メニュー
Check dependencies for known vulnerabilities and staleness. Use when user asks to "audit dependencies", "/deps-audit", "check for vulnerabilities", or wants to check dependency health. Don't use for reviewing code quality.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Explore a codebase to surface architectural friction and propose refactors toward deep modules (simple interface, large implementation) as GitHub issue RFCs. Use when the user asks to audit architecture, find structural friction, or identify refactor opportunities across a codebase. Don't use for single-module interface design (use /codebase-design) or code-level review of a diff (use /code-review).
Write end-to-end tests for user flows using Cypress. Use when user asks to "write e2e tests", "/e2e", "add Cypress tests", or wants to test a user flow end-to-end. Don't use for unit tests, component tests, or projects using Playwright, Puppeteer, or other non-Cypress frameworks.
Audit internationalization coverage and find hardcoded strings. Use when user asks to "check i18n", "/i18n", "find hardcoded strings", "check translations", or wants to verify translation coverage. Don't use for backend string extraction, non-frontend code, or projects without an i18n library.
Check for sensitive data in repository. Use when user asks to "check for sensitive data", "/safe-repo", or wants to verify no company/credential data is in the repository. Use `--diff` mode to scope to staged + unstaged changes only (e.g., before commit). Don't use for general code review, adding .gitignore entries, or scanning non-git directories.
Implement one phase of a plan — reads the plan, finds the next incomplete phase, implements it with feedback loops, marks checkboxes, offers a commit (one phase per invocation). Use after /plan when a plan exists at `.specs/plans/<slug>.md`, or when the user asks to build or implement the next phase. Don't use for ad-hoc changes with no plan (use /tdd) or to check progress (use /test).
Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.
| name | deps-audit |
| description | Check dependencies for known vulnerabilities and staleness. Use when user asks to "audit dependencies", "/deps-audit", "check for vulnerabilities", or wants to check dependency health. Don't use for reviewing code quality. |
Detect the project's package manager from its lockfile and run that ecosystem's audit + outdated tooling. Don't assume npm.
| Ecosystem | Lockfile | Audit | Outdated |
|---|---|---|---|
| npm | package-lock.json | npm audit | npm outdated |
| pnpm | pnpm-lock.yaml | pnpm audit | pnpm outdated |
| yarn | yarn.lock | yarn npm audit (berry) / yarn audit | yarn outdated |
| Python | requirements*.txt / uv.lock / poetry.lock | pip-audit | pip list --outdated |
| Go | go.sum | govulncheck ./... | go list -m -u all |
| Rust | Cargo.lock | cargo audit | cargo outdated |
| Level | CVSS | Action |
|---|---|---|
| Critical | 9.0-10.0 | Fix immediately, block merge |
| High | 7.0-8.9 | Fix before next release |
| Moderate | 4.0-6.9 | Fix in current sprint |
| Low | 0.1-3.9 | Fix when convenient |
For each critical/high vulnerability report:
Package: <name>@<version>
Advisory: <CVE / GHSA / RUSTSEC id>
Severity: Critical
Description: <one line>
Fix: <ecosystem fix command, e.g. npm audit fix / cargo update -p <pkg>>
pip-audit, govulncheck, cargo-audit) and stop