メニュー
Run `composer audit` to check composer.lock dependencies for known CVEs. Invoked by the builder before push and the reviewer's mandatory block. Mirrors the orchestrator's `composer-audit` quality gate.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
Reset the OpenRegister development environment (stop, remove volumes, restart, install apps)
Create a Pull Request from the current branch — runs local checks, picks target branch, and opens the PR on GitHub
Analyze a project's OpenSpec from 8 persona perspectives and suggest additional features
Detect admin settings Vue components registered in the vue-router. Admin settings are rendered by Nextcloud's settings framework via `AdminSettings.php`; adding their Vue components to the in-app router exposes them as publicly-accessible frontend routes, bypassing all server-side access checks. ADR-004 hard rule. Observed 2026-04-30 on doriath where `/settings → AdminRoot` was a route in `src/router/index.js` (commit c7c72e9).
Scan lib/ for forbidden debug helpers (var_dump / die / error_log / print_r / dd / dump) that should not ship. Invoked by the builder before push, by the reviewer as Mandatory Step 2, and by the fixer during a retry. Mirrors the orchestrator's `forbidden-patterns` quality gate.
Detect DOM data-attribute reads in `.vue`/`.js`/`.ts` files (e.g. `document.getElementById('x').dataset.version`) used to pull server-side data into the frontend. The Nextcloud-idiomatic pattern is `IInitialState::provideInitialState()` in PHP + `loadState()` from `@nextcloud/initial-state` in Vue. DOM data-attributes break on CSP-hardened instances and bypass the canonical pattern documented in ADR-004. Observed 2026-04-30 on doriath where `AdminRoot.vue` read `document.getElementById('doriath-settings').dataset.version`.
SOC 職業分類に基づく
| name | hydra-gate-composer-audit |
| description | Run `composer audit` to check composer.lock dependencies for known CVEs. Invoked by the builder before push and the reviewer's mandatory block. Mirrors the orchestrator's `composer-audit` quality gate. |
| metadata | {"category":"Hydra pipeline gate","tags":["hydra","mechanical-gate","composer","security","cve"]} |
Composer packages ship with known CVEs occasionally. The orchestrator's composer-audit stage fails the recheck on any High/Critical CVE in installed deps. Letting vulnerable packages ship is both a security problem and a blocking gate.
composer audit --format=plain
Exit 0 = clean. Exit non-zero = CVEs present. The plain-format output lists each advisory with its package, version, severity, and CVE ID.
For each flagged package:
composer.json to a patched version constraint (e.g. "phpunit/phpunit": "^10.5.64" if 10.5.63 has a CVE)composer update <package> to regenerate composer.lockcomposer check:strict + tests — a dep bump sometimes breaks downstream codeIf the advisory is in a dev-only dep (PHPUnit, PHPCS, Psalm, etc.), the bump is low-risk. Production deps need careful regression testing.
If the patched version breaks PHP-version compatibility (you're on PHP 8.3, patch needs 8.4) OR requires an ecosystem-wide migration, leave [unfixed: composer-audit — <CVE-ID>] with a note explaining the constraint. The applier will see it and decide whether to block.
composer update --dry-run shows what WOULD change without modifying composer.lockcomposer why <package> shows who depends on a transitive dep you can't directly updateSample gate output is in examples/:
/tmp/hydra-gate-composer-audit.log so the builder/reviewer can read line-by-line and apply Fix actions deterministically. Confirm the gate is green by running ./scripts/run-hydra-gates.sh --scope-to-diff from the app dir before pushing.