メニュー
Dispatch the security-auditor agent on the current branch diff with pre-gathered context. User-invocable only — does not auto-trigger on ambiguous phrasing. Use when you explicitly want a deep vulnerability audit of branch changes.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | security-audit |
| description | Dispatch the security-auditor agent on the current branch diff with pre-gathered context. User-invocable only — does not auto-trigger on ambiguous phrasing. Use when you explicitly want a deep vulnerability audit of branch changes. |
| disable-model-invocation | true |
Launches the security-auditor agent (from this plugin) with pre-loaded
branch context, so the agent does not have to assemble scope itself.
git rev-parse --abbrev-ref HEADgit diff main...HEAD --statgit log main..HEAD --onelinegh pr view --json title,body,comments 2>/dev/null || echo "no open PR for this branch"Dispatch the security-auditor agent via the Task tool with the context
above. Scope the audit to the branch diff shown.
Report back the agent's findings verbatim. Do not summarize or re-rank — the agent's Phase 6 output is already the final report format.
Use when the user is weighing or pressure-testing an idea rather than committing to build it — 'should I do X', 'which of these approaches', 'is this worth doing', 'what am I missing', 'am I overthinking or over-engineering this'. A lightweight thinking partner that surfaces hidden assumptions and argues for the simplest version, in conversation — no files, no spec. Once the idea is settled and the user wants it turned into an actual plan or spec, that's planning work — hand off to the ideation skill if it's available. Not for writing code to a known spec, bug fixes, or refactors.
Read and drive other tmux panes when Claude runs inside tmux. Use whenever the user points at something running in another pane/split/window — their dev server, test watcher, build, logs, REPL, or another shell — e.g. "errors in my dev server", "read/tail my other pane", "is my server up and on what port", "run this in my other split", "restart the watcher". Also for driving interactive/long-running CLIs (Node REPL, vite/next dev, vitest, node inspect) and spawning isolated background tmux sessions.
Socratic tutor that drills the user until they deeply understand a change — the problem, the solution, the design decisions, the edge cases, and what it impacts. Use after completing or reviewing work (a diff, PR, or session) when the user wants to truly own it, not just skim it — or when the user says /socratic-tutor, "teach me what we just did", "quiz me on this", "walk me through this change", or "make sure I understand this". Restates-first, quizzes, and does not stop until the user demonstrates mastery.
Run an extremely strict maintainability review for abstraction quality, giant files, and spaghetti-condition growth. User-invocable only — does not auto-trigger. Use for a thermo-nuclear code quality review, thermonuclear review, deep code quality audit, or especially harsh maintainability review.
Phased maintainability migration that transforms messy, overgrown, or slop-prone repos into product-shaped codebases while preserving behavior. Covers file splitting, typed boundaries, test hardening, feature folders, API consolidation, and a final migration audit microsite. Use when the user asks to "rehab this codebase", "run a maintainability migration", "modernize structure", "clean up this messy repo and make it maintainable", or "productionize this prototype". Unlike codebase-sweep (parallel quick audit), this is a deep, staged refactor with migration planning and checkpoint commits. Do not use for security audits, observability, compliance, or SRE work.
Comprehensive, codebase-wide quality sweep that dispatches parallel subagents to find and fix structural issues. Covers deduplication, type consolidation, dead code removal, circular dependencies, weak types, defensive try/catch, deprecated paths, and AI slop. Primary support for JS/TS projects (knip, madge, TypeScript types); other languages get grep-based analysis. Use when the user asks to "deep clean the whole repo", "run a full codebase audit", "nuclear cleanup", "deslop everything", or "sweep the entire codebase for quality issues". Do NOT use for single-file fixes, branch-scoped diffs (use de-slopify instead), or targeted refactors.