malgo

Detect outdated dependencies, upgrade them safely, verify the build, and create a PR. Covers Haskell (cabal/package.yaml/freeze file), GitHub Actions (pinned SHA versions), mise toolchain versions, and Nix flake inputs. Includes security advisory checks, release maturity verification (avoid bleeding-edge releases), supply chain attack detection, and unnecessary dependency removal. This skill enforces explicit user-approval gates before modifying files and before creating PRs — these gates are mandatory even under Auto Mode. Use this skill whenever the user mentions upgrading, updating, or bumping dependencies, packages, actions, toolchains, or flake inputs — even if they say something casual like "update deps" or "are my packages outdated?". Also trigger when the user asks about Dependabot-like workflows, version pinning, freeze file maintenance, dependency auditing, security scanning, or trimming unused packages.

Create a design document before implementation. Use when the user says /design, 'planして', '設計して', '計画を立てて', 'アーキテクチャを考えて', '設計文書を書いて', 'design this', or when a complex task clearly needs architectural decisions before coding. Always use this skill when the user requests planning or design work, even if they don't explicitly say 'design'. After writing the document, STOP — never proceed to implementation.

Task list management skill for tracking large-scale changes across multiple sessions. Use when the user says "create a task list", "plan changes", "follow todos/xxx.md", "continue from the track list", or "/track".