Claude Skills · Code Review & Testing
Magpie Dependency Audit
apache/magpieRead-only dependency vulnerability audit for one repository or a local checkout. Detects the project's dependency manager(s), runs the appropriate audit tool, surfaces patchable findings grouped by severity, and proposes upgrades for maintainer review. Never modifies manifests or lock files and never opens update PRs.
At a glance
This skill is for Code Review & Testing and helps you audit dependency vulnerabilities, review patchable security findings, and identify dependency upgrades.
git clone --depth 1 https://github.com/apache/magpie
cp -r magpie/skills/dependency-audit ~/.claude/skills/dependency-audit
Setup, runtime and requirements describe apache/magpie, the repo this skill ships in.
securityVulnerabilitiesdependency-managementapacheauditMaintenance
Also in apache/magpie
View the repoFor a batch of findings from a non-security audit tool (`<audit-tool>` — ruff / flake8 / mypy / pylint / CodeQL / Apache Verum / Apache Caer...
Read-only audit of GitHub Actions workflow runner compatibility for one repository, an explicit repository set, one Apache project with mult...
Post-vote committer and PMC onboarding for Apache projects. Walks the nominator through every step from ICLA check to welcome announcement f...
Read-only GitHub activity card for a named contributor on <upstream>. Fetches PR authorship, code-review activity, issues, and PR/issue comm...
Read-only nomination brief for a named GitHub contributor on <upstream>. Aggregates GitHub activity across all contribution tracks plus main...
Measures contributor-sentiment signals on <upstream> over a configurable window: thread tone (first-response classification), time-to-first-...
Read-only readiness tracker that maps a contributor's GitHub activity against the adopter's PMC-declared committer or PMC thresholds and sur...
Read-only license audit of a project's direct and transitive dependency tree. Detects the dependency manager(s), resolves each dependency's...
Read-only flaky-test detection from GitHub Actions CI run history for one repository. Parses workflow run outcomes over a configurable windo...
Draft a single net-new *good first issue* on the configured `<upstream>` repo from one supplied candidate such as a known gap or a small mai...
Sweep the open `<issue-tracker>` backlog for existing issues that could be labelled as good first issues. Classifies each candidate as READY...
Read-only maintainer dashboard for the open general-issue backlog of <issue-tracker>. Surfaces a health rating, prioritised recommendations,...
Other Code Review & Testing skills
Migrate test files from `as` type assertions to @total-typescript/shoehorn. Use when user mentions shoehorn, wants to replace `as` in tests,...
A relentless interview to sharpen a plan or design, which also creates docs (ADR's and glossary) as we go.
Move issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.
Create exercise directory structures with sections, problems, solutions, and explainers that pass linting. Use when user wants to scaffold e...
Use when you need to resolve an in-progress git merge/rebase conflict.
A relentless interview that asks every frontier question at once, round by round.