메뉴
Audits project dependencies for known vulnerabilities, outdated packages, unused dependencies, and license compliance. Works with npm, pip, cargo, go modules, and more.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Accessibility audit of UI code or a running site against WCAG 2.1 AA. Walks every WCAG criterion that maps to common patterns: keyboard reach, focus visibility, contrast, semantic HTML, ARIA, labels, alt text, motion, screen-reader sense. Severity-graded with code fixes.
Comprehensive business-logic blueprint for SaaS, ERP, e-commerce, and marketplace applications. Walks through every domain (auth, billing, multi-tenancy, inventory, audit, compliance, etc.), surfaces the edge cases that actually break in production, and proposes a concrete plan tailored to the user's context.
Reviews existing business code (billing, multi-tenancy, state machines, inventory, GL postings, audit logs, etc.) for missing real-world edge cases. Severity-graded findings — invariant violations, race conditions, missing idempotency, currency precision bugs, audit gaps, jurisdiction issues.
Research how 2–4 mature competitors solve a specific business problem (billing, RBAC, search, onboarding, multi-tenancy, etc.) and produce a side-by-side comparison so the team can pick the right approach for their context. Uses web search + scraping; cites every source.
Designs an end-to-end user flow before any pixels are drawn — entry point, screens, decisions, branches, error/recovery paths, edge cases, microcopy hooks. Outputs a structured spec engineering and design can build from.
Writes or reviews UX copy — button labels, error messages, empty states, success messages, tooltips, form labels, onboarding text, confirmation dialogs. Voice-consistent, action-led, recovery-oriented. Localizable. No dark patterns.
| name | dependency-audit |
| description | Audits project dependencies for known vulnerabilities, outdated packages, unused dependencies, and license compliance. Works with npm, pip, cargo, go modules, and more. |
| argument-hint | [optional: 'security', 'outdated', 'unused', or 'all'] |
| allowed-tools | Read, Grep, Glob, Bash |
!ls package.json package-lock.json yarn.lock pnpm-lock.yaml bun.lockb 2>/dev/null
!ls requirements.txt Pipfile Pipfile.lock pyproject.toml poetry.lock 2>/dev/null
!ls go.mod go.sum 2>/dev/null
!ls Cargo.toml Cargo.lock 2>/dev/null
!ls Gemfile Gemfile.lock 2>/dev/null
!ls *.csproj *.sln 2>/dev/null
!ls composer.json composer.lock 2>/dev/null
!ls mix.exs mix.lock 2>/dev/null
Run the appropriate audit command:
| Ecosystem | Command |
|---|---|
| npm | npm audit --json |
| yarn | yarn audit --json |
| pnpm | pnpm audit --json |
| pip | pip audit 2>/dev/null || pip-audit 2>/dev/null |
| Go | govulncheck ./... 2>/dev/null |
| Rust | cargo audit 2>/dev/null |
| Ruby | bundle audit check 2>/dev/null |
| .NET | dotnet list package --vulnerable 2>/dev/null |
| PHP | composer audit 2>/dev/null |
For each vulnerability found:
Run the appropriate command:
| Ecosystem | Command |
|---|---|
| npm | npm outdated --json |
| pip | pip list --outdated 2>/dev/null |
| Go | go list -m -u all 2>/dev/null |
| Rust | cargo outdated 2>/dev/null |
| Ruby | bundle outdated 2>/dev/null |
Classify updates:
Look for dependencies that are imported in package manifest but never referenced in code:
Note: Some dependencies are used via CLI, plugins, or config — verify before removing.
Check for problematic licenses:
| Package | Version | Severity | CVE | Fix Available |
|---|
| Package | Current | Latest | Update Type | Breaking? |
|---|
| Package | Last Import Found | Recommendation |
|---|
| Package | License | Risk Level |
|---|
Rate dependency health from 0 to 10 (10 = all up to date, no vulns).
