メニュー
Report-only maintenance sweep — dependency audit, test-suite health, security quick-scan, workboard grooming. Never changes code; produces a findings report and proposed backlog tickets. Use for recurring maintenance ("check the project's health") or schedule it with /loop.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Database engineering standards for PostgreSQL, MySQL, MongoDB, Supabase and Firebase/Firestore — schema/index design, security, and the per-engine gotchas an agent gets wrong. Loaded on top of backend-craft when a ticket touches the database. Use when designing schema, queries, migrations or data-access.
Next.js App Router full-stack standards — server/client boundaries, the four caching layers, server-action security, route handlers, rendering/streaming, metadata, middleware limits, and Next-specific testing. Loaded on top of react-craft (and alongside backend-craft for server code) when the ticket's stack is Next.js. Use when building any Next.js route, action, or API surface.
Headless QA tooling for driving real test tools from the CLI — Postman/Newman (functional + contract), OWASP ZAP + nuclei (security/DAST, the agent-drivable substitute for Burp), and k6/JMeter/autocannon (load). Use when running a comprehensive QA/security/load sweep against a running app.
Full delivery pipeline — takes a feature/project request, plans it into Jira-like markdown tickets, builds each ticket with specialized developer agents, then runs QA, security and code-audit agents, loops a debugger agent over findings until clean, and closes with a final report. Use when the user asks to build a feature or project end-to-end, or invokes /ship.
Express.js (Node) engineering standards — layering, async error handling (Express 4 vs 5), boundary validation, security middleware, graceful shutdown, and testing. Loaded on top of backend-craft when the ticket's stack is Express. Use when building Express APIs.
NestJS engineering standards — feature-module architecture, DI discipline, DTO validation, the guard/interceptor/pipe/filter split, config, TypeORM/Prisma, and testing. Loaded on top of backend-craft when the ticket's stack is NestJS. Use when building NestJS APIs.
| name | patrol |
| description | Report-only maintenance sweep — dependency audit, test-suite health, security quick-scan, workboard grooming. Never changes code; produces a findings report and proposed backlog tickets. Use for recurring maintenance ("check the project's health") or schedule it with /loop. |
| argument-hint | [deps | tests | security | board | all] |
L1 autonomy: read and report, never fix. Safe to run on a schedule
(/loop 1d /patrol) or in CI — it cannot break anything.
$ARGUMENTS (default all). Run the relevant checks — spawn
one agent per area, in parallel, each explicitly instructed READ-ONLY:
deps — ecosystem audit (npm audit / pip-audit / cargo audit):
exploitable vulns relevant to actual usage, plus major-version drift on
direct dependencies.tests — run the full suite 2× and report: failures, flakes (pass/fail
flicker), runtime trend, coverage holes on recently changed files.security — spawn security-auditor scoped to changes since the last
patrol (or last 20 commits) — quick pass, CRITICAL/HIGH only.board — workboard grooming report: stale in_progress/blocked tickets,
unfixed MEDIUM/LOW findings aging in ticket sections, epics stuck in
verifying, drift between BOARD.md and ticket frontmatter./board add style — batch, one confirmation). Fixing happens later
via /ship or /debug-findings, initiated by the user.workboard/BOARD.md's activity log:
patrol: <date> — <verdicts summary> so patrol history is visible.If the project has no workboard, run the checks anyway and just report.