lightdash/lightdash✦ 精选0°

fix-vulnerability

仓库创建 2021年3月19日最近提交 1 天前SkillHot 收录 1 天前

⬈ GitHub 仓库 ⬈ SKILL.md 原文件 ⬇ Raw 原始文件

▸ 精选理由

能自动化判断升级风险并生成说明，适合维护依赖安全。

▸ 风险提示

可能会拉取外部 changelog/资源，注意网络请求安全与信任源。

这个 Skill 做什么

处理 Snyk/依赖升级 PR：重建 lockfile、检查 changelog 并汇报影响。

帮你把 Snyk 或类似的依赖升级 PR 处理好：会重建 pnpm lockfile、检查相关 changelog 找出可能的 breaking change、把关键信息改好并作为 PR 评论汇报。碰到有人指派“修这个漏洞 PR”或收到依赖升级时用它。特别之处是把锁文件重建和变更影响分析都自动化，并在 PR 里留下清晰的结论供审查。

▸ 展开 SKILL.md 英文原文

Fix a Snyk vulnerability PR by regenerating the pnpm lockfile, checking changelogs for breaking changes, and posting findings as a PR comment. Use when asked to fix a vulnerability PR or handle a Snyk dependency upgrade.

开发编程依赖修复锁文件Snyk审查Claude Code

6.0k

Stars

750

Forks

仓库内 Skill

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/lightdash/lightdash/main/.claude/skills/fix-vulnerability/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/lightdash/lightdash/main/.claude/skills/fix-vulnerability/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

# Fix Vulnerability PR

Process a Snyk (or similar) dependency upgrade PR: rename the PR, regenerate the lockfile, analyze changelogs for breaking changes, and post a summary comment.

The user must provide a PR URL or number as `$ARGUMENTS`. If not provided, ask for it.

## Step 1: Fetch PR details

Extract the PR number from the argument and fetch the PR diff to understand what changed:

```bash
# Get PR metadata
gh pr view <PR_NUMBER> --json number,title,body,headRefName,baseRefName

# Get the diff to see which dependencies changed
gh pr diff <PR_NUMBER>
```

Parse the diff to identify:
- Which packages were upgraded (package name, old version, new version)
- Which `package.json` files we

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有