メニュー
Audits project dependencies for known vulnerabilities, outdated packages, unused dependencies, and license compliance. Works with npm, pip, cargo, go modules, and more.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Accessibility audit of UI code or a running site against WCAG 2.1 AA. Walks every WCAG criterion that maps to common patterns: keyboard reach, focus visibility, contrast, semantic HTML, ARIA, labels, alt text, motion, screen-reader sense. Severity-graded with code fixes.
Comprehensive business-logic blueprint for SaaS, ERP, e-commerce, and marketplace applications. Walks through every domain (auth, billing, multi-tenancy, inventory, audit, compliance, etc.), surfaces the edge cases that actually break in production, and proposes a concrete plan tailored to the user's context.
Reviews existing business code (billing, multi-tenancy, state machines, inventory, GL postings, audit logs, etc.) for missing real-world edge cases. Severity-graded findings — invariant violations, race conditions, missing idempotency, currency precision bugs, audit gaps, jurisdiction issues.
Research how 2–4 mature competitors solve a specific business problem (billing, RBAC, search, onboarding, multi-tenancy, etc.) and produce a side-by-side comparison so the team can pick the right approach for their context. Uses web search + scraping; cites every source.
Designs an end-to-end user flow before any pixels are drawn — entry point, screens, decisions, branches, error/recovery paths, edge cases, microcopy hooks. Outputs a structured spec engineering and design can build from.
Writes or reviews UX copy — button labels, error messages, empty states, success messages, tooltips, form labels, onboarding text, confirmation dialogs. Voice-consistent, action-led, recovery-oriented. Localizable. No dark patterns.
| name | dependency-audit |
| description | Audits project dependencies for known vulnerabilities, outdated packages, unused dependencies, and license compliance. Works with npm, pip, cargo, go modules, and more. |
| argument-hint | [optional: 'security', 'outdated', 'unused', or 'all'] |
| allowed-tools | Read, Grep, Glob, Bash |
!ls package.json package-lock.json yarn.lock pnpm-lock.yaml bun.lockb 2>/dev/null
!ls requirements.txt Pipfile Pipfile.lock pyproject.toml poetry.lock 2>/dev/null
!ls go.mod go.sum 2>/dev/null
!ls Cargo.toml Cargo.lock 2>/dev/null
!ls Gemfile Gemfile.lock 2>/dev/null
!ls *.csproj *.sln 2>/dev/null
!ls composer.json composer.lock 2>/dev/null
!ls mix.exs mix.lock 2>/dev/null
Run the appropriate audit command:
| Ecosystem | Command |
|---|---|
| npm | npm audit --json |
| yarn | yarn audit --json |
| pnpm | pnpm audit --json |
| pip | pip audit 2>/dev/null || pip-audit 2>/dev/null |
| Go | govulncheck ./... 2>/dev/null |
| Rust | cargo audit 2>/dev/null |
| Ruby | bundle audit check 2>/dev/null |
| .NET | dotnet list package --vulnerable 2>/dev/null |
| PHP | composer audit 2>/dev/null |
For each vulnerability found:
Run the appropriate command:
| Ecosystem | Command |
|---|---|
| npm | npm outdated --json |
| pip | pip list --outdated 2>/dev/null |
| Go | go list -m -u all 2>/dev/null |
| Rust | cargo outdated 2>/dev/null |
| Ruby | bundle outdated 2>/dev/null |
Classify updates:
Look for dependencies that are imported in package manifest but never referenced in code:
Note: Some dependencies are used via CLI, plugins, or config — verify before removing.
Check for problematic licenses:
| Package | Version | Severity | CVE | Fix Available |
|---|
| Package | Current | Latest | Update Type | Breaking? |
|---|
| Package | Last Import Found | Recommendation |
|---|
| Package | License | Risk Level |
|---|
Rate dependency health from 0 to 10 (10 = all up to date, no vulns).
