テスト・セキュリティのスキル

Prove detected findings with runnable, defense-only evidence. For each finding the detect map carries, it writes a safe-path JavaScript test and a self-contained advisory under `.lagune/proofs/`. The test asserts secure behavior, never an exploit.

日本語の概要は準備中です。原文の説明を表示しています。

Detect what the system actually does by reading the code, and map the security-relevant findings (login, uploads, payments, data exposure, and so on) with the evidence later phases need. Scans the whole project, named files, or a focused scope.

日本語の概要は準備中です。原文の説明を表示しています。

Establish or update the project's security charter, the safe-by-default principles every later phase must respect. Reads the project's files to learn what it is and uses, weighs any description you give against them, and asks when something is unclear.

日本語の概要は準備中です。原文の説明を表示しています。

Greenfield project architecture + harness scaffolding for AI Agent productivity. Interview-driven decisions → requirements.md → execute. Produces: Code Structure (vertical slice exemplar), Test Infrastructure, Guard Rails, conditional extensions, AND Harness (CLAUDE.md with domain/team context, rules, skills, hooks). L2: architecture decisions, L3: harness setup, L4: requirements + harness decisions (tasks generated later by /execute into plan.json). Use when: "/scaffold", "scaffold", "new project", "set up project", "프로젝트 세팅", "초기 구조"

日本語の概要は準備中です。原文の説明を表示しています。

Run a full implementation verification pass after code or data changes. Use when the user asks to verify, QA, smoke test, run checks, validate a feature, inspect a local app in the browser, capture screenshots, or turn discovered QA issues into regression tests/checklists with user approval.

日本語の概要は準備中です。原文の説明を表示しています。

Systematically QA test any application — web apps, native macOS apps, Electron apps, CLI tools, interactive REPLs, or anything on screen. Three modes: browser (chromux/CDP, fast, DOM-level), computer (MCP computer-use, screenshot + pixel clicks, any app), and cli (tmux, send-keys + capture-pane for interactive terminals). Auto-selects mode or accepts --browser / --computer / --cli override. Use when asked to "qa", "QA", "test this site", "test this app", "find bugs", "test and fix", "fix what's broken", "dogfood", "exploratory test", "bug hunt", "QA this app", "사이트 테스트", "앱 테스트", "브라우저 QA", "화면 보고 테스트해줘", "네이티브 앱 테스트", "screen test". Three tiers: Quick (critical/high only), Standard (+ medium), Exhaustive (+ cosmetic). Produces before/after health scores, fix evidence, and a ship-readiness summary.

日本語の概要は準備中です。原文の説明を表示しています。

Root cause based one-shot bug fix. debugger diagnosis → requirements.md generation → /execute. /bugfix "error description" Full investigation pipeline: debugger + gap-analyzer + standard verify. QA suggestion after successful fix.

日本語の概要は準備中です。原文の説明を表示しています。

Analyze new commits and generate related test cases.

日本語の概要は準備中です。原文の説明を表示しています。

Full SEO audit powered by the DataForSEO API. Orchestrates 5 specialist subagents (keywords, technical, competitors, content, backlinks) hitting DataForSEO Keywords Data, SERP, On-Page, Backlinks, and Labs endpoints in parallel, then produces a composite SEO Score (0-100) with prioritized action plan and audit JSON ready for PDF export.

日本語の概要は準備中です。原文の説明を表示しています。

软件架构 (含 应用架构 / 系统架构 / 分布式 后端架构 / 前后端 数据流 与 数据模型 设计 / API 边界 / 可扩展性 / 演进式架构 — 不含 硬件架构 / 纯企业架构 / 纯 DevOps / 纯安全架构) (software architecture — application & system architecture for web / mobile / distributed back-ends; designing services + data models + data flow + integration boundaries; making explicit trade-offs about scalability / coupling / consistency / evolvability; not hardware / chip architecture, not pure enterprise-architecture (TOGAF/Zachman), not pure DevOps / SRE, not pure security architecture (those are adjacent disciplines).) Master OS — automated mastery of software architecture — application & system architecture for web / mobile / distributed back-ends; designing services + data models + data flow + integration boundaries; making explicit trade-offs about scalability / coupling / consistency / evolvability; not hardware / chip architecture, not pure enterprise-architecture (TOGAF/Zachman), not pure DevOps / SRE, not pure security architecture (those are adjacent disciplines).: top builders' mental models, tool stack, current workflows, jargon, and where to keep up. Trigger this skill when the user works on software architecture — application & system architecture for web / mobile / distributed back-ends; designing services + data models + data flow + integration boundaries; making explicit trade-offs about scalability / coupling / consistency / evolvability; not hardware / chip architecture, not pure enterprise-architecture (TOGAF/Zachman), not pure DevOps / SRE, not pure security architecture (those are adjacent disciplines). problems and wants industry-grade thinking, tool selection, or workflow guidance. 触发词：「软件架构」「系统设计」「system design」「应用架构」「service design」

日本語の概要は準備中です。原文の説明を表示しています。

独立开发者与微型 SaaS — 单人或极小团队 (≤3 人) 构建可持续订阅收入的软件产品商业, 有别于自由职业/咨询、企业级 SaaS 和开源维护: (a) 产品发现与验证 (自己的痒 vs 市场优先 Nugent/Walling; 着陆页冒烟测试; 先接 Stripe 再写代码; JTBD 访谈适配独立开发者场景; Reddit/HN/X/社区痛点挖掘; Mom Test 验证框架; 公开构建作为验证机制); (b) 独立开发者技术架构 (无聊技术论 McKinley; 单体优先; serverless vs VPS 在 ≤$100/月预算下的取舍; Rails/Django/Laravel/Next.js 等框架的出货速度选型; 托管服务优先于自建; Supabase/PlanetScale/Neon 数据库即服务; Clerk/Auth0 认证即服务; Stripe/Paddle/LemonSqueezy 支付; Vercel/Fly.io/Railway 部署; AI 辅助编码 Cursor/Copilot 作为力量倍增器); (c) 无营销团队的分发与增长 (SEO 作为微型 SaaS 护城河; Product Hunt 发布; AppSumo 终身授权利弊; 冷邮件; Twitter/X 公开构建; IndieHackers 社区分发; 集成市场 Shopify/WordPress/Zapier/Slack 应用目录; 联盟计划; 一人内容营销); (d) 定价与变现 (SaaS 定价心理学; freemium vs 免费试用 vs 纯付费; 按席位 vs 按用量 vs 固定费率; 年付折扣; 老用户保价; 微型 SaaS 流失率控制; MRR/ARR/LTV/CAC 在微型规模的含义; $10K MRR 里程碑心理学); (e) 独立创始人心智模型与生活设计 (default alive vs default dead Graham; 拉面盈利 Levels; 生活方式生意 vs 增长生意的光谱; 独立开发者倦怠预防; 时间管理与上下文切换成本; 地理套利与远程优先; 一次构建反复销售的资产思维; 社区作为支持网络 IndieHackers/WIP/MicroConf); (f) 法务与运营基础 (公司注册地选择 LLC/Ltd/GmbH 税效; Stripe Atlas vs Firstbase vs 本地律师; 服务条款与隐私政策; GDPR/CCPA 低成本合规; 知识产权基础; 首次雇人的承包商 vs 员工选择; 独立开发者会计 SaaS — Xero/QuickBooks; 多辖区税务义务)。中国独立开发者生态: 出海作为主导策略 (从中国构建面向全球市场的产品以避开国内竞争/监管); 即刻/V2EX/少数派作为社区枢纽; 微信小程序作为替代分发; 小报童/爱发电作为中文市场变现; 人民币定价心理学; 支付宝/微信支付集成; ICP 备案要求; 中国区 App Store 审核差异; 独立开发者周刊。诚实处理: 生存偏差 (每一个 Pieter Levels 背后是数千个从未达到 $1K MRR 的人), AI 对微型 SaaS 生态位的颠覆 (wrapper 产品脆弱), 独自构建的孤独与心理健康成本, 公开构建的表演性质 vs 真正透明, AppSumo 终身授权上瘾毁坏单位经济, 样板代码销售的伦理边界。不含: 企业级 SaaS (不同 GTM/销售/融资模型), 不含: 自由职业/咨询 (用时间换钱非建资产), 不含: 开源维护 (不同可持续性模型), 不含: 风投支持的创业 (不同增长期望), 不含: 无代码/低代码平台构建 (相邻但不同受众), 不含: 内容创作作为主业。 (Independent Developer and Micro-SaaS — the craft of single-person or tiny-team (≤3 people) software product businesses that generate sustainable recurring revenue without venture capital, distinct from freelancing/consulting, enterprise SaaS, and open-source maintainership: (a) product discovery and validation (scratching your own itch vs market-first Nugent/Walling; landing page smoke tests; Stripe checkout before code; Jobs-to-Be-Done interview adapted to solo context; Reddit/HN/X/community pain-point mining; idea validation frameworks Fitzpatrick Mom Test; build-in-public as validation mechanism); (b) technical architecture for solo operators (boring technology thesis Mckinley; monolith-first; serverless vs VPS tradeoffs for ≤$100/mo infra; framework selection for shipping speed — Rails/Django/Laravel/Next.js/Remix/SvelteKit; managed services over self-hosted whenever possible; database-as-a-service Supabase/PlanetScale/Neon/Turso; auth-as-a-service Clerk/Auth0/Supabase Auth; payment integration Stripe/Paddle/LemonSqueezy; deployment Vercel/Fly.io/Railway/Render; monorepo vs polyrepo for solo; AI-assisted coding Cursor/Copilot as force multiplier); (c) distribution and growth without a marketing team (SEO as moat for micro-SaaS Ahrefs-style content marketing on 1-person budget; Product Hunt launches; AppSumo lifetime deals tradeoffs; cold email outreach; Twitter/X building in public; IndieHackers community distribution; integration marketplaces Shopify/WordPress/Zapier/Slack app directories as channels; affiliate programs; content marketing at scale-of-one); (d) pricing and monetization (SaaS pricing psychology Patel/Campbell; freemium vs free trial vs paid-only; per-seat vs usage-based vs flat-rate; annual discount strategies; grandfathering existing customers; churn reduction for micro-SaaS — Baremetrics/ProfitWell/ChartMogul analytics; MRR/ARR/LTV/CAC at micro scale; the $10K MRR milestone psychology); (e) solo founder mental model and lifestyle design (default alive vs default dead Graham; ramen profitability Levels; lifestyle business vs growth business spectrum; burnout prevention for solo operators — no team to delegate to; time management and context-switching costs; geographic arbitrage and remote-first; the 'build once sell twice' asset mindset; community as support network IndieHackers/WIP/MicroConf); (f) legal and operational basics (incorporation LLC/Ltd/Gm

日本語の概要は準備中です。原文の説明を表示しています。

DevOps 与站点可靠性工程 (SRE) — 平台 / 基础设施 / 可靠性工程师的认知操作系统, 覆盖软件交付 + 运维全生命周期 (CI/CD 与发布工程 trunk-based + 渐进式发布 canary/blue-green/feature flag + GitOps Argo CD/Flux / 基础设施即代码 Terraform/OpenTofu/Pulumi/Ansible + policy-as-code OPA / 容器与编排 Docker/Kubernetes + Helm/Kustomize + service mesh Istio/Linkerd / 可观测性 Prometheus + Loki + OpenTelemetry + Honeycomb + eBPF + RED/USE / SLO-SLI-error budget 与可靠性工程 Google SRE 学科 + 容量规划 + 优雅降级 / 事件管理与 on-call 事件指挥 + PagerDuty + runbook + 无指责复盘 + MTTR / 云平台与 FinOps AWS/GCP/Azure + 成本优化 + 弹性伸缩 / 平台工程与开发者体验 IDP + Backstage + golden path + Team Topologies / DevSecOps 与供应链安全 shift-left + SBOM + SLSA + sigstore + Vault / 韧性与混沌工程 fault injection + game day + 安全科学 / DORA 指标与工程效能 部署频率 + 变更前置时间 + 变更失败率 + Accelerate 研究 / 数据库与有状态运维 schema 迁移 + 备份容灾) — 不含 通用应用开发 / 纯云销售认证速成 / 'DevOps = 跑 Jenkins 的岗位' 窄化误解 / ITIL 工单文化传统运维 (旧范式仅做边界) / 把手工运维 ClickOps 当稳态 (是 toil, 本 skill 核心反模式) (DevOps & Site Reliability Engineering — the cognitive operating system of platform / infrastructure / reliability practitioners who own the full software delivery + operational lifecycle, covering (a) CI/CD & release engineering (build pipelines, trunk-based development, progressive delivery — canary / blue-green / feature flags, GitOps with Argo CD / Flux), (b) Infrastructure as Code (Terraform / OpenTofu, Pulumi, CloudFormation, Ansible, Crossplane — module design, state management, drift, policy-as-code OPA / Sentinel / Checkov), (c) containers & orchestration (Docker / OCI, Kubernetes — scheduling, networking CNI, storage CSI, operators / CRDs, Helm / Kustomize, service mesh Istio / Linkerd), (d) observability (the three pillars + beyond — metrics Prometheus / VictoriaMetrics, logs Loki / ELK, traces OpenTelemetry / Jaeger / Tempo, high-cardinality observability Honeycomb, eBPF, RED / USE methods, SLO-based alerting), (e) SLO / SLI / error budgets & reliability engineering (Google SRE discipline — service level objectives, error budget policy, toil budgets, capacity planning, load shedding, graceful degradation), (f) incident management & on-call (incident command, PagerDuty / Opsgenie, runbooks, blameless postmortems, MTTR / MTTD, error budget burn), (g) cloud platforms & FinOps (AWS / GCP / Azure well-architected, multi-region, cost optimization, autoscaling), (h) platform engineering & developer experience (internal developer platforms, Backstage, golden paths, self-service, Team Topologies), (i) DevSecOps & supply-chain security (shift-left, SAST / DAST, SBOM, SLSA, sigstore / cosign, secrets management Vault), (j) resilience & chaos engineering (chaos experiments, fault injection, game days, resilience engineering / safety science), (k) DORA metrics & engineering effectiveness (deployment frequency, lead time, change failure rate, MTTR, the Accelerate research), (l) databases & stateful operations (schema migrations, backups / DR, replication); NOT generic software development / app feature coding (是 平行学科, DevOps/SRE 关注 delivery + operability 不是 product feature), NOT pure cloud sales / certification cram without operational depth, NOT 'DevOps = a job title that runs Jenkins' 的窄化误解 (DevOps 是 文化 + 实践, SRE 是 Google 对 reliability 的工程化具体实现), NOT ITIL-heavy 传统运维 工单文化 (是 被 DevOps 取代的旧范式, 仅做边界标注), NOT manual ops / ClickOps as a steady state (是 toil, 本 skill 的核心反模式).) Master OS — automated mastery of DevOps & Site Reliability Engineering — the cognitive operating system of platform / infrastructure / reliability practitioners who own the full software delivery + operational lifecycle, covering (a) CI/CD & release engineering (build pipelines, trunk-based development, progressive delivery — canary / blue-green / feature flags, GitOps with Argo CD / Flux), (b) Infrastructure as Code (Terraform / OpenTofu, Pulumi, CloudFormation, Ansible, Crossplane — module design, state management, drift, policy-as-code OPA / Sentinel / Checkov), (c) containers & orchestration (Docker / OCI, Kubernetes — scheduling, networking CNI, storage CSI, operators / CRDs, He

日本語の概要は準備中です。原文の説明を表示しています。

音乐制作 / 混音 (音乐制作 / 混音 (Music Production & Mixing) — 录音棚与卧室工作室里把一首歌从编曲/录音/编程做到混音/母带成品的工程+艺术认知操作系统，面向制作人(producer)、混音师(mixing engineer)、母带工程师(mastering engineer)、beatmaker、唱作人/bedroom producer，以及想入行/服务这行(录音棚、plugin 厂商、sample 公司)的视角。覆盖: (a) 第一性张力 — **服务歌曲/情绪 (serve the song / emotion-first: 技术只为打动人，'if it sounds good it is good'，用耳朵不用眼睛) ⇄ 技术正确/工程纪律 (technical correctness: gain staging 增益结构、headroom 余量、相位 phase、监听校准、LUFS 响度规范)**; **黄金耳朵/直觉混音 (mix by ears, reference-driven, 不看分析仪) ⇄ 看表/分析仪/规则 (mix by metrics: EQ 曲线、频谱仪 spectrum analyzer、相关计 correlation meter)**; **少即是多/减法混音 (subtractive, 'less is more', 录好源头 = 混音成功一半) ⇄ 重度处理/'we'll fix it in the mix' (heavy processing, 后期补救)**; **In-the-box 全数字 (ITB: DAW + 插件，召回方便，bedroom 可达专业) ⇄ 模拟硬件/outboard (analog console + 硬件，'mojo'/谐波染色 vs 召回噩梦)**; **人性化/groove/不完美 (humanize, push/pull, 'the feel') ⇄ 量化/网格/修音 (quantize to grid, pitch-correct, 'in the pocket' 靠编辑)**; (b) 核心工作流 / pipeline (最标准、最易蒸高质量+CLI 化) — 编曲制作 arrangement/production → 录音/编程 tracking/programming → 编辑 editing (comping 选段/quantize/pitch-correct/time-align) → 混音 mixing (gain staging → balance 平衡 → EQ → compression → 空间 reverb/delay → 自动化 automation → 总线/母线处理 bus/mix-bus) → 母带 mastering (响度/EQ/限制 limiting/dither/排序+间隔) → 交付 delivery (DDP/streaming spec/stems); (c) 工具栈 — DAW (Pro Tools 录音棚标准/Ableton Live 电子+现场/Logic Pro Mac 性价比/FL Studio beatmaker/Cubase/Studio One/Reaper); 插件 (EQ: FabFilter Pro-Q/SSL/API; 压缩: 1176/LA-2A/SSL bus comp 及其复刻 Waves/UAD/Plugin Alliance; 混响: Valhalla/Lexicon/Bricasti; 调音: Auto-Tune/Melodyne; 限制器 limiter: Pro-L 2/Ozone); 硬件 (监听音箱 monitors: Yamaha NS-10/Genelec; 声学处理 acoustic treatment; 转换器 converters: Apollo/RME; 话筒 mics: U47/SM7B/57); 采样/音色 (Splice/sample packs/Kontakt/Serum 合成器); (d) 知识正典 — Mixing Secrets for the Small Studio (Mike Senior)、The Mixing Engineer's Handbook / Recording Engineer's Handbook (Bobby Owsinski)、Zen and the Art of Mixing (Mixerman)、The Art of Mixing (David Gibson 可视化)、Modern Recording Techniques、Sound on Sound 杂志、Mix With The Masters 大师课、Pensado's Place; (e) figures/流派 — 混音大师 (Chris Lord-Alge CLA 摇滚/Andrew Scheps 'Stadium' 3-bus/Tony Maserati/Manny Marroquin/Serban Ghenea 流行隐形混音/Michael Brauer multing); 制作人 (Rick Rubin 减法/氛围、Quincy Jones、Dr. Dre 完美主义、Max Martin 流行结构、Jack Antonoff、Finneas bedroom→Grammy、Metro Boomin/trap、Timbaland、Pharrell); 母带 (Bob Katz K-system/响度战争批判、Bob Ludwig、Greg Calbi); 教育者 (Mike Senior、Pensado、Warren Huart Produce Like A Pro、Dan Worrall 技术深挖); (f) 行业话术/黑话 — gain staging/headroom/LUFS/true peak/comping/bouncing/printing/stems/DI/reamp/sidechain/parallel compression 并行压缩/mid-side/bus/aux/send-return/dry-wet/transient/sibilance/de-ess/pumping/mud 浑浊/harsh 刺耳/boxy/muddy/in the pocket/the pocket/quantize/swing/groove/vibe/mojo/reference track/A/B/recall/print/glue 胶水; (g) 争议/批判 — 响度战争 loudness war (Bob Katz/Loudness Penalty/streaming 归一化 LUFS 终结了吗)、修音/Auto-Tune 之争 (artistic vs cheating)、ITB vs 模拟玄学 (硬件 'warmth' 是否安慰剂、null test 盲测)、preset/AI 混音 (iZotope/LANDR/sample-based 是否毁了 craft)、bedroom producer 民主化 vs 录音棚消亡、'loudness'/over-compression、plugin 复刻 vs 真硬件、Spotify normalization 对母带的影响、过度依赖 reference/抄袭; (h) 创意 vs 技术张力是本行业 deep tacit 知识的核心 — 大量隐性 '听感' 知识难以言传，靠 reference/学徒/千小时积累。不含: 现场扩声 live sound/PA、音乐理论/作曲 composition (虽相关但聚焦录音棚后期制作)、配乐/film scoring (虽相关但聚焦歌曲制作)、纯硬件电子工程/合成器 DIY、音乐商业/版权/发行 (虽相关但聚焦制作技艺本身)。) Master OS — automated mastery of 音乐制作 / 混音 (Music Production & Mixing) — 录音棚与卧室工作室里把一首歌从编曲/录音/编程做到混音/母带成品的工程+艺术认知操作系统，面向制作人(producer)、混音师(mixing engineer)、母带工程师(mastering engineer)、beatmaker、唱作人/bedroom producer，以及想入行/服务这行(录音棚、plugin 厂商、sample 公司)的视角。覆盖: (a) 第一性张力 — **服务歌曲/情绪 (serve the song / emotion-first: 技术只为打动人，'if it sounds good it is good'，用耳朵不用眼睛) ⇄ 技术正确/工程纪律 (technical correctness: gain staging 增益结构、headroom 余量、相位 phase、监听校准、LUFS 响度规范)**; **黄金耳朵/直觉混音 (mix by ears, reference-driven, 不看分析仪) ⇄ 看表/分析仪/规则 (mix by metrics: EQ 曲线、频谱仪 spectrum analyzer、相关计 correlation meter)**; **少即是多/减法混音 (subtractive, 'less is more', 录好源头 = 混音成功一半) ⇄ 重度处理/'we'll fix it i

日本語の概要は準備中です。原文の説明を表示しています。

临床诊断思维 (临床诊断思维 / 临床推理 (Clinical Diagnostic Reasoning) — 医生『怎么想病』的元学科:从症状/体征/检查到诊断结论的认知操作系统,从业者(临床医生/住院医/规培生,尤其全科/急诊/大内科等以未分化主诉为生的科室)、医学生与医学教育者、诊断安全与质量改进研究者、以及做医疗 AI 辅助诊断产品的人的视角。覆盖: (a) 第一性张力 — **直觉模式识别 (System 1: illness scripts 疾病脚本 / pattern recognition / gestalt, 『资深人一眼认出 aunt Minnie』) ⇄ 分析性推理 (System 2: hypothetico-deductive 假设演绎 / Bayesian 概率更新)** 的 dual-process 双过程理论 (Kahneman→Croskerry/Norman 谱系), 资深≠更会分析而是『脚本库更大+校准更好』; 更深层论战 — **『认知去偏可教 (Croskerry: bias awareness / cognitive forcing strategies / diagnostic timeout) ⇄ 偏倚标签是马后炮、知识结构才是主因 (Norman/Sherbino/Monteiro: debiasing 干预 transfer 证据弱, bias 是 hindsight 标签)』** — 本行最核心学术对垒; 『概率思维 (验前概率 × 似然比 → 验后概率, Pauker-Kassirer test/treatment threshold 阈值模型) ⇄ 穷尽式排查 (rule-out everything / 防御性医疗 / VOMIT)』; 『临床 gestalt ⇄ 结构化临床决策规则 (Wells/PERC/HEART)』; 『诊断简约 Occam's razor ⇄ Hickam's dictum (病人可以同时得 N 个病)』; 『床旁体格检查复兴 (Verghese Stanford 25 / McGee 循证体检) ⇄ 影像检验替代床旁』; (b) 方法论正典 — illness script theory (Schmidt/Boshuizen: enabling conditions/fault/consequences 三段结构), problem representation + semantic qualifiers 问题表征与语义限定词 (Bowen NEJM 2006, 把病人翻成 one-liner), hypothetico-deductive model (Elstein 1978《Medical Problem Solving》: 早期假设生成+定向检验), Bayesian 工具箱 (sensitivity/specificity/LR/Fagan nomogram/SnNout-SpPin), threshold model (Pauker-Kassirer NEJM 1975/1980), 认知偏倚分类学 (anchoring/premature closure/availability/confirmation/base-rate neglect/search satisficing/diagnostic momentum — Croskerry 偏倚清单), 去偏与元认知策略 (diagnostic timeout/cognitive forcing/Ely checklist/calibration), schema-based reasoning (Clinical Problem Solvers schemas: 按 pivot 症状走分支), reflective practice 结构化反思 (Mamede/Schmidt), 诊断错误科学 (NAM 2015 报告定义 / Newman-Toker Big Three / Hardeep Singh e-triggers / SAFER Dx 框架); (c) 行业结构与角色 — 医学生→实习/住院医 (晨会 morning report/查房被 pimping/汇报训练)→主治 attending→master clinician (NEJM CPC discussant/晨会大师如 Dhaliwal); 配套生态: 医学教育者 (clinical reasoning curriculum + 评估: script concordance test/key features exam/OSCE), 诊断安全研究者 (SIDM/AHRQ), 诊断辅助与 CDS 工具开发者 (DDx generator/AI); (d) 核心工作流 — 数据采集 (病史为王 + 循证体检 + 针对性检验影像) → 问题表征 (one-liner + semantic qualifiers) → 鉴别诊断生成 (schema / 解剖定位法 / VINDICATE-M 病因筛, 按『常见可能 × 致命不能漏 can't-miss』双轴排序) → 假设定向检验 (按 LR 选检查 / 阈值决策) → working diagnosis + 安全网 (red flags 交代 / test of time / test of treatment) → 反馈校准 (follow-up / M&M / diagnostic timeout); 教学工作流: 晨会渐进披露汇报 / CPC / SNAPPS / one-minute preceptor / virtual morning report; AI 增强工作流 (2023-2026: LLM 鉴别诊断头脑风暴 / OpenEvidence 检索 / ambient scribe 释放认知带宽 + 自动化偏倚 guardrails); (e) 产出物 — one-liner, problem list, prioritized DDx, assessment & plan (按问题分层), 晨会/CPC 汇报, M&M 复盘, 诊断不确定性沟通 (『最可能是 X, 但出现 Y 红旗立刻回来』); (f) 教育与评估 — script concordance test / key feature exam / EPA / 里程碑; 中国语境: 人卫《诊断学》教材 / 执业医师考试 / 规培结业临床思维考核; (g) 争议/批判 — debiasing 之争 (Croskerry vs Norman-Sherbino『knowledge is the cure』, 去偏 RCT 效果弱 / bias 标签不可证伪), 诊断错误率数字之争 (『10-15%』经典估计 / Newman-Toker 79.5 万美国年严重伤害外推方法被质疑 / 尸检符合率), dual-process 二分被批过度简化 (连续谱 / 难以实证分离), 决策规则 vs gestalt (资深 gestalt 常不输 Wells 类规则 / 算法厌恶), vignette 研究外推性 + context/case specificity (推理高度内容绑定不可通用迁移 [Norman/Eva] — 对『教推理通用课』产业的根本批判), AI 辅助诊断 2023-2026 (GPT-4 在 NEJM CPC/vignette 追平或超医生 [Kanjee 2023 JAMA / Goh 2024 JAMA Netw Open『AI alone > physician+AI』悖论] / Google AMIE / OpenEvidence 爆发 vs 自动化偏倚 / 去技能化 / 真实环境验证缺失), 防御性医疗与过度检查 (incidentaloma 瀑布 / VOMIT), 体检衰亡之争, pimping 教学法争议; (h) 流派/思想谱系 — 决策科学/Bayesian 派 (Ledley-Lusted 1959 → Elstein/Kassirer/Sox/Pauker/Eddy → Brush) vs 认知心理/双过程派 (Kahneman-Tversky → Croskerry/Graber) vs 教育认知派 (Schmidt/Boshuizen illness scripts → Norman/Eva/Mamede/Durning 情境认知) vs 诊断安全/系统派 (NAM 2015 / Newman-Toker / Hardeep Singh / Graber-SIDM: 错误=系统×认知共因) vs 床旁临床派 (Osler 传统 → Tierney aphorisms / Verghese / McGee / Dhaliwal / Saint: 病史体检为王 + 刻意练习) vs AI/计算派 (INTERNIST-1/DXplain 专家系统 → Isabel → LLM 世代 Rodman/Topol)。不含: 具体专科治疗方案与手术决策深度 (足踝外科/种植牙等另有 skill), 中医辨证 (另有 skill), EBM 文献批判性评价方法学 (相关但本 skill 聚焦诊断推理本身), 护理诊断体系 (NANDA), 影像/病理知觉型读片训练 (相邻但独立), 精神科 DSM 结构化访谈细节, 医患沟通技巧全集 (只覆盖诊断不确定性沟通), 患者自查/自我诊断指

日本語の概要は準備中です。原文の説明を表示しています。

红队渗透 / 攻防 — 受授权的红队作业者 + 渗透测试工程师 + 攻击型安全顾问的认知操作系统 (侦察 OSINT / 外网渗透 / 内网 AD 渗透 BloodHound + Kerberoasting + ADCS 利用 + 横向移动 / Web 应用渗透 OWASP WSTG / 移动 OWASP MASTG / 云渗透 AWS Azure GCP IAM 路径 + 容器逃逸 + K8s / C2 操作 Cobalt Strike Sliver Mythic Havoc + OPSEC / 初始访问 + AV EDR 绕过 (仅授权场景) / 无线 RF / 物理社工 / 报告与整改 / 框架 MITRE ATT&CK + D3FEND + PTES + OSSTMM + NIST 800-115 + Kill Chain / 法律伦理 CFAA + 网络安全法 + 刑法 285 286 + 数据安全法 + GDPR + 授权书 + 范围 + 交战规则 — 不含 黑产 / 未授权攻击 / 大规模 exploitation / 供应链投毒 / 未授权 DoS — 这是 重罪 + 行业封杀 + 律师吊销, 本 skill 严守 authorized-only 边界 — 也不含 蓝队 SOC + 恶意软件 即服务 / 僵尸网络 / 勒索软件作者 — 这是 cybercrime 不是 红队) (Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasion (phishing infrastructure, payload development, AV / EDR evasion, BYOVD, AMSI / ETW bypass — strictly for authorized engagements), (i) wireless / RF (WPA2/3, evil twin, Wi-Fi pivots), (j) physical / social engineering (badge cloning, pretexting, vishing — under engagement letter), (k) reporting & remediation (executive summary, technical findings, CVSS, MITRE ATT&CK mapping, retest), (l) frameworks & methodology (MITRE ATT&CK, MITRE D3FEND, PTES, OSSTMM, NIST SP 800-115, OWASP WSTG / MASTG, Cyber Kill Chain, Unified Kill Chain, Diamond Model), (m) law & ethics (CFAA US, Computer Misuse Act UK, 中国 刑法 285/286 + 网络安全法 + 数据安全法, GDPR for tested EU systems, engagement letter, scope, rules of engagement, safe harbor for bug bounty); NOT criminal hacking / 黑产 / unauthorized targeting / mass exploitation / supply-chain compromise / DoS against unconsented systems (这是 重罪 + 业内开除 + 律师执照吊销, 本 skill 严守 authorized-only 边界), NOT pure defensive blue team / SOC analyst tradecraft (是 平行学科, 仅做 边界标注 + ATT&CK 反推方向), NOT malware-as-a-service development / botnet ops / ransomware authoring (是 cybercrime 不是 红队), NOT 'ethical hacking' 在 'just curious 看看' 自我合理化的灰色操作 (违反 authorization 原则即不是 红队).) Master OS — automated mastery of Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasi

日本語の概要は準備中です。原文の説明を表示しています。

Flagship intra-paper self-consistency forensics: does the paper contradict ITSELF across abstract/intro/tables/body/appendix, and does the method DESCRIBED match the method EVALUATED? Needs no external ground truth — works PDF-only (L0). Runs a deterministic arithmetic pass + a fresh cross-model semantic pass, every finding span-anchored to the evidence ledger (claims.json), reviewer≠adjudicator. Emits consistency-audit.findings.json; NEVER computes the verdict. Triggers: "consistency audit", "check the paper against itself", "self-consistency", "内部自洽".

日本語の概要は準備中です。原文の説明を表示しています。

Audit experiment integrity against the evidence ledger. At L2 (repo + result files present) a fresh cross-model reviewer reads the eval code line-by-line for fake/derived ground truth, score self-normalization, phantom results (a paper number with no backing file/key), dead/uncalled metric code, verified-scope inflation, method-described ≠ method-evaluated drift, synthesized-looking results, placeholder/fake data still wired into a released result, code-output ≠ reported-number mismatch, and missing reproducibility artifacts (an empirical/agent/LLM paper shipping neither code nor the prompts/configs its results need) — every finding span-anchored to a ledger claim_id. At L0/L1 (PDF / source only) the same patterns are surfaced as info-level 'could-not-verify' signals where the ledger gives an anchor (observability_level_required:2) — NEVER a fraud verdict from a PDF. The reviewer PROPOSES findings; tools/adjudicate_findings.py computes the verdict. Detect-only. Triggers: "experiment forensics", "audit the results", "check the eval code", "实验诚实度".

日本語の概要は準備中です。原文の説明を表示しています。

Build the deterministic evidence ledger (artifact_manifest.json + claims.json) that every other Anti-Autoresearch auditor reads. One pass inventories artifacts, derives the observability level (L0 PDF-only / L1 +LaTeX / L2 +repo+results) by fixed rule, and extracts span-anchored, hashed, checkable claims (numbers, comparisons, scope, method, baselines, citations, captions, table cells) into claims.json. An OPTIONAL additive cross-model pass ADDS span-anchored semantic claims — method, theorem statements with their assumptions, definitions, proof/derivation steps and equations, scope, baselines, conclusions, the motivation span, and reproducibility-artifact references (the proof, derivation, and structure anchors the family B/D/G auditors need) — it never invents a number, emits a finding, or computes a verdict. Run FIRST, before any audit skill. Triggers: "build the ledger", "extract claims", "prep for integrity audit", "evidence ledger", "建证据账本".

日本語の概要は準備中です。原文の説明を表示しています。

Audit whether a paper's baseline comparisons are COMPLETE, FAIR, and SIGNIFICANT: a required recent SOTA baseline is missing while 'best/SOTA' is claimed (HP-MISSING-BASELINE); a baseline is undertuned / given less compute-tuning-data, run at a mismatched config, or the equal-budget ablation-as-baseline is absent (HP-WEAK-BASELINE); 'outperforms' is asserted over overlapping error bars or with no variance/seeds (HP-SIG-OVERLAP); and a cross-row 'improves over baseline by X%' is arithmetically wrong (HP-DELTA-ERROR, cross-row form only). A versioned per-domain baseline profile + a live leaderboard/recency search are assembled by the EXECUTOR as structured facts; a fresh cross-model reviewer (gpt-5.6-sol xhigh, read-only, fresh thread per dimension) PROPOSES findings, each span-anchored to a ledger claim_id; tools/adjudicate_findings.py DECIDES the verdict. Works at L0 (stated comparisons) and deepens at L2 (configs/result files). A completeness question it cannot settle internally becomes needs_external_check, never a guessed missing baseline. Emits baseline-comparison-audit.findings.json; computes NO verdict. Detect-only. Triggers: "baseline audit", "missing baselines", "is the comparison fair", "weak baseline", "baseline 误报", "SOTA earned?".

日本語の概要は準備中です。原文の説明を表示しています。

Family-G proof & derivation integrity forensics: does a THIRD PARTY's written proof/derivation actually establish its theorem, or does it skip an obligation, assume its own conclusion, take an invalid step, drift a symbol's meaning, or smuggle an unstated assumption? Decides from the WRITTEN proof/derivation — verdict-bearing at L1 (the LaTeX source; PDF-extracted math is unreliable, so an L0 PDF-only run surfaces info only) — never asserts 'fabricated', only that the step shown does not hold. A fresh cross-model reviewer reads the theorem/proof + an extraction-only obligation scaffold and proposes per-obligation findings, each span-anchored to the evidence ledger (claims.json); reviewer≠adjudicator. Emits proof-derivation-forensics.findings.json; NEVER computes the verdict. dimension=proof, can be critical. Triggers: "proof forensics", "check this proof", "derivation integrity", "audit the math", "证明审计", "推导有没有漏洞".

日本語の概要は準備中です。原文の説明を表示しています。

Transparent, itemized impressions of AI-generated WRITING STYLE — the repo's ONLY non-integrity track. Two passes: a deterministic defensive-hedge density screen (tools/check_ai_style.py, AIS-DEFENSIVE-HEDGE) plus a fresh cross-model GROSS-cases-only semantic pass over the 13 AIS-* style tells (broken narrative arc, LLM phrase tics, jargon-stuffing, invented codenames, clause/formula walls, gratuitous pseudocode, bullet overuse, bold-module spam, restatement loops, focus drift, single-style figures, appendix dumping). Every finding is named, LOCATED, span-anchored to the evidence ledger (claims.json), carries not_integrity_finding:true + false_positive_risk:high + an fp_case, and gets ZERO verdict weight: the adjudicator forces it to info, excludes it from overall_verdict, and renders it in a SEPARATE report section. NOT an AI-text classifier — no scores, no "this is AI-written", no authorship probability; a paper can be CLEAN_GIVEN_EVIDENCE and still list many. Emits ai-style-impressions.findings.json; computes NO verdict; if a tell is actually substantive it routes to the integrity auditor. Triggers: "AI style", "vibe check", "writing fingerprint", "AI 文风", "vibe paper".

日本語の概要は準備中です。原文の説明を表示しています。

Synthesize the single strongest EVIDENCE-BOUND reviewer case to reject a paper, built ONLY from the evidence ledger (claims.json) + the other auditors' confirmed findings — never free-floating LLM critique. Two fresh cross-model codex threads: an attack writes the ~200-word rejection paragraph (every accusation tagged to an existing claim_id/finding_id), a defense decomposes it and rules each point against the anchored evidence. MEMO-ONLY: emits adversarial-case-builder.memo.md (fed to the adjudicator via --memo) and carries NO verdict weight — tools/adjudicate_findings.py lists it in ZERO_WEIGHT_SKILLS and caps it at info. Honest-null allowed (the paper may survive). Run LAST. Detect-only. Adapted from ARIS kill-argument. Triggers: "adversarial case", "strongest objection", "rejection memo", "kill argument", "最强拒稿点".

日本語の概要は準備中です。原文の説明を表示しています。

Nielsen's 10 usability heuristics. Use when auditing an interface, designing interaction flows, writing error messages or reviewing usability.

日本語の概要は準備中です。原文の説明を表示しています。

Lighthouse audits and Core Web Vitals — LCP, CLS, INP. Use when optimising page load, layout shift, input delay, images, fonts or render-blocking resources.

日本語の概要は準備中です。原文の説明を表示しています。