Menu
Use when auditing the project for OWASP issues, secrets, vulnerable dependencies, auth gaps, or misconfigured infrastructure
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
Use when asked to implement an epic, a backlog of issues, or "/epic-implement N" — autonomous multi-agent execution of a GitHub epic's sub-issues, safe under a permission-bypassed session. Pass the epic number as the argument; if omitted, asks which open epic to run. A single issue goes to issue-implement.
Use when asked to implement a single GitHub issue end to end — "implement #171", "fix issue N", "pick up that bug" — where the deliverable is a reviewed PR. Epics and multi-issue backlogs go to epic-implement.
Use when capturing a feature, remediation, port/resurrection of old functionality, or any multi-issue program of work as a GitHub epic with sub-issues for later execution by separate agents — including when asked to "create an epic", "file this as issues", or "plan this so a lesser model can execute it". Single-issue-scale work (one bug/feature/chore) goes to issue-plan.
Use when capturing a single unit of work as a GitHub issue for later execution by a separate session — a bug found while debugging, a feature request, a chore, or a discovery out of scope for the current task. Triggers include "file an issue", "create an issue", "write this up as a bug". Multi-issue programs of work go to epic-plan.
Use when starting work in an unfamiliar module, when a module's `.context.md` is missing or stale, or when asked to document or understand a module's role
Use when restructuring existing code without changing behavior — extracting functions, splitting modules, or addressing tech debt and code smells
| name | security-audit |
| description | Use when auditing the project for OWASP issues, secrets, vulnerable dependencies, auth gaps, or misconfigured infrastructure |
Focused security review — code, dependencies, and configuration.
| Invocation | Target |
|---|---|
/security-audit | full project |
/security-audit [path] | focused on a file or module |
/security-audit deps | dependencies only |
make security (or the project equivalent) — flag known CVEs.security-reviewer agent (fall back to general-purpose with the persona injected only if it's unavailable). The prompt must request severity-rated (Critical/Major/Minor) findings on:
## Security Audit
**Scope:** [...] **Risk Level:** [Critical / Major / Minor / Clean]
### Dependency Vulnerabilities
| Package | Version | CVE | Severity | Fix |
|---|---|---|---|---|
### Code Findings
[reviewer report]
### Configuration Findings
[issues]
### Summary
Critical: [N] Major: [N] Minor: [N]
### Priority Actions
1. …
Same finding-driven gate as everywhere else (quality-and-verification.md): Critical and Major block (Critical additionally blocks deployment, fix immediately); Minor is documented and tracked, never blocking. CVE severities map: High -> Major, Medium/Low -> Minor.