메뉴
Periodically scan project dependencies for security vulnerabilities, outdated packages, and unused dependencies. Produces a prioritized action report. Run before every major release and at least once per month.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Systematic code review skill covering both requesting a review (pre-commit checklist) and receiving and responding to review feedback. Checks code quality, security, test coverage, architectural alignment, and documentation before any code is committed.
Before committing to an implementation plan, run this skill to stress-test the proposed architecture. Catches over-engineering, circular dependencies, missing failure modes, security gaps, and scalability cliffs — before any code is written. Acts as a "second eye" on the plan.
After any significant code change — new feature, API modification, config change, or architectural refactor — run this skill to identify which documentation files are now stale and update them. Keeps docs and code from drifting apart.
Manages all git operations (commit, push, branch management, PR creation) in a standardized, safe, and consistent way. Automatically runs the code-review skill before any commit. Enforces Conventional Commits standard. Handles the full lifecycle: branch → review → commit → push → PR.
When something breaks in production: triage the severity, gather evidence, identify root cause, deploy a fix or mitigation, and write a post-mortem. Provides a calm, structured process for high-stress moments.
Use this skill whenever you learn something important during a conversation: a key architectural decision, a project-specific convention, a bug root-cause, a 3rd-party API quirk, or any fact that would help a future agent avoid re-doing the same research. Writes structured entries to the project's knowledge base so that context persists across conversations and agents.
| name | dependency-audit |
| description | Periodically scan project dependencies for security vulnerabilities, outdated packages, and unused dependencies. Produces a prioritized action report. Run before every major release and at least once per month. |
Identify which package managers are in use:
package.json → npm / yarn / pnpm (Node.js)
requirements.txt → pip (Python)
pyproject.toml → pip / poetry (Python)
Gemfile → bundler (Ruby)
go.mod → go modules (Go)
Cargo.toml → cargo (Rust)
Run the audit steps for each ecosystem found.
npm audit
# or
yarn audit
# or
pnpm audit
pip install pip-audit
pip-audit
# If using GitHub: check Security tab → Dependabot alerts
# If using Snyk:
snyk test
Triage each finding:
| Severity | Action |
|---|---|
| Critical | Fix immediately before any other work |
| High | Fix before next release |
| Medium | Schedule for current sprint |
| Low | Track, fix when touching related code |
npm outdated
pip list --outdated
For each outdated package, check:
npx depcheck
pip install deptry
deptry .
For each unused dependency flagged:
package.json / requirements.txtFlag any dependencies with licenses that may be incompatible with your project:
# Node.js
npx license-checker --summary
# Python
pip install pip-licenses
pip-licenses
License risk tiers:
| License | Risk |
|---|---|
| MIT, Apache 2.0, BSD | Safe for most uses |
| LGPL | Generally OK, check linking requirements |
| GPL | Risk if distributing proprietary software |
| AGPL | High risk — requires open-sourcing if used via network |
| Unknown | Must investigate before use |
Write findings to .agent/audits/dependency-audit-<YYYY-MM-DD>.md:
# Dependency Audit — <YYYY-MM-DD>
## Summary
- **Critical vulnerabilities:** <N>
- **High vulnerabilities:** <N>
- **Outdated packages:** <N>
- **Unused packages:** <N>
- **License issues:** <N>
## Critical / High — Action Required
### <package-name> @ <version>
- **CVE:** CVE-XXXX-XXXXX
- **Severity:** Critical
- **Description:** <what the vulnerability is>
- **Fix:** Upgrade to <version>
- **Breaking changes:** Yes/No — <details>
## Outdated Packages
| Package | Current | Latest | Urgency | Notes |
|---------|---------|--------|---------|-------|
| express | 4.17.1 | 5.0.0 | High | Major version — review changelog |
| lodash | 4.17.20 | 4.17.21 | Low | Patch only |
## Unused Dependencies (safe to remove)
- `left-pad` — not imported anywhere
- `moment` — replaced by `date-fns` but not removed
## License Issues
- `<package>` uses GPL-3.0 — review with team before next release
## Recommendations
1. <prioritized action>
2. <prioritized action>
For packages with patch or minor updates and no breaking changes:
# Node.js — safe updates only
npm update
# Python
pip install --upgrade <package>
After upgrading:
chore: dependency security updates <YYYY-MM-DD>For major version upgrades, create a separate branch and task.