テスト・セキュリティのスキル

Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for attack path analysis, Mimikatz for credential extraction, and Impacket for protocol-level attacks including Kerberoasting, AS-REP Roasting, and delegation abuse. Activates for requests involving Active Directory pentest, AD attack simulation, domain compromise testing, or Kerberos attack assessment.

日本語の概要は準備中です。原文の説明を表示しています。

Red team engagement planning is the foundational phase that defines scope, objectives, rules of engagement (ROE), threat model selection, and operational timelines before any offensive testing begins.

日本語の概要は準備中です。原文の説明を表示しています。

Use when assessing cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, or IaC security gaps. Covers AWS, Azure, and GCP posture assessment with MITRE ATT&CK mapping.

日本語の概要は準備中です。原文の説明を表示しています。

Executes comprehensive red team exercises that simulate real-world adversary operations against an organization's people, processes, and technology. The red team operates with stealth as a primary objective, employing the full attack lifecycle from initial reconnaissance through objective completion while testing the organization's detection and response capabilities. This differs from penetration testing by focusing on adversary emulation rather than vulnerability identification. Activates for requests involving red team exercise, adversary simulation, adversary emulation, or full-scope offensive security assessment.

日本語の概要は準備中です。原文の説明を表示しています。

Executes authorized phishing simulation campaigns to assess an organization's susceptibility to email-based social engineering attacks. The tester designs realistic phishing scenarios, builds credential harvesting infrastructure, sends targeted phishing emails, and tracks open rates, click-through rates, and credential submission rates to measure human security awareness. Activates for requests involving phishing simulation, social engineering assessment, email security testing, or security awareness measurement.

日本語の概要は準備中です。原文の説明を表示しています。

Use when a website needs a broad audit covering UX, conversion, content, SEO, technical correctness, and information hierarchy before changes are planned.

日本語の概要は準備中です。原文の説明を表示しています。

Use when legacy prompts or older framework flows reference `e2e-runner` and you need the modern runtime to resolve that capability cleanly.

日本語の概要は準備中です。原文の説明を表示しています。

Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup

日本語の概要は準備中です。原文の説明を表示しています。

Sets up safe working habits and a change log so you always know what Cowork has done to your files — and can undo anything. Use when setting up file protection guardrails, for establishing safe automation habits, during initial access configuration, when granting file permissions for the first time, or when the user says "is cowork safe", "file safety", "what if it deletes my files", "audit trail", "safety setup", "I'm nervous about file access", "how do I trust cowork with my files", "can cowork mess up my computer", "I heard someone lost files", or "how do I stay in control".

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when measuring or rechecking a brand's visibility in AI answers, citations, source lists, or competitor rankings; when resuming an interrupted GEO run; or when another workflow needs captured answers and a portable measurement artifact. Use it even if the user says only “am I recommended?”, “who gets cited instead?”, or “run these questions”. Capture rendered answers through an available engine playbook, persist validated data, and export JSON; add PDF/dashboard only when requested. Accept a query CSV or a semantic-core handoff. Question research requires the separate opt-in harvest flow; this skill does not audit or edit the target website.

日本語の概要は準備中です。原文の説明を表示しています。

Use when a feature or code change made by Claude is complete and the developer wants to confirm they actually understood it before shipping. Triggers on "handoff", "quiz me", "comprehension check", "did I understand this", "verify I read the code", "test my understanding", or after finishing a feature when the developer wants to take ownership of AI-written code. Also triggers on requests for an interactive or clickable quiz ("interactive mode", "let me answer with the mouse", "mode interactif", "je réponds à la souris"). Quizzes the developer on WHERE the logic lives (file/function) and WHY decisions were made (trade-offs, behavior, debugging), with the number of questions scaled to the size of the change. Multiple-choice questions are clickable by default (asked through `AskUserQuestion`) and fall back to typed answers. Points to file:line on wrong answers, allows one retry, then reveals the answer, and ends with a score plus the weak areas to re-read. Conducts the quiz in the developer's language.

日本語の概要は準備中です。原文の説明を表示しています。

Security scanner for AI Agent skills, plugins, and MCP servers. Use when: user asks to scan a skill, check if a plugin is safe, vet an MCP server, review skill security, detect malicious code, supply chain safety, or says 'is this safe to install', 'scan this skill', 'check this MCP server', 'security scan', 'vetting', 'skill safety', 'prism scan', '安全扫描', '这个插件安全吗', '扫描一下', '检查安全性', '安装前检查', '技能审查'.

日本語の概要は準備中です。原文の説明を表示しています。

Use when creating new skills, editing existing skills, or verifying skills work before deployment. Applies Test-Driven Development to process documentation — watch agents fail without the skill, write the skill that addresses those failures, then close loopholes.

日本語の概要は準備中です。原文の説明を表示しています。

Comprehensive testing skill covering unit, integration, and e2e testing with TDD. Use when writing tests, improving coverage, or setting up testing infrastructure. Keywords: test, TDD, unit test, integration, e2e, coverage, mock, jest, vitest

日本語の概要は準備中です。原文の説明を表示しています。

Security-focused development skill covering OWASP Top 10 and secure coding. Use when implementing authentication, handling user data, or security review. Keywords: security, auth, authentication, authorization, OWASP, XSS, SQL injection, CSRF, secure

日本語の概要は準備中です。原文の説明を表示しています。

Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.

日本語の概要は準備中です。原文の説明を表示しています。

Use when building autonomous LLM agents operating in live environments. Protects against prompt injection, tool abuse, data exfiltration, and runaway loops. Keywords: guardrails, prompt injection, IPI, safety, sandboxing, NeMo, LLM Guard.

日本語の概要は準備中です。原文の説明を表示しています。

Use when implementing any feature or bugfix, before writing implementation code

日本語の概要は準備中です。原文の説明を表示しています。

Persistent browser and Electron interaction through `js_repl` for fast iterative UI debugging.

日本語の概要は準備中です。原文の説明を表示しています。

Web application testing principles. E2E, Playwright, deep audit strategies.

日本語の概要は準備中です。原文の説明を表示しています。

Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the task requires automating a real browser from the terminal (navigation, form filling, snapshots, screenshots, data extraction, UI-flow debugging) via `playwright-cli` or the bundled wrapper script.

日本語の概要は準備中です。原文の説明を表示しています。

Package entire code repositories into single AI-friendly files using Repomix. Capabilities include pack codebases with customizable include/exclude patterns, generate multiple output formats (XML, Markdown, plain text), preserve file structure and context, optimize for AI consumption with token counting, filter by file types and directories, add custom headers and summaries. Use when packaging codebases for AI analysis, creating repository snapshots for LLM context, analyzing third-party libraries, preparing for security audits, generating documentation context, or evaluating unfamiliar codebases.

日本語の概要は準備中です。原文の説明を表示しています。

Testing patterns and principles. Unit, integration, mocking strategies.

日本語の概要は準備中です。原文の説明を表示しています。