菜单
Report outdated and vulnerable packages across the backend (Directory.Packages.props / Hiscary.sln) and frontend (client/package.json) in one combined summary. Invoke when the user says "dependency check", "check for outdated packages", "any vulnerable dependencies", or "/dependency-check".
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Cross-reference Application write-service methods / Angular components against existing test files, ranked by how central each file is (referenced-by count), to surface the highest-leverage places to add tests next. Invoke when the user says "find untested code", "what's untested", "test coverage gaps", or "/find-untested".
Scaffold a brand-new bounded context (all backend layer projects, solution wiring, API gateway route, and the matching Angular feature folder). Invoke when the user says "new bounded context", "scaffold context", "add a bounded context", or "/new-bounded-context <ContextName>".
Brainstorm at least 10 automation ideas for this project across three tiers (plain non-AI automation, AI-assisted SDLC support, AI agentic loops), then create one GitHub issue per idea the user picks. Invoke when the user says "automation ideas", "how could we automate this project", "suggest some automations", or "/automation-ideas".
Implement a spec generated by /spec. Reads .claude/specs/{slug}/design.md, executes each task in Section 8 in order, marks tasks complete as it goes, verifies acceptance after each task, and stops on failure. Invoke when the user says "implement issue
Report open GitHub issues/PRs, failing CI runs, pending EF Core migrations per bounded context, Nx-affected projects since the last release tag, stale branches, and outdated/vulnerable packages — one combined health snapshot. Invoke when the user says "project health", "health check", "how healthy is the repo", or "/project-health".
Drop and recreate the local dev Postgres database, then reapply every bounded context's EF Core migrations in dependency order. Refuses to run against anything but localhost. Invoke when the user says "reset dev db", "reset local database", "wipe my local postgres", or "/reset-dev-db".
| name | dependency-check |
| description | Report outdated and vulnerable packages across the backend (Directory.Packages.props / Hiscary.sln) and frontend (client/package.json) in one combined summary. Invoke when the user says "dependency check", "check for outdated packages", "any vulnerable dependencies", or "/dependency-check". |
| allowed-tools | Bash Read |
/dependency-check
dotnet list package --outdated and --vulnerable cannot be combined in one call — run them separately:
dotnet list server/src/Hiscary.sln package --outdated
dotnet list server/src/Hiscary.sln package --vulnerable
Both commands emit NU1902/NU1903 warnings inline during restore even without --vulnerable — don't mistake those restore-time warnings for the --vulnerable report itself; run the explicit command too so the report is complete and not just whatever happened to print during restore.
cd client
npm outdated
npm audit --json
Summarize npm audit's JSON output by severity count (critical/high/moderate/low) rather than dumping the raw JSON — it's large. npm outdated output is already compact; include it close to verbatim.
Two sections, Backend and Frontend, each with two subsections (Outdated, Vulnerable). For vulnerabilities, always name the specific package, current version, and severity — a summary like "3 vulnerabilities found" without naming them isn't actionable. Cross-reference: if the same underlying library shows up outdated in both --outdated and --vulnerable (common — an outdated package is often also the vulnerable one), note that explicitly since upgrading once fixes both findings.
Do not attempt to upgrade anything automatically — this skill reports, it doesn't modify Directory.Packages.props, package.json, or lock files. If the user wants to act on a finding, that's a separate, explicit follow-up.