メニュー
Use when handling Dependabot PRs, CodeQL/Trivy alerts, or doing a routine dependency/CVE sweep for this repo.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Use when `make ci-local` fails locally or a GitHub Actions run reports a CI failure (format, lint, line-budget, typecheck, or test errors).
Use when reviewing a diff, PR, or change set for correctness and quality before merge or handoff. For a deep security-only pass, use security-review instead.
Use when bringing this repo into compliance with a GeneFoundry fleet standard (tool-naming, response-envelope, container-hardening, versioning, MCP transport, or logging) or closing its tracking issue.
Use when preparing to tag, publish, or deploy a genefoundry-router build.
Use when reviewing genefoundry-router security before deploy, when touching auth/proxy/logging/limits config, or when answering an infosec/DSB question.
Use when changing the router's authentication or authorization — JWT/OAuth modes, verifiers, resource/audience metadata, the secure-by-default bind guard, or the no-token-passthrough boundary.
| name | dependency-cve-sweep |
| description | Use when handling Dependabot PRs, CodeQL/Trivy alerts, or doing a routine dependency/CVE sweep for this repo. |
Follow AGENTS.md first. Consolidate a repo's open Dependabot PRs into one clean PR rather than merging many.
uv lock --upgrade-package <name> (targeted) or uv lock --upgrade (full); keep uv.lock committed and --frozen in the build.uses: owner/action@<40-char-sha> # vX.Y.Z), never floating tags.py/incomplete-url-substring-sanitization test-assertion false positive, switch to exact-match assertions.severity: CRITICAL,HIGH + ignore-unfixed: true + exit-code: "1") and retain the SBOM (docs/CONTAINER-HARDENING-STANDARD-v1.md).make ci-local; patch-bump the app version; squash-merge only on green.When bumping FastMCP, verify validation-error wrapping: some 3.4.x releases re-raise argument-validation errors as fastmcp.exceptions.ValidationError, so a test asserting on a Pydantic ValidationError must walk __cause__. A version/catalog guard test may also need regenerating.
exit-code: "1" without ignore-unfixed: true — gates on unfixable base-image CVEs → self-inflicted outage.