Comprehensive guide for setting up and configuring CodeQL code scanning via GitHub Actions workflows and the CodeQL CLI. This skill should be used when users need help with code scanning configuration, CodeQL workflow files, CodeQL CLI commands, SARIF output, security analysis setup, or troubleshooting CodeQL analysis.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Performs security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame for context, calculates blast radius by counting callers, checks test coverage of modified code, and generates a markdown report. Use when reviewing a PR, commit, or diff for security vulnerabilities, checking whether a change re-introduces a previously fixed bug, asking what else a change could break, or finding which modified code has no test covering it.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Refactor given method `${input:methodName}` to reduce its cognitive complexity to `${input:complexityThreshold}` or below, by extracting helper methods. Use when a method exceeds a cognitive-complexity threshold flagged by a linter or review.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Refactors code surgically without changing behavior: extract functions, rename, break up large functions and classes, reduce complexity, and remove code smells. Use when code is hard to understand or extend, or the user asks to clean up, refactor, or improve existing code.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Reviews and refactors code according to the project's own instruction and guideline files, keeping behavior intact. Use when the user asks for a cleanup pass that must follow repository conventions (for example .github/instructions) rather than generic best practices.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Interactive onboarding that learns your communication style, audiences, and data sources to configure personalized status briefings. Paste in examples of updates you already write, answer a few questions, and roundup calibrates itself to your workflow. Use the first time Roundup is used, or to recalibrate its style and sources.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when designing new API endpoints, defining module boundaries or contracts between teams, creating component prop interfaces, or changing an existing public interface. Covers naming, versioning, error shapes, and designing surfaces that are hard to misuse.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when setting up a project's CI pipeline, adding or changing automated checks, configuring deployment pipelines, or debugging CI failures. Covers quality gates, pipeline stages, and what to verify automatically on every change.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when working code feels heavier than it needs to be — deeply nested logic, long functions, unclear names, duplication after a merge, or a review that flagged complexity. Reduces complexity while preserving behavior exactly. Not for code you do not yet understand, or code you are about to rewrite.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Establishes a project's quality bar as a written contract and stops agents quietly lowering it. Interviews the user on which dimensions matter, supplies sane default thresholds when they have no number in mind, records everything in CONSTRAINTS.md, and watches the diff for a weakened bar — new @ts-ignore or eslint-disable suppressions, skipped or deleted tests, assertions stripped out, unimplemented stubs, thresholds edited down. Use when no quality bar is written down, when the user says "set up constraints" or "define our standards", when the user wants dimensions they care about — accessibility, web performance, coverage — set up as enforced constraints, when an agent keeps silencing checks or skipping tests to get to green, when you need a coverage or performance threshold and don't know what number to pick, or when an agent writes more code than anyone will read.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when replacing an old system, API, or library, sunsetting a feature, consolidating duplicate implementations, removing dead code nobody owns, or deciding whether to maintain a legacy system versus migrate off it. Covers deprecation timelines, migration paths, and safe removal.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when you want every assumption cross-examined before proceeding, when stress-testing a plan for hidden failure modes, when correctness matters more than speed, when working in unfamiliar code, when stakes are high (production auth, security-sensitive logic, a high-stakes migration, irreversible operations), or any time a confident output would be cheaper to verify now than to debug later.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when building or modifying user-facing interfaces: new components and pages, responsive layouts, interactivity and state management, or fixing visual and UX issues. Covers component architecture, styling, accessibility, and state boundaries.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when refining a vague idea through divergent expansion, convergent focus, and assumption stress-testing before planning or implementation.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Delivers changes incrementally. Use when implementing any feature or change that touches more than one file. Use when you're about to write a large amount of code at once, or when a task feels too big to land in one step.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Profiles macOS and iOS apps with Instruments and xctrace: choosing templates such as Time Profiler, launching binaries with arguments, recording traces, and exporting results. Use when a Mac or iOS app needs CPU, memory, or responsiveness profiling.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Profiles native macOS and iOS apps from the command line only: xctrace recording, Time Profiler samples, hotspot ranking, and symbolication with atos and vmmap. Use for headless or SSH-based performance analysis without opening the Instruments GUI.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Instruments code so production behavior is visible and diagnosable. Use when adding logging, metrics, tracing, or alerting. Use when shipping any feature that runs in production and you need evidence it works. Use when production issues are reported but you can't tell what happened from the available data.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when performance budgets or SLAs exist, users or monitoring report slowness, Core Web Vitals fall below thresholds, a change may have caused a regression, or a feature handles large datasets or high traffic. Measure-first workflow: profile, fix the proven bottleneck, re-measure. Not for speculative optimization.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when a task feels too large or vague to start, a spec needs breaking into implementable units, work must be parallelized across agents or sessions, or implementation order is unclear. Produces ordered tasks with acceptance criteria. Skip when the spec already contains well-defined tasks.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when building anything that accepts user input, implementing authentication or authorization, storing or transmitting sensitive data, integrating external APIs, or adding file uploads, webhooks, or callbacks. Covers input validation, secrets, authz checks, and PII and payment handling.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.