テスト・セキュリティのスキル

GStack investigation method for bugs, incidents, failing tests, regressions, and unclear behavior where evidence and root cause should precede fixes.

日本語の概要は準備中です。原文の説明を表示しています。

Produces a deep, honest peer-review of how someone uses Claude Code by statistically analyzing their local session data (~/.claude/usage-data/ and ~/.claude/projects/). Trigger whenever the user asks to review, analyze, audit, or critique their own Claude Code usage, workflow, habits, or skill level — including phrases like "analyze my cc usage", "review my cc sessions", "peer review my cc workflow", "deeper than /insights", or any ask for an honest audit of their AI workflow. Also covers portfolio/hiring-manager framings (e.g. "portfolio for Anthropic/OpenAI/xAI"), but ALWAYS ask the user in Step 0 which version to build (self / hr / both) before running — never silently produce an HR report, because that version goes to outsiders and needs explicit privacy setup. The HTML report is laid out ledger-first for SELF (opening band, output/team/leak/trend ledgers, then peer review, 9-dim scoring, try-this-week, case study, claim-indexed evidence). The HR variant is a recruiter version v1: identity card, earned badges (threshold-based, earned-only), allowlist-filtered output ledger, one case study, and a methodology & scope disclosure — no scores, no peer-review memo, no charts.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when an engineering team needs a secure development policy, or has one that does not match how code really ships, and asks "write our secure SDLC policy", "secure development policy from our CI", "document our code review and scanning for the audit", "what does our pipeline already enforce", "change management for engineers" or "secure coding policy for SOC 2 or CRA". Reads the repositories and pipeline definitions, inventories what is actually enforced (reviews, checks, scanners, deploy gates, dependency and secret controls), and writes a policy whose every "must" points to the place it is enforced, with gaps listed as decisions.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when a supplier has returned a security questionnaire, assurance report, certificate or trust pack and someone asks "review this vendor's answers", "is this supplier safe to use", "read their SOC report for us", "what should we ask the vendor next", "triage the vendor security assessment" or "does their certificate cover the service we buy". Checks report and certificate scope against the service in use, sorts answers into evidenced, asserted, contradicted and evasive, lists the obligations the report puts back on the customer, and writes a triage note with follow-up questions and a proposed decision for the owner.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when the implementation status column of a statement of applicability may not match reality, and the team asks "is our SoA accurate", "check the implemented column", "do we have evidence for every implemented control", "reconcile the SoA with our evidence", "pre-audit evidence check" or "the auditor found a control marked implemented with no records". Samples the records behind every control marked implemented, grades the evidence, proposes a corrected status for each row and writes a reconciliation table plus an evidence gap list with owners.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when a company needs its information security policy set written or rebuilt, or asks "write our security policies", "draft the information security policy", "we need policies for the audit", "policy pack for a startup", "our template policies are 40 documents nobody reads" or "which policies do we actually need". Maps the policy set to the company's size and owners, drafts the top-level policy and the topic policies in testable language that reflects what the company does, flags commitments that need a decision, and prepares the approval and communication record for leadership.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when a team must define what its management system covers before a certification project, or its current scope is one vague sentence, and asks "write our ISMS scope", "what should be in scope", "can we exclude the sales office", "scope for the certificate", "draw the boundary of our management system" or "the auditor says our scope is unclear". Drafts the scope statement with boundaries, interfaces, dependencies and justified exclusions, for a security, privacy or AI management system, and writes a statement file plus a boundary table of open questions.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when a statement of applicability already exists and the team wants its exclusions to survive the audit, and asks "review our SoA exclusions", "is this a valid justification", "can we exclude physical security if we are fully remote", "the auditor challenged our not applicable controls", "rewrite our exclusion justifications" or "we outsource it, so it does not apply, right". Tests every excluded control against scope, assets, activities, suppliers, risks and commitments, gives each a keep, rewrite, reverse or ask verdict, and writes a review table plus rewritten justifications for the owner to approve.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when a certification audit is booked and the team wants to know whether the first stage will go through, and asks "are we ready for stage 1", "pre-audit readiness check", "what will the auditor read first", "documentation review before the certification audit", "mock stage 1" or "what would stop the audit". Walks the documentation set the way a certification auditor reads it, checks that documents agree with each other and with the records, and writes a list of stoppers, likely findings and polish items with an owner and a fix for each.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when a company needs to decide how much assessment each supplier deserves, or asks "tier our vendors", "which suppliers are critical", "we have 200 vendors and cannot assess them all", "build a third-party risk tiering", "rank suppliers by risk" or "which vendors need a security review this year". Builds the complete supplier population from finance, single sign-on and contracts, scores each supplier on data, access and dependency, assigns a tier by the highest axis, sets the assessment depth and cycle per tier, and writes a tiered list with the reason for every score.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when an external audit, attestation examination or assessment is coming and the team wants populations and evidence ready for the samples the auditor will pull, or asks "prepare for audit sampling", "what samples will the auditor ask for", "get our populations ready", "the auditor wants a list of all changes in the period", "evidence for the leavers sample", "Type II sample prep" or "how do we prove completeness of the population". Lists the populations an auditor is likely to sample, builds each from the system of record with the query that produced it, checks completeness and the evidence behind a dry-run sample, and writes a readiness file per population plus a list of gaps to fix before fieldwork.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when one AI system needs its impact on people and on the company assessed before launch, after a significant change, or because a customer, auditor or regulator asks for it, and the team says "AI impact assessment", "assess the impact of this model", "fundamental rights impact assessment", "who could this AI harm", "bias assessment before launch" or "sign-off for the AI feature". Describes the system in its context, works through impacts on the people it affects with evidence, sizes them, proposes mitigations with measurable triggers, and writes one assessment ready for the system owner and an accountable executive to sign.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when a company must work out where each of its AI systems sits under the EU AI Act, and asks "is this high-risk", "classify our AI systems", "AI Act risk tier", "are we a provider or a deployer", "does Annex III apply to us", "is this a prohibited practice", "what does the AI Act mean for our chatbot" or "which AI Act obligations do we have". Tests each system, one at a time, for scope, role, prohibited practices, the two high-risk routes, the narrow exemption, transparency duties and general-purpose models, and writes a reasoned classification record per system plus a summary table of resulting obligations to confirm with whoever owns legal interpretation.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when a periodic user access review is due, an auditor asked for access review evidence, or someone says "prepare the access review", "run the quarterly user recertification", "who still has admin", "check leavers still have access", "build the access review sheets for managers" or "our last review was a rubber stamp". Picks the systems in scope, builds account populations reconciled against HR, pre-flags leavers, orphans, shared and dormant accounts, assigns independent reviewers, defines the decisions to record, and plans the removal follow-up.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when a company needs rules for how staff use company systems, data, devices and AI tools, or asks "write our acceptable use policy", "AUP for employees", "can staff use ChatGPT at work", "AI usage policy", "BYOD rules", "remote work security rules" or "a policy people will actually read". Finds how people really work (devices, apps, AI tools, travel), puts the choices to the reader as decisions, drafts a short plain-language policy with concrete do and do not examples, and adds a comprehension check and an acknowledgement text for onboarding.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when a company that already runs a security management system wants to add an AI management system, or is preparing for an AI governance certification, and asks "scope our AI management system", "what should the AIMS cover", "AI governance roles", "who owns AI governance", "extend our ISMS to AI" or "write the AI management system scope statement". Decides which AI systems, roles, teams and lifecycle stages are in, maps interfaces and dependencies, reuses the processes the security system already runs, assigns roles with a RACI, and writes the scope statement, the roles file and the open questions for leadership.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when the company is about to buy, renew or switch on an AI product or an AI feature inside an existing product, and asks "assess this AI vendor", "do they train on our data", "AI supplier questionnaire", "review the AI terms", "can we use this model provider with customer data", "who are the subprocessors behind this AI tool" or "AI vendor risk assessment". Sizes the review to the use, reads the terms, data processing agreement and documentation before asking questions, checks training use, retention, model changes, subprocessors, transfers, security and exit, and writes an assessment with a recommendation plus the follow-up questions for the vendor.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when a customer or prospect has sent a security questionnaire, due diligence form or vendor assessment and someone asks "answer this security questionnaire", "fill in the customer's vendor assessment", "draft answers from our policies", "we have 300 questions due Friday", "reuse our previous questionnaire answers" or "which answers can we not back up". Drafts every answer from the company's own documents with a source and a confidence level, flags answers without evidence and answers that create commitments, checks consistency with past answers, and writes an answer sheet plus a list of items for owners to confirm.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when a set of policies, procedures, plans and registers has grown in pieces and someone asks "check our documents for contradictions", "are our policies consistent", "the retention periods don't match", "which severity scale is right", "harmonise our ISMS documents", "cross-check the incident plan against the policy" or "clean up our documentation before the audit". Extracts the checkable facts from every document (periods, deadlines, scales, roles, labels, references), finds contradictions, naming drift and broken references, proposes which document owns each fact, and drafts a glossary and a fix list for the owners.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when a data processing agreement is being negotiated or renewed and someone asks "review the TOMs annex", "check the security measures in this DPA", "can we sign this annex", "the customer sent their DPA with a security schedule", "is our standard annex still true" or "does this vendor's annex promise enough". Breaks the technical and organisational measures annex into single commitments, compares each one with what the company actually runs or with what the use case needs, and writes a line-by-line review, proposed redlines and a list of practice gaps for owners.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when a new product feature, vendor, AI use, monitoring tool or change in processing raises the question "do we need a DPIA", or someone asks "DPIA screening", "is this high risk processing", "data protection impact assessment threshold", "privacy impact screening for this feature", "does our AI feature need a DPIA" or "document why we did not do a DPIA". Describes the processing with numbers, tests it against the GDPR cases, the supervisory authority's list and the EDPB-endorsed criteria, reaches a reasoned outcome (required, recommended, not required) with a re-screen trigger, and keeps a screening log for accountability.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when an audit, attestation period or customer review is coming and someone asks "is our evidence up to date", "check the evidence folder before the auditor sees it", "which screenshots are stale", "do we have evidence for the whole period", "find undated evidence" or "what will the auditor reject". Indexes every evidence artefact with the date inside it, its owner and the period it covers, flags what is stale, undated, unowned, outside the audit period or missing for a recurring activity, and writes an index plus a refresh list per owner.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when an auditor, assessor or regulator has sent a request list and the team asks "turn the auditor's request list into tasks", "who needs to provide what", "build the evidence tracker", "split the PBC list by owner", "what exactly do they want for this request" or "we have two weeks to send everything". Normalises each request into owned, dated tasks naming the exact artefact, period and source system, separates population requests from sample requests, batches the clarification questions, and writes a tracker plus one brief per owner.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when a company starts a compliance programme and needs to know how far it is from a framework, and asks "run a gap analysis", "how ready are we for the audit", "baseline us against the framework", "what do we have and what is missing", "readiness assessment before we hire an auditor" or "how long until we can certify". Baselines what exists against the chosen framework from documents and records, rates each item by evidence rather than opinion, sizes every gap by effort and audit risk, and writes a gap register plus a prioritised summary with the long-lead items first.

日本語の概要は準備中です。原文の説明を表示しています。