菜单
Analyze project dependencies for security vulnerabilities, license compliance, and staleness. Use when auditing dependencies, checking for CVEs, reviewing license obligations, or assessing upgrade risk. Not for actually upgrading packages (use update:deps instead).
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Improve a SKILL.md file by applying missing or weak skill-authoring patterns (17 patterns across 7 categories). Use when a skill needs strengthening, after running skill:check to identify gaps, or when creating a new skill from scratch. Do NOT use for prompt-level improvements (use prompt:enhance instead) or for evaluation only (use skill:check instead).
Run a baseline-enhance-reeval loop on a SKILL.md to measure improvement. Generates targeted test cases for enhanced patterns to ensure the comparison reflects actual improvement in changed areas. Use when testing whether skill:enhance actually improves eval scores, measuring skill quality before and after changes, or automating the measure-enhance-measure workflow. Do NOT use for evaluation only (use /eval-run instead), for enhancement only (use skill:enhance instead), or for setting up eval infrastructure (use /eval-analyze and /eval-dataset instead).
Evaluate a SKILL.md file using three-layer linting: schema validation, 17 skill-authoring patterns, and optional substance review (--deep). Use when reviewing skill quality, checking pattern coverage, testing activation metadata, or assessing a skill before sharing. Add --deep for qualitative substance review. Do NOT use for prompt-level analysis (use prompt:skill-checker instead) or for enhancing/rewriting skills (use skill:enhance instead).
Deploy a service to the staging environment with health checks and rollback. Use when asked to deploy, push to staging, release to staging, or test a deployment. Do NOT use for production deployments (use deploy:production instead) or for CI/CD pipeline configuration.
Format source code files
Run database migrations against the target environment. Use when applying schema changes, running pending migrations, or checking migration status. Do NOT use for seed data insertion or database backups.
| name | review:dependencies |
| description | Analyze project dependencies for security vulnerabilities, license compliance, and staleness. Use when auditing dependencies, checking for CVEs, reviewing license obligations, or assessing upgrade risk. Not for actually upgrading packages (use update:deps instead). |
| allowed-tools | ["Read","Bash","Glob"] |
| user-invocable | true |
Perform a read-only analysis of the project's dependency tree. This skill reads lock files, queries vulnerability databases, and produces a structured report. It does not modify any files.
Detect which package manager the project uses by checking for lock files:
package-lock.json or yarn.lock or pnpm-lock.yaml -> Node.jsCargo.lock -> Rustgo.sum -> Gorequirements.txt or poetry.lock or uv.lock -> PythonIf multiple lock files exist, analyze all of them and report separately.
For each detected ecosystem, run the appropriate audit command:
npm audit --json or yarn audit --jsoncargo audit --jsongovulncheck ./...pip-audit --format jsonParse the JSON output and extract: package name, installed version, vulnerability ID (CVE), severity, and fixed version (if available).
Read the lock file to extract all transitive dependencies and their licenses. Flag any dependency using:
For each direct dependency, compare the installed version against the latest available:
Output a markdown table with columns:
| Package | Version | Latest | Staleness | Vulnerabilities | License | Action Needed |
Sort by severity: vulnerabilities first, then license issues, then staleness.