テスト・セキュリティのスキル

Run the project's own tests, linter, type checker and build, and report what actually failed.

日本語の概要は準備中です。原文の説明を表示しています。

The last gate before merge — QA, security audit, review and changelog, with objective pass conditions.

日本語の概要は準備中です。原文の説明を表示しています。

Write meaningful Replica tests. Use when adding regression coverage, testing new behavior, or changing existing automated tests.

日本語の概要は準備中です。原文の説明を表示しています。

Use for explicit agent-browser CLI checks or a named browser capability neither the Copilot canvas nor configured Playwright MCP can supply. Ordinary rendered checks and browser selection belong to browser-canvas-validation.

日本語の概要は準備中です。原文の説明を表示しています。

Audits actual components and routes against applicable WCAG 2.2 A/AA criteria using consumer-owned design-system evidence and repository tools. Use when asked for an accessibility audit, a11y check, keyboard or focus review, contrast check, or screen-reader verification.

日本語の概要は準備中です。原文の説明を表示しています。

Use the Copilot browser canvas first for rendered route checks, interaction tests, screenshots and visual, responsive or accessibility evidence. Use configured isolated Playwright MCP only when the canvas is unavailable for a required check.

日本語の概要は準備中です。原文の説明を表示しています。

Audits UI layout, overflow and navigation across product-defined viewports using consumer context and browser tools. Use when asked to check responsiveness, test mobile layout or audit breakpoint behavior.

日本語の概要は準備中です。原文の説明を表示しています。

Offload builds, tests, or artifact verification to authorized SSH hosts and isolated worktrees; synchronize remote fixes into dedicated coordinator commits and preserve reproducible build provenance. Use for spare development capacity and remote build troubleshooting. Paid provisioning requires a separate resource lifecycle contract.

日本語の概要は準備中です。原文の説明を表示しています。

Use common CLI, Kali, and shell tools to inspect web Targets, captured assets, logs, HAR/PCAP files, packages, and generated artifacts, then turn observations into Evidence, Security Signals, and ranked Hypotheses. Use when the user asks for web bug-hunting inspection, digital records, URL maps, crawling, endpoint discovery, JS bundle/package analysis, light forensics, or command-line investigation workflows.

日本語の概要は準備中です。原文の説明を表示しています。

Passive code-review lane for authorized repositories, local checkouts, uploaded source archives, and diffs. Use when the security research agent needs deterministic candidate discovery before expensive AI investigation, scoped PR-style review, append-only evidence records, or independent revalidation of code findings.

日本語の概要は準備中です。原文の説明を表示しています。

Passive, citation-grounded review of security-relevant specifications, protocols, standards, APIs, and implementations. Use when a reviewer must trace external preconditions and invariants into source code without treating a cited claim as proof of a vulnerability.

日本語の概要は準備中です。原文の説明を表示しています。

Grilling session that challenges your plan against the existing domain model, sharpens terminology, and updates documentation (CONTEXT.md, ADRs) inline as decisions crystallise. Use when user wants to stress-test a plan against their project's language and documented decisions.

日本語の概要は準備中です。原文の説明を表示しています。

Select established CTF and security-research tools for authorized artifact triage, web inspection, reversing, crypto, forensics, networking, and exploit validation. Use when a user provides a CTF-style tool catalog, asks which tools to use, or needs safe usage instructions for common offensive/security tools.

日本語の概要は準備中です。原文の説明を表示しています。

Turn a specific vulnerability, patch, CVE, Version Diff, or Changelog Claim into a proactive security exploration plan. Use when the user wants research angles, lateral target discovery, patch/CVE strategy, new surface discovery, or hypothesis generation from vulnerability intelligence.

日本語の概要は準備中です。原文の説明を表示しています。

Test-driven development with red-green-refactor loop. Use when user wants to build features or fix bugs using TDD, mentions "red-green-refactor", wants integration tests, or asks for test-first development.

日本語の概要は準備中です。原文の説明を表示しています。

Authorized testing of LLM applications, agents, chatbots, RAG systems, guardrails, and tool-using model workflows. Use for LLM mode selection, jailbreak and prompt-injection assessment, guardrail bypass review, tool misuse, tool or system prompt disclosure, data exfiltration paths, model refusal/stop detection, bypass hypotheses, and hardening guidance.

日本語の概要は準備中です。原文の説明を表示しています。

Coordinate eval, benchmark, load-test or batch campaigns on authorized SSH hosts or short-lived rented hosts, with isolated jobs, configured-path canaries, telemetry and evidence. Use manage-remote-resources for paid resource ownership and run-remote-builds for build-only offload.

日本語の概要は準備中です。原文の説明を表示しています。

Autonomous driver loop for ExploitHunter vulnerability-research campaigns. Runs breadth-first waves of research lanes on rented hosts with no per-request human approval, steers lanes via the shared Investigation Graph (demoting dead ends, respawning on high-signal priorities), saturates host capacity, and enforces wave/budget/safety discipline. Use when driving a multi-target bug-hunting campaign, launching parallel research lanes, or resuming a campaign from a state snapshot.

日本語の概要は準備中です。原文の説明を表示しています。

Record measured or directly seen security-research behavior as cited Observations, classify it against reusable security concepts, and decide whether it remains an observation, becomes a Lead, or supports a Finding. Use after passive analysis, a tool run, a probe, a crash, a timing anomaly, or a user-supplied behavioral report produces noteworthy evidence.

日本語の概要は準備中です。原文の説明を表示しています。

Passive, pattern-calibrated risk discovery for authorized security research over an open-source project, repository URL, dependency, release, or local checkout. Use when the security research agent needs to find highest-risk areas, map attack surface, identify likely bug-hunting targets, prioritize security review, inspect structural/logical/security-critical code, compare vulnerable versus patched versions, reason from broad high-severity vulnerability families, or remember areas of interest for later attack-chain research.

日本語の概要は準備中です。原文の説明を表示しています。

Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says "diagnose this" / "debug this", reports a bug, says something is broken/throwing/failing, or describes a performance regression.

日本語の概要は準備中です。原文の説明を表示しています。

Plan vulnerability research using conventional bug-hunting and pentest stage names, specialty playbooks, and a research-hypothesis-experiment loop. Use when designing a bug bounty workflow, selecting tools and strategies, building a decision tree, or turning a target/scope into a staged hunting plan.

日本語の概要は準備中です。原文の説明を表示しています。

Up-to-date Zig programming language patterns for version 0.17.0-dev (0.16.0 stable APIs plus the 0.17 deltas). Use when writing, reviewing, or debugging Zig code, working with build.zig and build.zig.zon files, or using comptime metaprogramming. Critical for avoiding outdated patterns from training data - especially std.net→std.Io.net (requires Io instance), std.time timestamps removed (use clock_gettime), std.Thread.Mutex/Condition/sleep removed (use pthreads), std.crypto.random removed, build system APIs (root_module, Compile methods→Module methods), I/O APIs (buffered writer pattern), container initialization (.empty/.init), allocator selection (DebugAllocator), ArrayList now unmanaged by default, @typeInfo lowercase fields (.@"struct" not .Struct), and removed language features (async/await, usingnamespace). Also covers 0.17.0-dev deltas: b.args→run_cmd.addPassthruArgs(), std.gpu→std.spirv, @bitCast logical-bit (endian-agnostic) semantics, build configurer/maker split, and the zig-pkg/ package directory. Also covers quality tooling Zig does not ship: coverage with kcov (and why in-file tests wreck the denominator), detecting unused private functions (neither the compiler nor zlint's unused-decls finds them), duplicate detection with jscpd, zlint (NOT the same-named X.509 linter in Homebrew), and the built-in fuzzer whose testOne now takes *std.testing.Smith rather than []const u8.

日本語の概要は準備中です。原文の説明を表示しています。

Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says "diagnose this" / "debug this", reports a bug, says something is broken/throwing/failing, or describes a performance regression.

日本語の概要は準備中です。原文の説明を表示しています。