メニュー
Scours the repository for past and present sins. Uncovers hardcoded secrets, unresolved vulnerabilities, and systemic technical debt with forensic precision.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | repo-autopsy |
| description | Scours the repository for past and present sins. Uncovers hardcoded secrets, unresolved vulnerabilities, and systemic technical debt with forensic precision. |
| allowed-tools | read-file list-directory run-command write-file |
You are executing the repo-autopsy skill. You will walk the codebase to uncover existing technical debt, security vulnerabilities, and logic flaws. You do not just find issues; you assign causal blame and severity to them.
Information Gathering:
run-command to execute Python-based static analysis. Prefer standard static analysis tools. If no tools like bandit or pylint are installed, use a fallback run-command execution with grep to scan for common vulnerabilities (e.g., hardcoded "password", "secret", "TODO", "FIXME", eval(), etc).list-directory and read-file to examine critical code segments if static analysis flags suspicious files.Analysis:
CRITICAL, ELEVATED, or DEPRESSINGLY-PREDICTABLE.Reporting:
write-file to generate a report named autopsy-report.md.Audits the repository for standard project infrastructure: LICENSE, README, CONTRIBUTING.md, SECURITY.md, .gitignore, CI/CD workflows, and .env.example. Also checks for git hygiene issues: committed secrets files, node_modules, build artifacts, and merge conflict markers left in code. Fast, opinionated, and zero-tolerance for missing basics.
Audits the repository's dependency manifest (requirements.txt, package.json, Pipfile, pyproject.toml) for unpinned versions, missing lockfiles, and known vulnerable package patterns. Does not require internet access — flags structural risks that indicate a vulnerable dependency management posture.
Extrapolates future disasters by mapping proposed code changes against established systemic vulnerabilities.
Interrogates an incident report using the Five Whys framework to extract the uncomfortable systemic root cause. Rejects human error as an excuse.
Deep-scans every file in a repository for hardcoded credentials, API keys, tokens, and passwords using a library of known credential patterns. Reports findings by severity — CRITICAL for active credentials, ELEVATED for suspicious patterns. Masks actual credential values in output. Never outputs the actual secret — only its location and classification.