テスト・セキュリティのスキル

Connects to Oxylabs remote agent browsers over the Chrome DevTools Protocol (CDP) with Playwright or Puppeteer. Managed browser environment, residential proxies, geo-targeting, persistent sessions and profiles, session recording and live VNC inspection for debugging. Use instead of WebFetch or a local browser whenever a site renders with JavaScript, serves access challenges, verification interstitials or bot-management block pages, or needs a full browser session, screenshots or PDFs. Covers connection, retries, error recovery, built-in challenge handling (the page_handler parameter, the oxylabs-page-status page state reported by the page handler, manual triggering), telling a handled challenge from a block that needs a fresh identity, and reliable access to publicly available data without manual intervention.

日本語の概要は準備中です。原文の説明を表示しています。

Expert WCAG (Web Content Accessibility Guidelines) advisor covering WCAG 2.0, 2.1, and 2.2 — the W3C international accessibility standards. Use this skill whenever a user asks about WCAG success criteria, conformance levels (A/AA/AAA), accessibility audits, POUR principles, accessibility statements, ARIA patterns, colour contrast, keyboard accessibility, screen reader compatibility, mobile accessibility, cognitive accessibility, WCAG 2.2 new criteria, WCAG 3.0 preview, legal requirements referencing WCAG (EN 301 549, EAA, ADA, Section 508), or mapping WCAG to accessibility laws. Trigger for any web or digital content accessibility question — even if the user doesn't say "skill" or "WCAG".

日本語の概要は準備中です。原文の説明を表示しています。

Risk-based vendor assessment framework for IT service providers, technology vendors, and third-party partners under DORA, NIS2, GDPR. Provides three-phase process (Initial Screening / Detailed Assessment / Final Evaluation), six-dimension risk scoring (Financial/Operational/Compliance/Security/Reputational/Strategic) with weighted matrices, full DORA Art. 28-30 contractual checklist, NIS2 Art. 21(2) security measures enumeration, GDPR Art. 28 documentation checks, red flags per dimension, trigger-based review criteria, and document templates. Use when: (1) Evaluating new vendors or technology providers, (2) Conducting critical ICT third-party due diligence under DORA, (3) Performing supply chain security assessment under NIS2, (4) Creating vendor onboarding documentation, (5) Establishing ongoing vendor monitoring, (6) Assessing concentration risk, or (7) Generating executive vendor risk reports.

日本語の概要は準備中です。原文の説明を表示しています。

Guide for (a) auditing an existing whistleblower system or (b) drafting a compliant reporting policy from a provided template. Covers EU Directive 2019/1937, the amended Sapin II law (Waserman 2022), Decree 2022-1284, CNIL guidelines, public sector requirements, and duty of vigilance.

日本語の概要は準備中です。原文の説明を表示しています。

This skill stress-tests a proposed settlement position before an offer goes out or comes back: the assumptions it depends on, your leverage and the opponent’s, the evidential weaknesses, the likely opponent response, and the timing and costs pressures around it. It structures settlement judgment for a better-informed decision; it does not advise whether to settle.

日本語の概要は準備中です。原文の説明を表示しています。

Audits legal AI skills, prompts, workflows, MCP/tool instructions, and agent packages for prompt injection, malicious instructions, unsafe scripts, suspicious metadata, credential exposure, exfiltration paths, persistence mechanisms, and supply-chain risk. Use before installing, importing, publishing, promoting, modifying, or trusting third-party or generated AI skills and legal workflows. Do not use as a generic code review unless skill trust, workflow safety, prompt injection, or supply-chain hygiene is in scope.

日本語の概要は準備中です。原文の説明を表示しています。

Screen a client, counterparty, payer or corporate against the sanctions lists published by the designating authorities themselves — the UK Sanctions List (FCDO), OFSI, the UN Security Council, the EU consolidated list and OFAC's SDN and non-SDN lists. Use when onboarding, before taking a payment, before completing a transaction, or whenever a name must be checked against sanctions. Produces candidates and provenance, never a clearance: the record names every list searched with its publication date and count, states what was NOT searched, and ends at a blank decision block. Fails closed — a cache that is missing, damaged, truncated or stale is reported NOT SEARCHED and the process exits non-zero, so nothing can read an incomplete run as clean. Matches across transliteration, diacritics, homoglyphs and initials, because nobody spells a name the way the publisher does. Standard library only; screening opens no network connection.

日本語の概要は準備中です。原文の説明を表示しています。

Expert TSA cybersecurity compliance advisor for critical infrastructure owners and operators. Use this skill whenever a user asks about TSA Security Directives for pipelines, freight railroads, passenger rail, public transit, or bus operators; the TSA Cyber Risk Management Program (CRMP); Cybersecurity Implementation Plan (CIP); Cybersecurity Operational Implementation Plan (COIP); Cybersecurity Assessment Plan (CAP); incident reporting to CISA; designation of a Cybersecurity Coordinator; Critical Cyber Systems (CCS); OT/IT network segmentation; the TSA November 2024 NPRM; or any directive in the SD Pipeline-2021 series, SD 1580-21-01 (freight rail), or SD 1582-21-01 (public transit/passenger rail). Also trigger for questions like "are we covered by TSA directives?", "what does the TSA require for pipeline cybersecurity?", "how do I build a CIP?", "what must I report to CISA?", or any request involving transportation critical infrastructure cybersecurity compliance.

日本語の概要は準備中です。原文の説明を表示しています。

Audit an AI agent skill before installing it. Use proactively whenever the user is about to add, install, enable, or evaluate an unfamiliar skill — including phrases like "audit this skill", "is this skill safe", "scan skill before install", "check skill for malicious code", "review this plugin", or any pre-install gate on an untrusted, third-party, or community-distributed skill bundle. Runs ten categories of static checks (code execution, network exfiltration, credential harvesting, persistence, prompt injection, supply-chain hooks, obfuscation, destructive filesystem ops, secrets, Trojan Source / homoglyphs) and emits a PASS / WARN / FAIL verdict.

日本語の概要は準備中です。原文の説明を表示しています。

Use when an application or system — including one built quickly with AI coding agents — needs a security review with regulatory grounding: a STRIDE threat model, a LINDDUN privacy threat model, a dependency exposure screen against live CVE / CISA-KEV / EPSS data, or a selected, non-exhaustive screen of which EU security obligations (GDPR, NIS2, Cyber Resilience Act, AI Act) may apply and which need determination. Orchestrates the server-enforced threat-modeling workflows of the Ansvar Gateway MCP connector and grounds every regulatory statement in officially published text fetched at answer time — scope, role, and application-date limits stated, never a compliance verdict. Never simulates a workflow and never answers legal questions from model memory.

日本語の概要は準備中です。原文の説明を表示しています。

Produces an adversarial attack on a legal argument that survives reply. Runs the opposing-counsel discipline twice: an unrestrained first pass, then the same instrument turned on that pass to cut every point that collapses under challenge - attacks on conceded facts, wrong-forum objections, speculation about documents and motives, gotchas with innocent explanations, overclaims, self-refuting assertions, and padding. The deliverable is one standalone attack containing only what can be defended, capped at five heads, not a discussion of the discarded draft. Use to attack, stress-test, red-team or rebut a submission, brief, motion, witness statement, letter or structured legal reasoning. Triggers on "attack this but only with points that hold", "no cheap shots", "what survives reply", "which points can I actually defend", "give me the version I can file", "double-pass adversarial review". Also use when an earlier adversarial review came back overlong or scattershot. Formal British English.

日本語の概要は準備中です。原文の説明を表示しています。

Adjudicates whether a hit generated by sanctions, PEP, or adverse-media screening is a true positive, false positive, or requires human escalation. Use whenever a user presents a screening alert, a name match against a watchlist (OFAC SDN, EU consolidated list, UK OFSI, UN list, PEP list, adverse media hit, etc.), or asks to clear a screening hit / reduce false positives / determine whether a flagged name is actually the listed party. Use even when the user describes the task casually — "is this person actually on the sanctions list", "did we get a real match", "clear this alert", "I have a hit on X" — these are all screening-adjudication tasks. Produces a deterministic determination with full audit trail (structured JSON + human-readable narrative). Designed for use by compliance analysts and screening systems.

日本語の概要は準備中です。原文の説明を表示しています。

Expert Section 508 compliance advisor for US federal ICT accessibility. Use this skill whenever a user asks about Section 508, WCAG 2.0/2.1 AA for federal systems, VPAT or Accessibility Conformance Reports (ACR), accessibility audits, remediation planning, PDF accessibility, web or software accessibility, mobile accessibility, federal procurement accessibility requirements, contractor obligations, undue burden exceptions, assistive technology compatibility, or Section 508 testing. Covers the Revised Section 508 Standards (2018), all WCAG 2.0 Level AA success criteria, the four POUR principles, testing methodologies, and agency compliance workflows. Trigger even if the user doesn't say "skill" — any Section 508 or ICT accessibility question for federal systems should use this skill.

日本語の概要は準備中です。原文の説明を表示しています。

Builds compliance checklists for business scenarios involving GDPR, PIPL, or advertising/data laws. Outputs a structured checklist with check items, legal basis, risk levels, and actionable recommendations. Triggered by requests like "run a compliance check," "GDPR/PIPL compliance," "pre-launch review," "privacy impact assessment (PIA/DPIA)," or asking if a feature is compliant.

日本語の概要は準備中です。原文の説明を表示しています。

Audit Terms of Service, user agreements, and privacy policies for consumer risks, producing a structured report that flags unfair clauses, data traps, and liability issues. Trigger when a user asks to review, audit, or analyze a ToS, privacy policy, or user agreement, or mentions specific concerns like auto-renewal or data authorization.

日本語の概要は準備中です。原文の説明を表示しています。

Expert SOC 2 compliance assistant covering all five Trust Services Criteria (Security/CC, Availability/A, Confidentiality/C, Processing Integrity/PI, Privacy/P). Use this skill whenever a user mentions SOC 2, Trust Services Criteria, SOC 2 Type 1 or Type 2, audit readiness, compliance gaps, control documentation, evidence collection, vendor risk questionnaires, or anything related to AICPA service organization controls. Trigger even for adjacent topics like "we need to get audited", "a customer asked for our security report", "writing an information security policy", or "preparing for an audit". Covers gap analysis, policy writing, control documentation, audit evidence preparation, and vendor risk reviews for organizations at any maturity level — from first-time startups to seasoned compliance teams.

日本語の概要は準備中です。原文の説明を表示しています。

Expert New Zealand Information Security Manual (NZISM) advisor for NZ government agencies and their supply chains. Use for NZISM control guidance, gap analysis, agency security obligations, classification framework (Unclassified through Top Secret), security risk management, system certification, and GCSB/NCSC NZ compliance. Triggers on: NZISM controls, NZ government security, GCSB compliance, agency cybersecurity obligations, NZ classification markings, Restricted/Confidential/Secret system scoping, agency security policies, third-party supplier security, Certification and Accreditation (C&A), and any question about NZ government information security requirements or the NZISM framework.

日本語の概要は準備中です。原文の説明を表示しています。

Expert NIST Cybersecurity Framework (CSF) advisor covering CSF 2.0 and CSF 1.1. Use this skill whenever a user asks about NIST CSF, cybersecurity risk management, the six CSF functions (Govern, Identify, Protect, Detect, Respond, Recover), CSF profiles, implementation tiers, gap assessments, organizational profiles, community profiles, CSF core subcategories, informative references, or mapping to other frameworks (NIST SP 800-53, ISO 27001, CIS Controls, COBIT). Also trigger for questions like "how do I implement NIST CSF?", "what does CSF 2.0 change?", "help me build a CSF profile", "how do I assess my cybersecurity posture?", or any request involving organizational cybersecurity risk strategy or framework alignment.

日本語の概要は準備中です。原文の説明を表示しています。

NIST SP 800-53 Rev 5 compliance advisor — all 20 control families (AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, SR), Low/Moderate/High baseline selection, FIPS 199/200 system categorization, control tailoring and overlays, privacy controls (PT family), supply chain risk management (SR family), assessment procedures (SP 800-53A), OSCAL, RMF integration (SP 800-37), and mapping to FedRAMP, FISMA, CMMC 2.0, and ISO 27001. Use for any federal system security controls, FISMA compliance, RMF step guidance, control narrative writing, or baseline tailoring question.

日本語の概要は準備中です。原文の説明を表示しています。

EU NIS2 Directive (Directive (EU) 2022/2555) compliance advisor for essential and important entities: entity classification, Art. 21 risk management measures, Art. 23 incident reporting timelines (24h/72h/1 month), Art. 20 governance obligations, supply chain security (Art. 21(2)(d); coordinated risk assessments Art. 22), gap assessments, policy drafting, ISO 27001 alignment, and penalty exposure analysis. Also covers Commission Implementing Regulation (EU) 2024/2690, the technical/methodological sub-requirements for Art. 21(2) and the significant-incident thresholds binding on DNS/cloud/data-centre/MSP/MSSP/trust-service and other digital entities. Use for NIS2 readiness, transposition questions, ENISA technical implementation guidance, significant-incident thresholds, supervisory differences between essential and important entities, and cross-border coordination.

日本語の概要は準備中です。原文の説明を表示しています。

Prepare a lawyer for an adversarial proceeding the way Neal Katyal's "Harvey" prepared him for the SCOTUS tariffs argument: profile the tribunal from their prior opinions and questions, predict the specific questions you will face, map narrow "escape routes" each judge can walk through without abandoning prior commitments, and spar adversarially until only the strongest answers survive. The model is the sparring partner. The human still wins the case. Use when: preparing for oral argument, appellate argument, motion hearing, evidentiary hearing, deposition (taking or defending), arbitration, mediation, or any proceeding where a known decision-maker will fire questions at you in real time. Also useful for stress-testing a brief before filing. Proactively suggest when: the user mentions an upcoming hearing/argument with named judges or arbitrators, drafts a brief and wants it pressure-tested, asks "what will Justice X / Judge Y ask me," or talks about preparing for a specific bench.

日本語の概要は準備中です。原文の説明を表示しています。

a skill that determines whether a given subject matter qualifies for copyright protection under EU law by applying the Cofemel two-step test (concept of work + originality), grounded in fifteen CJEU judgments (including the most recent Mio/Konektra and Calinescu) and the four EU directive provisions on originality. It argues from one of two positions: pro-rightsholder (establishing that the work is original) or pro-alleged-infringer (contesting work status or originality via the four exclusion grounds — technical function, rule-dictated outcome, sweat of the brow, idea/functionality). It includes sector-specific modules for photography, software/GUI, sporting events, databases, applied art, functional texts, derivative works/critical editions, and multimedia works.

日本語の概要は準備中です。原文の説明を表示しています。

Performs a legal compliance audit for a Moroccan e-commerce website, focused on personal data protection (Law 09-08) and consumer contract disclosures/obligations (Law 31-08). Use this skill when a user asks to audit, check, or assess the legal compliance of an e-commerce website operating in Morocco — presence and validity of Terms & Conditions, privacy policy, CNDP declaration, mandatory disclosures, right of withdrawal, consent banner. Out of scope: compliance for other countries, Meta/Google advertising compliance (covered by another skill), definitive legal advice (results are a starting point for professional review, not legal advice).

日本語の概要は準備中です。原文の説明を表示しています。

Detects prompt injection hidden in documents from the other side (pleadings, skeletons, bundles, served evidence, opponents' emails and attachments) before an AI reads them, so the model is not turned against your client. Checks word by word that the text an extractor hands the model was visibly drawn on the page: white, near-white, covered, clipped, off-page, tiny, transparent and invisible-mode text in PDF (ink test plus OCR); Word formatting resolved as Word does (styles, shading, theme colours, scaling, off-page frames, fallbacks, unused headers); HTML/CSS, RTF, email with attachments and zips, xlsx/pptx and legacy formats. Flags Unicode smuggling, text addressed to an AI and authorities found only in hidden text. Fails closed. Optional Read-tool hook. Use BEFORE any AI summary or analysis of an opposing or third-party document. Triggers: 'scan for injection', 'is this document safe', 'check the other side's skeleton', 'injection guard'.

日本語の概要は準備中です。原文の説明を表示しています。