菜单
Triage and fix Dependabot alerts and CodeQL findings in the ai repository. Use when the user asks to address security vulnerabilities, fix Dependabot alerts, resolve CodeQL issues, or do security maintenance.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
ALWAYS use this skill whenever you would otherwise ask the user a question in free-form chat -- for clarifications, confirmations (especially destructive actions), missing parameters, multiple-choice decisions, or structured form input. Elicitations are routed through the Unique AI Platform UI via `unique-cli elicit create` + `elicit wait` (or `elicit ask` outside an agent harness) so the user gets a proper structured prompt and you get a structured answer back. Do NOT ask the user in plain chat when you can use this skill instead.
Read Agentic Table (magic table / due-diligence) sheets through the unique-cli agentic-table command. Use when the user or task involves inspecting an Agentic Table: a sheet's state and metadata, a specific cell's value or lock state, a cell's edit/answer history, or the sheet's generated export artifacts (reports, question exports). These are read-only (Tier 0) commands — they never modify the sheet and never require confirmation. Access to each sheet is enforced by the platform; a denial is reported as `agentic-table: permission denied`.
Call MCP (Model Context Protocol) server tools on the Unique AI Platform using the unique-cli mcp command. Use when the user asks to invoke, call, or execute an MCP tool, or when they need to send a JSON payload to an MCP server through the CLI. The JSON payload is forwarded 1:1 to the platform's MCP call-tool API.
Invoke connected Unique spaces/subagents through the unique-cli subagent command. Use when the workspace exposes connected-space tools and you need to delegate a question or task to one of those configured assistants.
Search the Unique AI Platform knowledge base using the unique-cli search command, with automatic per-turn citation tracking so cited facts render as clickable reference chips and `<sup>N</sup>` footnotes on the Unique platform. Use whenever the user asks to find, search, or query documents or content on Unique, including filtering by folder or metadata. Also covers `unique-cli read <cont_id>` for reading the full indexed text of a document when its content ID is already known. NOTE: This search uses combined vector + full-text indexing. Excel (.xlsx/.xls), CSV (.csv), and image files are NOT full-text indexed, so they will not appear in search results. To locate these file types, use the unique-cli-file-management skill instead (browse folders with `unique-cli ls` to find them by name).
Search the documents uploaded for the CURRENT task/row (e.g. an Agentic Table row's attached files) via the `unique-cli uploaded-search "<query>"` command, with the same per-turn citation tracking as `unique-cli search` so cited facts render as `<sup>N</sup>` footnotes and clickable reference chips on the Unique platform. ALWAYS use this skill when the user refers to documents they uploaded/attached to this task, or when you need facts from the task's own attached files. These uploaded files are scoped to the chat, NOT to a knowledge-base folder, so they will NEVER appear in `unique-cli search` results no matter the folder or metadata filters. Use `unique-cli search` for the knowledge base and this command for the task's uploaded documents; the two are complementary and citation numbering is shared across them within a turn.
| name | security-maintenance |
| description | Triage and fix Dependabot alerts and CodeQL findings in the ai repository. Use when the user asks to address security vulnerabilities, fix Dependabot alerts, resolve CodeQL issues, or do security maintenance. |
| license | MIT |
| compatibility | claude cursor opencode |
| metadata | {"version":"2.0.0","languages":"python","audience":"developers","workflow":"automation","since":"2026-04-14"} |
I drive the security maintenance workflow for the ai repository to keep both dashboards at zero:
Versions and changelogs are fully owned by release-please (config: release-please-config.json, manifest: .release-please-manifest.json). CI enforces this via .github/scripts/check-no-manual-release.sh, which fails any PR that modifies:
CHANGELOG.md.release-please-manifest.jsonversion = "..." line in any pyproject.tomlBecause of that:
CHANGELOG.md or bump version by hand. Do not use the release-process skill to justify manual edits in security PRs — that skill documents automation, not hand bumps.git-conventional-commits). For Dependabot/CodeQL fixes use fix(<scope>): ... so release-please groups them under "Bug Fixes". Use chore(deps): ... only for risk-free dep bumps you don't want to surface in user-facing notes (it's hidden in the changelog).Never merge Dependabot auto-PRs. Use constraint-dependencies in the root pyproject.toml instead.
gh api --paginate); the Dependabot endpoint is cursor-paged and a single per_page=100 call silently caps at 100.constraint-dependencies in root pyproject.toml with "<package>>=<fixed-version>".exclude-newer conflicts — if the fix version is within the 2-week rolling window, add an exclude-newer-package timestamp (day after latest PyPI upload). See exclude-newer reference.exclude-newer-package entries — remove any timestamp older than 2 weeks (redundant, global window already covers it). Keep = false entries.uv lock --refresh. If resolution fails, bump the timestamp and retry.fix/dependabot-<pkg>-<ver> (single CVE) or fix/security-<date> (batch). Subject: fix(deps): bump <pkg> to >=<ver> (GHSA-xxxx) or fix(security): batch dependabot fixes <date>. Do not touch CHANGELOG.md or any version = ... field — release-please will pick the commit up on the next standing Release PR.fix(<package-or-area>): <what was hardened> (CodeQL <rule-id>). Again: no manual changelog/version edits.exclude-newer-package entries.fix(...) subjects so release-please attributes bumps to the right workspace package(s) on the next Release PR.check-no-manual-release.sh, then close any resolved Dependabot auto-PRs after merge.constraint-dependencies persists across relocks; auto-PRs only edit uv.lock.CHANGELOG.md, .release-please-manifest.json, or version = ... — check-no-manual-release.sh will block the PR.fix(...) not chore(deps): ... when you want the fix to appear in user-facing release notes; chore is hidden by the changelog config.uv uses strict < on individual wheel upload times).