Skip to content
cccskills
FreePublished on GitHub

vuln-check

Review resolved dependency versions and relevant code for security vulnerabilities. Get findings with evidence, impact, and targeted remedies, distinguishing published dependency warnings from exploit paths demonstrated in the project.

OriginalShow the original description

Check resolved dependencies and relevant code paths for security vulnerabilities. Use for security checks or /vuln-check; use audit for a broader correctness and maintainability assessment.

See how to install

Good for

  • Check dependencies for known vulnerabilities
  • Trace untrusted input to sensitive operations
  • Locate potential secrets in committed files
  • Prioritize security fixes using evidence

Files included (1)

  • SKILL.md1.8 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

Assess the requested security surface with evidence. A check returns findings; implement remediation when the user has requested it.

  1. Read package.json and pnpm-lock.yaml for the affected dependency paths. Use current advisory data, such as pnpm audit, and record the resolved version, advisory, affected range, and verified fixed version where available. Distinguish a dependency advisory match from a demonstrated exploit path in this project.
  2. Trace untrusted inputs through guards to sensitive operations: shell execution, filesystem access, plugin capabilities, and terminal escape output. For paths, check containment and symlink behavior where relevant; normalization alone does not prevent traversal. Inspect actual validation and authorization before treating a suspicious API as a vulnerability. Scan committed repository files for potential secrets; report only the path, line, and secret type, never the value or a source excerpt.
  3. Report findings by severity with location, trigger, impact, evidence, and the smallest effective remedy. Separate confirmed issues from leads needing verification. Preserve the upstream peer/dev dependency contract when proposing upgrades.
  4. State the scope, sources checked, and gaps. If advisories are unavailable, report that the dependency check is incomplete; absence of findings is not a claim that the project is vulnerability-free.

Report potential secrets only by path, line, and type, never their value or a source excerpt. Do not run automatic dependency fixes as part of a check; for requested remediation, make targeted changes and validate the affected paths.

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

audit

FreeSummary

Audit a repository or broad subsystem for security, correctness, and maintenance risks. Trace how inputs reach affected behavior, verify suspected defects, and report confirmed findings with severity, triggers, impact, and practical remedies.

  • Auditing risks across a repository
  • Checking state loss and resource limits in a TUI
  • Checking dependencies for known vulnerabilities
ccch1mneyyy/dsh-TUI5.2KUpdated Oct 22, 2026

bug

FreeSummary

Turn a reported defect into a concise bug report or issue draft that someone else can reproduce or investigate. Organize symptoms, reproduction steps, expected and actual behavior, environment, and impact while separating evidence from unknowns.

  • Turning a defect description into a bug report
  • Organizing reproduction steps and expected behavior
  • Adding evidence from logs and relevant code
ccch1mneyyy/dsh-TUI5.2KUpdated Oct 22, 2026

dsh-tui-guide

FreeSummary

Answer questions about dsh-tui using its bundled manuals. Find relevant guidance on installation, shortcuts, configuration, themes, session migration, and VS Code integration, then cite the source file and section for checking.

  • Looking up shortcuts and everyday operations
  • Checking configuration and theme settings
  • Finding guidance for migrating sessions
ccch1mneyyy/dsh-TUI5.2KUpdated Oct 22, 2026

pr

FreeSummary

Prepare and publish a pull request with a linked issue, English commit and PR titles, and a Chinese description explaining the change, implementation, and verification. Update an existing branch PR and report its URL and CI status.

  • Publishing current code changes as a pull request
  • Rewriting a PR description to match the final changes
  • Adding diagrams and rendered terminal output to a PR
ccch1mneyyy/dsh-TUI5.2KUpdated Oct 22, 2026

pr-comments

FreeSummary

Turn existing pull request review comments into prioritized next steps by checking them against the current code. Separate outstanding concerns, addressed feedback, and questions needing replies, then implement and validate fixes when requested.

  • Prioritizing pull request review feedback
  • Checking whether comments still apply to current code
  • Implementing and validating requested review fixes
ccch1mneyyy/dsh-TUI5.2KUpdated Oct 22, 2026

practice

FreeSummary

Practice one programming concept through a small exercise matched to your goals, experience, and available time. Get feedback based on observable results, with hints or explained solutions and a harder variation when you are ready.

  • Practicing a programming concept in 10–15 minutes
  • Understanding display width for CJK characters and emoji
  • Tracing event order and cleanup
ccch1mneyyy/dsh-TUI5.2KUpdated Oct 22, 2026

See all skills by ccch1mneyyy

Report a problem with this skill