テスト・セキュリティのスキル

Heuristic security scan of installed skills — prompt-injection phrases, hidden unicode instructions, credential-store access, network-pipe-to-shell and payload-smuggling patterns. Use when the user asks 'are my skills safe', wants to scan skills for prompt injection or malware patterns, or before trusting a newly installed skill. Trigger with '/janitor-security'.

日本語の概要は準備中です。原文の説明を表示しています。

Find new skills on GitHub or check a specific skill before installing. Use when the user wants to search for skills, evaluate a skill URL, check overlap and security risk before installing, or compare a local skill against alternatives. Trigger with '/janitor-discover'.

日本語の概要は準備中です。原文の説明を表示しています。

Show whether each skill is earning its context-window cost — combined tokens-used view sorted by waste. Use when the user asks 'are my skills worth it', 'what's my context budget', 'which skills are dead weight', or wants to audit skill value, token cost, or usage. Trigger with '/janitor-value'.

日本語の概要は準備中です。原文の説明を表示しています。

Use when writing tests for Rust service code - unit tests beside the code, integration tests in tests/, tokio::test, Router::oneshot for HTTP, sqlx::test for a fresh database per test, trait fakes or mockall at ports, test-first

日本語の概要は準備中です。原文の説明を表示しています。

Use when writing tests for C#/.NET code - xUnit structure, NSubstitute or the repository's mocking library at ports, WebApplicationFactory for HTTP, Testcontainers Postgres for EF Core, FakeTimeProvider, test-first

日本語の概要は準備中です。原文の説明を表示しています。

Use when writing tests for a TypeScript service on Node.js - Vitest or the repository's Jest / node:test, fakes at port boundaries, HTTP through app.inject or supertest, Testcontainers Postgres for queries, fake timers, test-first

日本語の概要は準備中です。原文の説明を表示しています。

Use when the diff adds or changes a loopback HTTP or WebSocket server, a bind address, a Unix socket, named pipe, XPC or D-Bus service, an Electron or Tauri main-process handler, a custom URL scheme or file association, a privileged helper or updater, or code that spawns tools inside directories a user or download supplied

日本語の概要は準備中です。原文の説明を表示しています。

Quick mode for the rest of the session. Instead of CI's full checks, a change runs only the checks it can affect (format, lint, types and build, its own tests, and every unit, integration, flow and browser test that reaches the code it touched), and the rest of the suite is left for a full run such as a pull request's CI. Runs only when the user types it, and `/first-pass:quick off` turns it off.

日本語の概要は準備中です。原文の説明を表示しています。

Use when reviewing Python changes - Django, Flask and FastAPI handlers, subprocess, SQL, Jinja2, format strings, and data/ML code that loads pickles, models, notebooks or remote model code

日本語の概要は準備中です。原文の説明を表示しています。

Use when reviewing iOS (Swift), Android (Kotlin) or Flutter changes - token storage, ATS and cleartext config, TLS trust, exported components, deep links, WebView JavaScript bridges, certificate pinning claims, secrets bundled in the app, Firebase rules

日本語の概要は準備中です。原文の説明を表示しています。

Use when the diff calls a model, exposes a tool to one, feeds it fetched or user content, renders or executes its output, stores agent memory or conversation history, asks a user to approve an agent action, routes MCP tools, or changes agent settings, MCP configs, tool policies or prompt files - including this platform's own agents

日本語の概要は準備中です。原文の説明を表示しています。

Use when reviewing Java or Kotlin server changes on Spring or Quarkus - security config and method security, JPA/JPQL and JdbcTemplate queries, request binding, deserialization, XML parsers, SpEL, templates, Actuator, JNDI and reflection

日本語の概要は準備中です。原文の説明を表示しています。

Use when reviewing Go changes - net/http and Fiber handlers, database/sql and GORM queries, os/exec, filepath and os.Root, html/template, crypto, TLS and SSH clients, JSON binding

日本語の概要は準備中です。原文の説明を表示しています。

Use when a candidate finding falls into a noisy category - the do-not-report list, the precedents that settle recurring edge cases, and the narrow exceptions where an excluded category still counts

日本語の概要は準備中です。原文の説明を表示しています。

Use when semgrep, osv-scanner, github-security or snyk MCP tools appear in your tool list - what each server is for, how to call it safely, what data leaves the machine, and how its findings are triaged

日本語の概要は準備中です。原文の説明を表示しています。

Use when deciding the verdict of a security review - severity anchors and confidence scale, when to block, approve with notes, add a needs-validation note, drop or reject as unreviewable, the smallest-fix rule and the exact comment templates

日本語の概要は準備中です。原文の説明を表示しています。

Use when the diff renders user-controlled content as HTML, builds links or redirects, changes CSP or CORS, adds a cookie-authenticated state change or WebSocket, a postMessage handler, a markdown renderer, a service worker, browser storage of tokens or private data, a frameable sensitive action, or an Electron/Tauri window

日本語の概要は準備中です。原文の説明を表示しています。

Use when you want deterministic evidence for a review - which already-installed scanners may be run against the checkout, their exact read-only invocations, how to triage their output, and what must never be run or installed

日本語の概要は準備中です。原文の説明を表示しています。

Use when starting any security review in code_review - risk-tier each changed file, read the repo's own security patterns, compare, then trace source to sink, including removed guards and blast radius

日本語の概要は準備中です。原文の説明を表示しています。

Use when reviewing Node.js or TypeScript server code - Express/Fastify/Nest handlers, Next.js server actions and route handlers, child_process, ORM raw queries, prototype pollution, template engines, JWT and outbound HTTP clients

日本語の概要は準備中です。原文の説明を表示しています。

Use when reviewing game code in C#, GDScript or C++ (Unity, Godot, Unreal, custom engines) - client vs server authority, RPC and packet validation, in-app purchases and economy, save and replay files, mod and script loading, secrets in client builds

日本語の概要は準備中です。原文の説明を表示しています。

Use when the diff changes a GitHub Actions workflow, a reusable action, a CI cache or artifact handoff, a Dockerfile or compose file, Terraform/HCL, Kubernetes manifests or Helm values, an environment overlay, a workload identity binding or a cloud OIDC trust policy - judged only where concretely exploitable

日本語の概要は準備中です。原文の説明を表示しています。

Use when you have a candidate security finding and before it goes in a comment - restate it as a crossed boundary, prove reachability, impact and a concrete exploit, apply triage dismissals, route out-of-repository facts to needs-validation, keep the effect no stronger than the trace, then the self-refute and verifier passes

日本語の概要は準備中です。原文の説明を表示しています。

Use when working on any browser game (Phaser, PixiJS, three.js, Babylon.js, PlayCanvas, Excalibur, KAPLAY) - requestAnimationFrame with clamped delta and visibility pause, zero-allocation frame loops, measuring in DevTools, bundle and asset size budgets, Vitest with seeded RNG and injected time, and a seeded Playwright smoke test with console capture.

日本語の概要は準備中です。原文の説明を表示しています。