메뉴
Use when running a codebase-wide or subsystem bug audit — fan out orthogonal parallel investigators, adversarially verify every Medium+ finding before filing, write bug issues in the standard body, and file a severity-grouped [Epic] with linked sub-issues and an "Areas verified clean" section.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | bug-audit-epic |
| description | Use when running a codebase-wide or subsystem bug audit — fan out orthogonal parallel investigators, adversarially verify every Medium+ finding before filing, write bug issues in the standard body, and file a severity-grouped [Epic] with linked sub-issues and an "Areas verified clean" section. |
A bug audit produces verified bug reports only — no code changes. The fixes come later, one PR per issue (see the bug-fix-pr skill). Evidence for this procedure: epics #493 (24 children), #543 (47 children, rounds 2–3), #570 (staging deep-dive); standard child body #545; children #545–569.
Pick the commit the audit runs against and record it in the epic verbatim: Audited at main = <sha> (#570 audited at d424c74; #493 at its round-1 base). Every file:line cite in every child must resolve against that SHA. When the audit spans several days and later rounds re-verify cites against a newer SHA, state both bases (#543 records base 98f5b74, extended to d424c74).
Run parallel investigators, each with a distinct attack angle so coverage does not overlap:
Before a Medium-or-higher candidate is filed, an independent agent tries to refute it. Record the outcome in the epic methodology: upgrades (evidence traced deeper — #570 upgraded one to SDK-serializer level), confirmations, and downgrades with corrections (#543 downgraded five to Low). Drop plausible-but-unproven low-severity candidates rather than filing them (#493).
Merge findings that independent investigators reported for the same root cause. Exclude anything already filed in earlier waves, stated explicitly by issue-number range (#570 excludes everything in #493 and #543 including staging items #521–#542; #543 excludes #493's #447 as tracked). Refute suspected process gaps in writing rather than leaving them implied (#570 refuted a suspected export tag-destruction; #543 dismissed a "closed but unmerged" concern by confirming the PR was merged).
Body sections, in order (template = #545):
## Summary — what breaks and why, in prose.## Where — file:line anchors for every implicated site.## Failure scenario — a concrete reproduction a fixer can replay.## Severity — with justification.## Suggested fix — the minimal correct change.Found during a Fable-coordinated / Opus-executed <scope> audit; adversarially verified (<how>). Confidence: CONFIRMED.Labels: bug + the area label(s) (staging, param, secret, …) + a Priority:* label. Priority definitions: Critical = silent data loss or wrong values returned (e.g. #545 — a tag-only write silently corrupts a Key Vault reference into a plain literal).
[Epic] <scope> bug audit (<date>), label epic (+ area label for a subsystem audit).Use when restructuring the README or the GitHub Pages site generated from it — the left-nav/left-pane, section reorg, or per-provider command docs. Covers the build-docs-site.py split + literate-nav SUMMARY pipeline, its HTML-comment directives and site-only transforms (nav-group, site:skip, hero <h1>, asset ../ prefix, DOC_NAV grouping), the python-markdown gotchas GitHub hides, and the `mise docs-build` strict gate.
Use when authoring or backfilling the "## Highlights" section of a GitHub release — the human-written summary that prepends the auto-generated notes. Covers when a release earns highlights, the fixed format (bold lead + breaking-change note, `###` subsections, PR-referenced bullets), and the prepend-in-place mechanics.
Use when re-recording the CLI, TUI, or GUI demo GIFs after a UI change or a user-visible output change. Covers the record scripts, robust Playwright selectors, output-drift triggers, frame verification, and Git LFS.
Load when writing or reviewing Go that builds or transforms slices/maps. Prefer samber/lo, samber/lo/it, and stdlib slices/maps callback & iterator utilities over hand-rolled make + range + append; keep an explicit loop only where side effects or control flow are genuinely complex.
Load when you need the per-provider capability, versioning, and alias matrix for suve's CLI without reading the full docs/{aws,azure,gcloud}.md option tables. A one-page orientation; link out for per-command detail.
Load when adding or modifying a provider adapter, or when touching internal/provider/** or internal/domain/**. Captures the invariants that keep the provider-neutral seam honest: the neutral domain model, opaque version refs, the typed write/delete option pattern, interface segregation, and SDK confinement.