菜单
Use when asked "is this safe to deploy", "pre-deploy check", "deploy checklist", or "/deploy-check". Runs a pre-deployment safety checklist: diff review, rollback plan, dependencies, and go/no-go decision.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | deploy-checklist |
| description | Use when asked "is this safe to deploy", "pre-deploy check", "deploy checklist", or "/deploy-check". Runs a pre-deployment safety checklist: diff review, rollback plan, dependencies, and go/no-go decision. |
Survey the change. In parallel:
git log --oneline origin/main..HEAD
git diff --stat origin/main...HEAD
gh pr view <PR> --json title,body,reviews,statusCheckRollup
Check CI status. All required checks must be green. If any are failing or pending, output NO-GO immediately with the check names.
Run the checklist:
## Pre-deploy Checklist — <service> to <env>
### Change review
- [ ] PR approved by >= 1 reviewer
- [ ] CI all green
- [ ] No secrets or credentials in diff
- [ ] Migrations are backwards-compatible (if any)
- [ ] Feature flags in place for risky changes
### Dependencies
- [ ] Downstream services compatible with this change
- [ ] No shared infra changes that affect other teams
- [ ] External API / third-party dependencies verified
### Rollback plan
- [ ] Previous version is deployable (`git log` shows last good SHA)
- [ ] Rollback command documented: `<command>`
- [ ] Database migrations are reversible (or blue/green deploy)
### Timing
- [ ] Not deploying during peak traffic (check dashboard)
- [ ] On-call engineer aware / available
- [ ] Change window approved (if required)
Go / No-Go decision:
Use when reviewing a backend HTTP / GraphQL handler for validation, authz, errors, performance, observability, and security, or "/backend-review". Produces a structured review with file:line citations.
Use when running a cloud security posture scan (CSPM) on AWS, Azure, or GCP using prowler, scout-suite, or checkov, or "/cloud-scan". Requires read-only credentials; produces CIS-benchmark-aligned findings with remediation.
Use when scanning a container image or Dockerfile for vulnerabilities, misconfigurations, and best-practice violations using trivy, dockle, or hadolint, or "/image-scan". Flags base-image CVEs, root user, missing healthchecks, and bloat.
Use when running an authorized non-intrusive DAST baseline scan (OWASP ZAP baseline, nuclei, nikto) against a web app or API endpoint you own, or "/dast". Requires explicit authorization; refuses unowned targets.
Use when handed a stack trace, error log, or "this is broken" with a paste of output, and asked to find the root cause across frontend, backend, or DB tiers, or "/debug-trace". Produces a hypothesis tree, the evidence supporting each branch, and the next diagnostic step.
Use when scanning a project's third-party dependencies for known CVEs across npm, pip, Go, Maven, Cargo, etc., or "/dep-scan". Runs trivy, npm audit, pip-audit, govulncheck, or osv-scanner and produces a prioritized fix list.