메뉴
Use when auditing the project for OWASP issues, secrets, vulnerable dependencies, auth gaps, or misconfigured infrastructure
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Use when asked to implement an epic, a backlog of issues, or "/epic-implement N" — autonomous multi-agent execution of a GitHub epic's sub-issues, safe under a permission-bypassed session. Pass the epic number as the argument; if omitted, asks which open epic to run. A single issue goes to issue-implement.
Use when asked to implement a single GitHub issue end to end — "implement #171", "fix issue N", "pick up that bug" — where the deliverable is a reviewed PR. Epics and multi-issue backlogs go to epic-implement.
Use when capturing a feature, remediation, port/resurrection of old functionality, or any multi-issue program of work as a GitHub epic with sub-issues for later execution by separate agents — including when asked to "create an epic", "file this as issues", or "plan this so a lesser model can execute it". Single-issue-scale work (one bug/feature/chore) goes to issue-plan.
Use when capturing a single unit of work as a GitHub issue for later execution by a separate session — a bug found while debugging, a feature request, a chore, or a discovery out of scope for the current task. Triggers include "file an issue", "create an issue", "write this up as a bug". Multi-issue programs of work go to epic-plan.
Use when starting work in an unfamiliar module, when a module's `.context.md` is missing or stale, or when asked to document or understand a module's role
Use when restructuring existing code without changing behavior — extracting functions, splitting modules, or addressing tech debt and code smells
| name | security-audit |
| description | Use when auditing the project for OWASP issues, secrets, vulnerable dependencies, auth gaps, or misconfigured infrastructure |
Focused security review — code, dependencies, and configuration.
| Invocation | Target |
|---|---|
/security-audit | full project |
/security-audit [path] | focused on a file or module |
/security-audit deps | dependencies only |
make security (or the project equivalent) — flag known CVEs.security-reviewer agent (fall back to general-purpose with the persona injected only if it's unavailable). The prompt must request severity-rated (Critical/Major/Minor) findings on:
## Security Audit
**Scope:** [...] **Risk Level:** [Critical / Major / Minor / Clean]
### Dependency Vulnerabilities
| Package | Version | CVE | Severity | Fix |
|---|---|---|---|---|
### Code Findings
[reviewer report]
### Configuration Findings
[issues]
### Summary
Critical: [N] Major: [N] Minor: [N]
### Priority Actions
1. …
Same finding-driven gate as everywhere else (quality-and-verification.md): Critical and Major block (Critical additionally blocks deployment, fix immediately); Minor is documented and tracked, never blocking. CVE severities map: High -> Major, Medium/Low -> Minor.