菜单
Handle Trivy CVE findings by adding entries to .trivyignore.yaml when no upstream fix is available. Do NOT use npm overrides to work around transitive dependency CVEs — they break cross-platform lockfile entries (e.g. rollup native binaries).
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Audit that docs/rbac-permission-matrix.md matches the RBAC catalog in code (roles, permissions, and grants in rbac.constants.ts and api-contracts permissions.ts). Reports every mismatch.
Generate CRUD boilerplate (backend NestJS controller/service/module/guard/policy/factory/routes/e2e + frontend Redux slice/thunks/selectors/middleware/spi/api) from a given entity file and a list of methods.
Run the last steps before ending a feature. Shows a form where you can check/uncheck which final steps to run — update changelog, create a branch, run tests-parallel, create a PR — then executes the selected steps in that order.
Create a GitHub issue on bayesimpact/bayes-platform from a free-text description. Drafts a clear title and structured body, picks appropriate labels, and posts it via the gh CLI, returning the issue URL. Optionally enriches the issue with context from the current codebase.
Suggest a Conventional Commits message for the last changes without committing. Analyzes the current diff and returns a ready-to-use commit name.
Run Trivy vulnerability scan on Docker images (API, CPU workers, GPU workers). Builds images, scans for CRITICAL/HIGH CVEs, and reports findings.
| name | trivy-ignore |
| description | Handle Trivy CVE findings by adding entries to .trivyignore.yaml when no upstream fix is available. Do NOT use npm overrides to work around transitive dependency CVEs — they break cross-platform lockfile entries (e.g. rollup native binaries). |
When Trivy (or a CI security scan) reports CVEs in JS dependencies with no clear upstream fix, add them to .trivyignore.yaml with a short expiry.
Never use npm overrides to force-patch transitive dependency versions. Overrides cause npm install to regenerate the lockfile for the current platform only, dropping cross-platform optional native binaries (e.g. @rollup/rollup-linux-x64-gnu). This breaks CI/Vercel builds on Linux.
Prefer .trivyignore.yaml with a short expiry (30-60 days) for CVEs blocked on upstream package maintainers.
Only apply direct fixes (e.g. npm audit fix without --force) if they don't introduce breaking changes.
Read the current .trivyignore.yaml file at the repo root.
For each CVE to ignore, add an entry with:
id: the CVE identifier (e.g. CVE-2026-33671)expired_at: 30-60 days from today (format: YYYY-MM-DD)reason: a short explanation — which package, why no fix is available, what's blocking upstreamUse the Edit tool to append the new entries under the vulnerabilities: key.
Verify the YAML is valid by checking indentation matches existing entries (2-space indent, dash-prefixed list items).
- id: CVE-2026-33671
expired_at: 2026-06-01
reason: "picomatch — no upstream fix available in transitive deps (jest, vite, angular-devkit)"