菜单
Use whenever answering anything version-sensitive — library/framework/SDK APIs, package versions, model IDs, pricing, CLI flags, config, or "latest/newest" anything. Verify against current sources instead of training data.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Build a regression + eval harness for AI-written code and AI features. Generates characterization tests that lock current behavior before a refactor, scaffolds a Promptfoo eval suite for chatbots/RAG/classifiers, and wires it into the ship-gate. Use when the user wants evals, regression tests for AI code, to stop AI features drifting, or to test an LLM feature.
Run security audit — dependency vulnerabilities, secret scanning, OWASP pattern detection, HTTP headers. Use when user wants to harden their project.
Accessibility audit + auto-fix (WCAG 2.2 A/AA). Scans built/static HTML for screen-reader, keyboard, and structure failures, fixes the deterministic ones, and escalates to a rendered scan for contrast and focus. Use when the user wants to check or improve accessibility, fix WCAG issues, or pass an a11y review.
Turn the /ship scorecard into a blocking, config-as-code quality gate. Sets per-category score thresholds, hard-fails on leaked secrets or critical findings, and wires the gate into a pre-push hook and CI so nothing below the bar merges. Use when the user wants a merge gate, CI quality gate, pre-push check, or to enforce ship-readiness.
Post-deploy canary monitoring — checks site health, detects regressions, monitors for errors after deployment. Use after deploying to verify production is healthy.
Code review with principal-engineer-level depth. Reviews for correctness, performance, security, maintainability, and architecture. Use when completing tasks, reviewing PRs, or before merging.
| name | staying-current |
| description | Use whenever answering anything version-sensitive — library/framework/SDK APIs, package versions, model IDs, pricing, CLI flags, config, or "latest/newest" anything. Verify against current sources instead of training data. |
| allowed-tools | Bash, Read, WebSearch, WebFetch |
Training data has a cutoff. Libraries ship breaking changes, prices change, model IDs get renamed, and APIs get deprecated after that cutoff. Answering version-sensitive questions from memory is the single most common way an otherwise-correct agent ships wrong code. This skill is the standing rule for not doing that.
The Ultraship Currency Guard hook (UserPromptSubmit) already fires on every prompt and injects a reminder when it detects version-sensitive language. This skill is what you do when that fires — or any time you're about to state a fact whose correct answer changes over time.
Before stating any of the following, verify it against a current source. Never answer from training data alone:
| Source | Use for |
|---|---|
context7 MCP (resolve-library-id → query-docs) | Library/framework/SDK documentation and API syntax. This is the primary source for code. Use it even when you think you know the answer. |
| WebSearch / WebFetch | Versions, pricing, model IDs, release notes, deprecations, anything not in a library's docs. The current month is the search context — say "2026" in queries when recency matters. |
The project's lockfile (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, Cargo.lock) | The exact version actually installed here — always check this before assuming a version. |
import or hook call from memory for a library you haven't checked this session.When the task involves Claude, the Anthropic API, model IDs, or pricing, the same rule applies with extra force — these change frequently. Verify model IDs and pricing against current Anthropic docs before quoting them.