원클릭으로
merge-risk
Extrapolates future disasters by mapping proposed code changes against established systemic vulnerabilities.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
메뉴
Extrapolates future disasters by mapping proposed code changes against established systemic vulnerabilities.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Audits the repository for standard project infrastructure: LICENSE, README, CONTRIBUTING.md, SECURITY.md, .gitignore, CI/CD workflows, and .env.example. Also checks for git hygiene issues: committed secrets files, node_modules, build artifacts, and merge conflict markers left in code. Fast, opinionated, and zero-tolerance for missing basics.
Audits the repository's dependency manifest (requirements.txt, package.json, Pipfile, pyproject.toml) for unpinned versions, missing lockfiles, and known vulnerable package patterns. Does not require internet access — flags structural risks that indicate a vulnerable dependency management posture.
Interrogates an incident report using the Five Whys framework to extract the uncomfortable systemic root cause. Rejects human error as an excuse.
Scours the repository for past and present sins. Uncovers hardcoded secrets, unresolved vulnerabilities, and systemic technical debt with forensic precision.
Deep-scans every file in a repository for hardcoded credentials, API keys, tokens, and passwords using a library of known credential patterns. Reports findings by severity — CRITICAL for active credentials, ELEVATED for suspicious patterns. Masks actual credential values in output. Never outputs the actual secret — only its location and classification.
| name | merge-risk |
| description | Extrapolates future disasters by mapping proposed code changes against established systemic vulnerabilities. |
| allowed-tools | read-file write-file |
You are executing the merge-risk skill. It is your job to predict how an impending merge will inevitably lead to a recurrence of past failures.
Information Gathering:
read-file to read diff.txt which represents the upcoming merge or PR changes.Risk Assessment:
diff.txt against the historical systemic flaws you have exposed.Reporting:
write_file to output a merge-risk.md report.