菜单
Audit dependencies across cargo outdated, cargo deny check, and cargo audit. Produce tiered findings: Blocking (CVEs), Suggestions (major bumps), Nitpicks (minor/patch bumps). Can auto-apply patch updates when asked.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Audit godmode skills, agents, and plugin files for internal consistency, broken references, stale commands, and cross-skill contradictions. Use when asked to "introspect", "audit the skills", "review godmode", or after adding new skills.
Use at the start of every conversation to orient to available skills and workspace rules. Replaces superpowers entirely. Triggers on session start, "/godmode", or "what skills do you have".
Generate and maintain a `.ctx/godmode/memory-bank/` directory that captures project context backed by source code. The memory bank is injected into prompts via lifecycle hooks and updated incrementally as work progresses. Use when starting a new project, onboarding to an unfamiliar codebase, or when context drift is detected.
Patterns and techniques for adding governance, safety, and trust controls to AI agent systems in Rust. Use this skill when building agents that call external tools, implementing policy-based access controls, adding semantic intent classification to detect dangerous prompts, creating trust scoring systems for multi-agent workflows, building audit trails, or enforcing rate limits and content filters. Covers policy composition, tool wrappers, trust decay, and JSONL audit trails — all in Rust.
Parse git history into structured changelogs. Use to generate release notes, audit commit conventions before tagging, or integrate with `godmode release` workflow.
Dead code detector for Rust workspaces. Finds unused public API surface, orphaned test helpers, stale feature flags, and plugin artifacts referencing removed CLI subcommands. Cross-references pub exports against call sites across the workspace.
| name | godmode:dep-audit |
| description | Audit dependencies across cargo outdated, cargo deny check, and cargo audit. Produce tiered findings: Blocking (CVEs), Suggestions (major bumps), Nitpicks (minor/patch bumps). Can auto-apply patch updates when asked. |
| requires | [] |
| next | ["dep-bump"] |
Lists all crates with available updates. Categorizes by version bump type.
cargo outdated --workspace
Output shows:
Flag each update by severity:
Scans for:
cargo deny check
Any advisory or license failure is Blocking or Suggestion level (depending on license policy).
Scans the vulnerability database for known CVEs in transitive dependencies.
Use cargo deny check advisories instead of cargo audit — cargo-audit 0.22
cannot parse CVSS 4.0 entries in the advisory DB (upstream bug; crashes at DB
load time before any --ignore flags can be applied).
cargo deny check advisories --config .config/deny.toml
Reports advisory ID, affected crate, and severity. Always Blocking.
Findings that are expected/accepted should be added to the [advisories] ignore
list in .config/deny.toml with a documented rationale comment.
Report findings in three sections:
- <crate> <version> — <CVE-ID or advisory> — <description>
- <crate> — <license> incompatible with <project license>
- <crate> <current> → <latest> — <reason or breaking change summary>
- <crate> <current> → <latest>
Omit sections with no findings.
When a crate appears in multiple Cargo.toml files (workspace, sub-crates),
note version mismatches:
- <crate> version mismatch: root uses X, crate-foo uses Y
When asked to "apply patches" or "fix it":
cargo update -p <crate> --precise <version>cargo deny check advisories --config .config/deny.toml to verify no new conflictscargo check --workspace to verify all builds succeedGuardrails:
Stop the audit if:
cargo outdated output is malformed (binary missing or broken)cargo deny or cargo audit crash with unrecoverable errorReport the error and ask for manual investigation.