テスト・セキュリティのスキル

Expert PCI DSS compliance advisor covering PCI DSS v4.0.1 (current) and v4.0. Use this skill whenever a user asks about PCI DSS, payment card security, cardholder data protection, CDE scoping, SAQ types (A, A-EP, B, B-IP, C, C-VT, P2PE, D), ROC, AOC, QSA assessments, ASV scans, merchant levels, service provider levels, network segmentation, penetration testing, tokenisation, encryption of PAN data, or any of the 12 PCI DSS requirements. Also trigger for questions like "are we PCI compliant?", "how do I scope my CDE?", "which SAQ applies to us?", "what changed in PCI DSS v4.0?", "how do I prepare for a QSA audit?", or any request involving payment data security, cardholder data environment, or PCI certification readiness.

日本語の概要は準備中です。原文の説明を表示しています。

Detects prompt injection hidden in documents from the other side (pleadings, skeletons, bundles, served evidence, opponents' emails and attachments) before an AI reads them, so the model is not turned against your client. Checks word by word that the text an extractor hands the model was visibly drawn on the page: white, near-white, covered, clipped, off-page, tiny, transparent and invisible-mode text in PDF (ink test plus OCR); Word formatting resolved as Word does (styles, shading, theme colours, scaling, off-page frames, fallbacks, unused headers); HTML/CSS, RTF, email with attachments and zips, xlsx/pptx and legacy formats. Flags Unicode smuggling, text addressed to an AI and authorities found only in hidden text. Fails closed. Optional Read-tool hook. Use BEFORE any AI summary or analysis of an opposing or third-party document. Triggers: 'scan for injection', 'is this document safe', 'check the other side's skeleton', 'injection guard'.

日本語の概要は準備中です。原文の説明を表示しています。

a skill that determines whether a given subject matter qualifies for copyright protection under EU law by applying the Cofemel two-step test (concept of work + originality), grounded in fifteen CJEU judgments (including the most recent Mio/Konektra and Calinescu) and the four EU directive provisions on originality. It argues from one of two positions: pro-rightsholder (establishing that the work is original) or pro-alleged-infringer (contesting work status or originality via the four exclusion grounds — technical function, rule-dictated outcome, sweat of the brow, idea/functionality). It includes sector-specific modules for photography, software/GUI, sporting events, databases, applied art, functional texts, derivative works/critical editions, and multimedia works.

日本語の概要は準備中です。原文の説明を表示しています。

Prepare a lawyer for an adversarial proceeding the way Neal Katyal's "Harvey" prepared him for the SCOTUS tariffs argument: profile the tribunal from their prior opinions and questions, predict the specific questions you will face, map narrow "escape routes" each judge can walk through without abandoning prior commitments, and spar adversarially until only the strongest answers survive. The model is the sparring partner. The human still wins the case. Use when: preparing for oral argument, appellate argument, motion hearing, evidentiary hearing, deposition (taking or defending), arbitration, mediation, or any proceeding where a known decision-maker will fire questions at you in real time. Also useful for stress-testing a brief before filing. Proactively suggest when: the user mentions an upcoming hearing/argument with named judges or arbitrators, drafts a brief and wants it pressure-tested, asks "what will Justice X / Judge Y ask me," or talks about preparing for a specific bench.

日本語の概要は準備中です。原文の説明を表示しています。

Audits legal AI outputs and workflows for honest compression: unnecessary complexity, false simplicity, excessive caveats, hidden uncertainty and poor cost per legally acceptable output.

日本語の概要は準備中です。原文の説明を表示しています。

GDPR Legitimate Interest Assessment (LIA) — Guided assessment for Art. 6(1)(f) GDPR using the EDPB three-step test. Based on EDPB Guidelines 1/2024, EDPB Opinion 28/2024 (AI models), the OSS Case Digest on Legitimate Interest (McIntyre 2026), CNIL AI guidance (June 2025), ICO guidance, and key CJEU case law. Use when: (1) user needs to assess whether legitimate interest is appropriate, (2) user asks about Art. 6(1)(f), "Interessenabwägung", "berechtigtes Interesse", "balancing test", or "LIA", (3) user wants to document a legitimate interest assessment, (4) user mentions the three-step test, (5) user evaluates necessity or proportionality under Art. 6(1)(f), (6) user discusses direct marketing, fraud prevention, IT security, employee monitoring, AI training, web scraping, or credit checks in context of legal basis, (7) user handles a right to object (Art. 21), (8) user asks about children's data, profiling, or cross-border data sharing under legitimate interest, (9) user compares legitimate interest against other legal bases. Do NOT use for: consent assessments (Art. 6(1)(a)), contract performance (Art. 6(1)(b)), DPIA workflows, or pure ePrivacy/cookie compliance questions — though the skill does address the ePrivacy/GDPR overlap where relevant.

日本語の概要は準備中です。原文の説明を表示しています。

Turns a legal question, a set of draft questions, or source material such as a statute, jury instruction, rubric, contract checklist, or coding manual into a battery of narrow questions that TypeSafe's Jev, a fast classifier that returns probabilities rather than prose, can answer reliably across many documents. The skill breaks conclusions such as negligence, felony murder, or standing into element-level questions, writes the governing rule into each question, and delivers the questions alone, in Jev's request format or in plain English. Built for legal work that asks the same questions of many texts: coding statutes across jurisdictions, coding opinions or case files for empirical research, checking contracts against a review checklist, screening intake narratives, and grading student work against a rubric. Use when asked to write Jev questions, build a classifier for legal documents, or turn a legal test into yes-or-no questions. Running the questions requires Jev access; writing them does not.

日本語の概要は準備中です。原文の説明を表示しています。

Expert ISO 27001 compliance assistant for security and compliance teams. Use this skill whenever a user asks about ISO 27001 or ISO/IEC 27001, including any of the following: gap analysis, auditing, compliance assessments, control checklists, policy writing, document generation, Statement of Applicability (SoA), risk assessment, risk registers, risk treatment plans, Annex A controls, ISMS implementation, clause requirements, certification readiness, transitioning from 2013 to 2022, control implementation guidance, incident response policies, access control policies, supplier security, or any information security management system (ISMS) topic. Trigger even if the user doesn't say "skill" — any ISO 27001 or ISMS question should use this skill.

日本語の概要は準備中です。原文の説明を表示しています。

Expert ISO 27701 Privacy Information Management System (PIMS) compliance advisor. Use this skill whenever a user asks about ISO/IEC 27701:2025, ISO/IEC 27701:2019, privacy information management, PIMS certification, PII controller or processor obligations, privacy risk assessment, Statement of Applicability for privacy, privacy by design, data subject rights, DPIA, records of processing activities, transitioning from ISO 27701:2019, GDPR alignment with ISO 27701, or any privacy management system topic. Also trigger for questions about Annex A.1 (controller controls), A.2 (processor controls), A.3 (shared security controls), or implementing a standalone PIMS without ISO 27001. When in doubt, use this skill — it covers the full ISO 27701 lifecycle from gap assessment through certification.

日本語の概要は準備中です。原文の説明を表示しています。

Expert ISO 42001 AI Management System (AIMS) compliance advisor. Use this skill whenever a user asks about ISO/IEC 42001:2023, AI governance, AI management systems, AI risk assessment, AI system impact assessment, Annex A controls for AI, Statement of Applicability for AI systems, AI policy, responsible AI, AI lifecycle management, AI incident management, AI transparency, AI bias, AI certification readiness, or any topic related to implementing or auditing an AI Management System. Also trigger for questions like "how do I become ISO 42001 certified?", "what controls does ISO 42001 require?", "how do I assess AI risk under 42001?", "what is an AIMS?", or any request involving organisational governance of AI systems, responsible AI frameworks, or AI regulatory compliance aligned to an ISO standard.

日本語の概要は準備中です。原文の説明を表示しています。

Builds a high-fidelity interactive legal assessment as a single self-contained HTML artifact. Output includes a live countdown timer, contract review tasks with hover-annotated problem clauses, candidate answer textareas, model answers hidden behind reveal blocks, scenario-based legal memo tasks, strategy and function-building questions, and a pre-submission checklist that encodes the marking criteria. Use when the user needs to (1) assess a legal candidate with a realistic timed exercise, (2) train or onboard junior lawyers using problem sets rather than doctrine, (3) help a candidate prepare for a real take-home assessment they are facing, (4) build educational materials for law students, in-house teams, or compliance training, or (5) produce scenario-based training modules on specific legal topics. Triggers on "legal test", "take-home", "mock exam", "contract redline exercise", "candidate assessment", "legal training exercise", "practice test", or similar phrasing even when informal.

日本語の概要は準備中です。原文の説明を表示しています。

Audits the transition from legal AI output to reliance, recommendation, execution, or real-world commitment. Use it before an AI-generated analysis, memo, contract review, compliance finding, or workflow output is acted upon to check whether authority, evidence, mandate, uncertainty, procedure, and review conditions remain sufficient.

日本語の概要は準備中です。原文の説明を表示しています。

Firm-matter matching, matter instruction drafting, firm onboarding checklist, and instruction audit for in-house legal ops teams. Match a new matter to the right panel firm by practice area, jurisdiction, complexity, and cost tier. Produce a structured matter instruction with scope, timeline, budget, staffing, and reporting requirements. Generate an onboarding checklist covering conflict clearance, engagement letter, OCG acknowledgment, e-billing setup, and platform access. Audit an existing instruction for completeness and produce a remediation note. Trigger on: 'which firm should handle this', 'instruct the firm', 'write the instruction', 'matter instruction template', 'onboard the firm', 'set up the matter', 'conflict check', 'e-billing setup', 'is our instruction complete', 'review our instruction', 'instruction gap', 'allocate this matter'.

日本語の概要は準備中です。原文の説明を表示しています。

Use when a security incident, data breach, or actively exploited vulnerability raises the question "who must we notify, where, and by when?" Screens one incident across the EU reporting regimes — NIS2, GDPR, DORA, and the Cyber Resilience Act — determines which duties fire for each involved entity's roles, resolves the receiving authority per regime and member state from served national law, and produces a deadline table in which every duty, authority, and deadline is cited from official publisher text fetched live through the Ansvar Gateway MCP connector. Never answers from model memory.

日本語の概要は準備中です。原文の説明を表示しています。

Expert Australian Information Security Manual (ISM) advisor for government entities and their supply chains. Use for ISM control selection, gap analysis, system authorisation, IRAP assessment preparation, security documentation, and ASD compliance. Triggers on: ISM controls, ASD compliance, IRAP assessment, PROTECTED system scoping, Essential Eight vs ISM, system authorisation, NC/OS/ PROTECTED/SECRET/TOP SECRET classification markings, security objectives, ISM guidelines or chapters, control applicability markings, cybersecurity documentation for Australian government, and any question about the ASD Information Security Manual framework or Australian government cybersecurity obligations.

日本語の概要は準備中です。原文の説明を表示しています。

Audits legal AI outputs, prompts, skills, workflows and MCP/tool instructions for fluent but unsupported reasoning, missing evidence, overconfidence, hidden assumptions, weak causal links and absent human-review gates.

日本語の概要は準備中です。原文の説明を表示しています。

Expert HIPAA compliance assistant for healthcare and software contexts. Use this skill whenever the user mentions HIPAA, PHI (Protected Health Information), ePHI, covered entities, business associates, healthcare data privacy, medical records, health information security, BAA (Business Associate Agreements), or any compliance review involving patient data. Also trigger for requests to draft privacy notices, HIPAA policies, consent forms, security risk assessments, or breach notification letters. Use for developers building healthcare software who need technical safeguard guidance (encryption, access controls, audit logs), compliance officers reviewing documents or procedures, and anyone asking "is this HIPAA compliant?" or "what does HIPAA require for X?". When in doubt about whether a healthcare or data privacy question falls under this skill — use it.

日本語の概要は準備中です。原文の説明を表示しています。

Generates a formal, structured AI Act compliance assessment report suitable for legal files, audit trails, and regulatory inquiries. This skill should be used when the user asks to "generate an AI Act report", "create a compliance assessment report", "document the AI Act analysis", "create a Prüfbericht", "export as Word document", or wants to consolidate prior AI Act skill outputs into a formal documented assessment.

日本語の概要は準備中です。原文の説明を表示しています。

Expert DORA (Regulation (EU) 2022/2554 — Digital Operational Resilience Act) compliance advisor for EU financial entities. Use this skill whenever a user asks about DORA compliance, ICT risk management frameworks, ICT incident classification or reporting, threat-led penetration testing (TLPT), ICT third-party risk management, Register of Information, contractual provisions with ICT providers, ICT concentration risk, oversight of critical ICT third-party service providers (CTPPs), or any DORA RTS/ITS obligation. Also trigger for: "DORA gap analysis", "DORA readiness", "Art. 6 ICT risk framework", "Art. 17 incident reporting", "Art. 26 TLPT", "Art. 28 third-party policy", "Art. 30 contractual provisions", "Register of Information CIR 2024/2956", "critical TPSP designation", "DORA vs NIS2", "DORA simplified framework", or EBA/ESMA/EIOPA digital resilience guidance.

日本語の概要は準備中です。原文の説明を表示しています。

Expert EU Cyber Resilience Act (CRA) advisor for Regulation (EU) 2024/2847 — mandatory cybersecurity and vulnerability handling requirements for all products with digital elements (PDEs) sold in the EU. Use this skill for gap analysis, product classification (Default / Class I / Class II), conformity assessment route selection, CE marking, SBOM requirements, vulnerability and incident reporting to ENISA/CSIRTs, support period obligations, and manufacturer/importer/distributor duties. Trigger for EU CRA, Cyber Resilience Act, PDE compliance, Annex I requirements, SBOM EU, CE marking cybersecurity, or connected product security EU.

日本語の概要は準備中です。原文の説明を表示しています。

Expert guidance for FedRAMP certification and compliance under CR26 (FedRAMP Consolidated Rules for 2026). Use this skill whenever a user asks about FedRAMP authorization, ATO (Authority to Operate), cloud security for federal government, NIST SP 800-53 controls, CSP compliance, or any of the core FedRAMP document types: SSP, SAP, SAR, POA&M, CIS/CRM workbooks. Also trigger for questions about FedRAMP Certification Classes (A, B, C, D — new baseline labels: A = pilot/transitional, B = LI-SaaS/Low, C = Moderate, D = High, per NTC-0004), FedRAMP 20x (now the primary authorization pathway), OSCAL mandate (September 2026), 3PAO assessments, continuous monitoring (ConMon), gap assessments, system boundary definition, or architecture reviews for federal cloud. FedRAMP Ready retires July 28, 2026. When in doubt, use this skill — it covers the full FedRAMP lifecycle from readiness through continuous monitoring.

日本語の概要は準備中です。原文の説明を表示しています。

Expert GDPR compliance assistant covering all four core workflows: (1) auditing code and systems for GDPR violations, (2) drafting GDPR-compliant documents such as privacy policies, Data Processing Agreements (DPAs), and consent notices, (3) answering GDPR compliance questions with authoritative article citations, and (4) reviewing data flows and PII handling practices. Use this skill whenever the user mentions GDPR, data protection, privacy compliance, lawful basis, data subject rights, DPA, privacy notices, consent management, data breaches, DPIAs, controller/ processor relationships, cross-border data transfers, or any EU/UK data privacy topic. Also trigger for questions like "is this GDPR compliant?", "how do I handle personal data?", "what does a privacy policy need?", or any request involving PII, personal data, or data retention in a regulatory context.

日本語の概要は準備中です。原文の説明を表示しています。

Elite incident response and legal compliance guidance for data breaches under GDPR Articles 33 & 34. Use when: (1) User reports a data breach or security incident — including "is this even a personal data breach?" triage, (2) User asks about breach notification obligations or deadlines, (3) User mentions "72 hours", Art. 33, Art. 34, or notification requirements, (4) Discussion involves security incidents affecting personal data, (5) User needs breach risk assessment using ENISA methodology, (6) User mentions "Data Breach" or "Incident" or "Data Leakage" or "Ransomware" or "Exfiltration", (7) User needs to determine Controller vs Processor obligations, (8) Cross-border breach scenarios requiring Lead SA determination, (9) User needs a mitigation playbook or immediate response recommendations, (10) User needs audit-ready breach documentation (.docx) or an EDPB-template-aligned breach notification / evidence file — including follow-up and withdrawal notifications, (11) Breach involves an AI system requiring AI Act Art. 73 serious incident screening.

日本語の概要は準備中です。原文の説明を表示しています。

A drafting-and-review copilot for a founders' / co-founders' agreement — the terms fixing equity, vesting, IP, roles, control, deadlock, and departure between cofounders. Jurisdiction-agnostic, anchored on the Delaware C-corp default. Two modes: DRAFT (intake → equity & vesting → clauses → blocker triage → pre-signature check) and REVIEW (audit an existing agreement against an 18-clause checklist and red-flag scan). It handles the highest-dispute terms first-class: the equity split as documented reasoning (not a fake calculator), reverse vesting and the 83(b) clock, present-tense IP assignment (the Stanford v. Roche trap), leaver buyback and dead equity, and the deadlock clause most tools omit. It drafts for the venture, never one founder against another. Not legal advice.

日本語の概要は準備中です。原文の説明を表示しています。