bookstore

Automatically fix security vulnerabilities by updating affected dependencies. Triggered by the "vuln:" command followed by space-separated tokens. Each token is either JIRA-ID:VULN-ID (e.g. MGD-2423:CVE-2023-46604) or a bare VULN-ID (e.g. CVE-2023-46604) when no Jira ticket exists. Handles CVE IDs automatically by looking them up on NVD. Skips CWE and OWASP IDs with a warning. For each CVE: fetches the affected library, checks if it is used in the repo, finds the minimal safe version, runs baseline tests, applies the fix, rebuilds, re-runs tests, then commits to a new branch and opens a pull request. Use when the user wants to remediate one or more security vulnerabilities in the current repository.

Upgrade one or more components (libraries, frameworks, languages, build tools, CI/CD actions) in the current repository to a target version. Triggered by the "upgrade:" command followed by space-separated tokens in the form "component:version", "component:minor", "component:latest", "component:lts", or bare "component" (latest compatible assumed). Works on any project regardless of language or ecosystem. Upgrades are applied to the current branch with no commits or PRs. Runs tests before and after each upgrade; updates test code if required by the new version. Use when the user wants to keep dependencies, frameworks, languages, or CI/CD actions current.

Use Atlassian CLI (acli) to manage Jira Cloud work items: authenticate, search/fetch tickets by project and status, update/edit fields, transition status, assign, comment, and perform safe bulk operations with JQL. Trigger this skill when the user asks to list Jira tickets, change status, edit issues, or automate Jira workflows via acli.

Investigate GitHub repositories using the gh CLI. Analyze PRs, issues, commits, CI/CD status, repo health, contributor activity, security vulnerabilities, and fetch repo docs/content. Use for any GitHub-related investigation or documentation retrieval.