfile, or preparing for a security review.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Produces a documented inventory of the implicit business rules, edge cases, and bug-as-feature behaviors that tangled code encodes, with real input-to-output examples, so a rewrite preserves behavior. Use when you are about to rewrite, port, or replace legacy code whose only specification is the source, and you see policy buried in conditionals, magic numbers, hardcoded dates, or per-customer special cases. Do NOT use when you need an executable safety net before refactoring — use characterization-test-writer instead; do NOT use when you need to find service boundaries in a monolith — use monolith-decomposer instead.
Writes pinning and characterization tests that lock in the current behavior of untested legacy code before a refactor, so any later behavior change trips an alarm. Use when you are about to refactor, rewrite, or modify an untested legacy function/module and need a safety net first, when code has no tests and its "correct" behavior is simply whatever it does today, or when you must capture existing output (bugs included) before touching it. Do NOT use when writing tests for new behavior you are building red-green — use tdd-expert instead; do NOT use to decide which code is worth testing or to rank coverage gaps — use coverage-gap-finder instead.
Proves code is unreachable with converging evidence, then removes it and its tests, fixtures, and flags in reversible slices without breaking dynamic callers. Use when deleting suspected dead code, cleaning up after a migration or feature retirement, trimming a bloated module, or before estimating work on unfamiliar code. Do NOT use when you want to survey and rank an area's debt without committing to deletion — use find-tech-debt instead.
Drives a major-version framework bump as a sequence of small, reversible, CI-gated PRs using official codemods and changelog diffing while keeping the app green. Use when bumping React, Rails, Spring Boot, Angular, or any framework across a major version with breaking API/config changes; do NOT use for language or runtime version jumps (Python 2 to 3, Node majors, Java LTS) — use language-version-migrator instead.
Ports a codebase across a breaking language or runtime version using compatibility shims, automated transforms, and old-vs-new verification. Use when migrating Python 2 to 3, jumping Node major versions, moving across Java LTS releases, or any runtime upgrade where source must change to keep compiling or behaving correctly. Do NOT use when upgrading an application framework's major version (React, Rails, Spring) — use framework-upgrader instead; and skip this when the runtime change is purely operational (base image, CI matrix, deploy target) with no syntax or semantic breaks.
Finds and sequences one bounded-context seam to extract from a monolith, gated on dependency, data-ownership, and transaction-boundary evidence, and produces an incremental strangler extraction plan. Use when you are planning to carve a service out of a monolith, deciding where to cut, or evaluating whether a candidate seam is ready to extract.
| name | Dependency Risk Audit |
| description | Audits third-party dependencies for CVEs, abandoned packages, license risk, and supply-chain hygiene indicators. Load when adding new packages, reviewing a lockfile, or preparing for a security review. |
Third-party packages are the most common source of supply-chain compromise and known-vulnerability exploitation. Treat dependency selection as a security decision, not just a convenience one.
Run the ecosystem's native audit tool first (npm audit, pip-audit, bundle audit, govulncheck). For each finding:
A dependency with no CVEs today can become a liability tomorrow. For any new or high-traffic dependency check:
Install-time attacks abuse package publication pipelines. Apply these checks:
Licenses create legal exposure, not just engineering risk. Flag any dependency with a copyleft license (GPL, AGPL, EUPL) in a proprietary codebase — these require legal review before shipping. Acceptable defaults for most commercial projects: MIT, Apache-2.0, BSD-2, BSD-3, ISC.
Rank findings: (1) exploitable CVE with available fix, (2) exploitable CVE no fix — needs replacement, (3) abandoned package on a critical path, (4) license conflict, (5) maintenance concern only. Address (1) and (2) before any release. Defer (5) to a scheduled dependency hygiene sprint.
