テスト・セキュリティのスキル

Systematic 6-phase debugging protocol. Structured approach to bugs with quick checks, isolated testing, 20-minute rule, and bug report template.

日本語の概要は準備中です。原文の説明を表示しています。

Reads a risk register together with meeting notes and incident reports and returns a draft update pack: existing risks whose exposure, controls, ownership or status the sources say have changed, new risk candidates, closure candidates, and the one owner decision each item needs. Never assigns or changes a likelihood, impact, score or colour and never edits the register; owners decide. Use when the user asks to "update the risk register from these minutes", "refresh the register with the incidents since the last review", "reconcile the register against the notes" or "what changed on our risks". Do not use for writing up an incident itself, use incident-postmortem-drafter or data-incident-impact-brief instead; to track actions from minutes, use corrective-action-tracker. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Turns a control list and an audit scope into draft evidence requests grouped by control owner, each with the control as stated, the audit period, evidence examples (commonly requested) and a proposed due date derived from the fieldwork dates. Never judges whether evidence is sufficient, never selects the sample and never sends a request; the auditor decides. Use when the user asks to "prepare the evidence requests", "draft the PBC list", "build the evidence request pack for the audit" or "what do we need to ask each control owner for". Do not use for document requests and interview questions built from an audit plan, use audit-prep-pack instead; to check claims in a report against sources, use claims-evidence-map. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Builds an evidence map for one document, section or contested claim: every factual claim extracted verbatim and numbered, its supporting passage in the supplied sources or UNKNOWN, the strength of that support as evidenced, contradictions between sources, and the specific question or document that would close each gap, returned in the chat as Markdown tables for the author or reviewer. Use when the user asks to "check what this document actually proves", "map the evidence behind these claims", "which of these statements are supported", "build an evidence map", "what would we need to back this up" or "is this claim substantiated". Do not use for requesting evidence of security controls from control owners, use control-evidence-request-pack instead. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Prepares a DRAFT internal audit pack from the audit plan: scope as stated, criteria with clauses quoted from the documents provided, document requests per auditee with due dates, open interview questions per process and role, previous findings to follow up and a readiness checklist. Never pre-judges conformity, writes findings or selects the sample; the lead auditor decides. Use when the user asks to "prepare the internal audit", "build the audit pack from this plan", "draft the document requests and interview questions" or "get us ready for the supplier audit". Do not use for evidence requests built from a control list, use control-evidence-request-pack instead; to chase actions from earlier audits, use corrective-action-tracker. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Turns corrective and preventive actions from NCRs, audit reports, action forms, minutes or a tracker into one DRAFT tracker: action as stated, source, owner, due date, evidence expected and status, with flags for overdue, unowned, undated, stale and closed-without-evidence items and one question per flag. Never closes, verifies, reassigns or re-dates an action. Use when the user asks to "build the CAPA tracker", "update the corrective action log from these audit reports", "which actions are overdue or have no owner" or "draft the chase notes for open actions". Do not use for writing up the nonconformity itself, use nonconformance-report-drafter instead. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Drafts a nonconformance report from inspection notes, test results and the governing specification or procedure: what was observed, where, the evidence with references, the requirement cited quoted verbatim with the departure from it, and containment proposals for the quality lead to decide. Never classifies severity, dispositions the item, names a root cause or closes the report. Use when the user asks to "write up this nonconformance", "draft an NCR from my inspection notes", "formalise this deviation" or "turn this snag into a defect report". Do not use for tracking the actions an NCR raises, use corrective-action-tracker instead. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Produces a draft controls and gap pack from a requirement, regulation, standard or policy and the organisation's control descriptions: obligations broken out of the source text, the controls that appear to address each, apparent coverage, gaps, questions for control owners and actions to assess. Never concludes compliance or that a control is effective; owners and audit assess. Use when the user asks to "map this regulation to our controls", "run a controls gap analysis", "break this standard into obligations" or "where is our control coverage thin". Do not use for comparing a policy document against a standard, use policy-gap-review instead; to draft evidence requests from the mapped controls, use control-evidence-request-pack. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Pre-fills a customer's or prospect's security or third-party risk questionnaire from the organisation's own answer sources (prior questionnaires, answer library, policies), returning one row per question with a draft answer marked Reused, Adapted, Missing or Routed, its source, date, scope match and owner, plus the Missing list by owner. Never invents an answer, certification or control and never submits. Use when the user asks to "pre-fill this security questionnaire", "take a first pass at the customer's due diligence form", "answer this vendor assessment from our previous responses", "populate the third-party risk questionnaire" or "which questions can we reuse answers for". Do not use for screening a vendor's own answers, use vendor-risk-screening-brief instead; for RFP or tender answers use rfp-response-drafter. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Prepares a DRAFT vendor risk screening brief from the material the user provides on one vendor (questionnaire answers, certificates, assurance reports, policies, contract extracts): per screening topic, what a document evidences with reference, date and scope, what is only asserted, what is missing or contradicted, certificate and report details as stated, and ready-to-send questions for the vendor and the internal owners. No web research, no risk rating, tier, score or recommendation. Use when the user asks to "screen this vendor", "review the vendor's questionnaire answers", "check what the vendor's certificate covers", "what is missing from this due diligence pack" or "draft the follow-up questions for the vendor". Do not use for answering a customer's questionnaire about your own organisation, use vendor-security-questionnaire-prefill instead. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Prepares a DRAFT data incident impact brief from the incident notes and data inventory the user provides: the timeline as stated, systems involved matched to the inventory, data categories held and evidenced as involved, people and record counts potentially affected with the source and method behind every figure, third parties, notification questions for legal and the data protection officer, and every UNKNOWN with the evidence that would settle it. No legal determination: it never states whether the incident is a reportable breach, whether notice is due, to whom or by when. Use when the user asks to "prepare the impact brief for this incident", "what data was involved", "how many people are affected", "map the incident to our data inventory" or "pull together what legal needs on the incident". Do not use for the blameless postmortem or root-cause timeline, use incident-postmortem-drafter instead. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Compares one policy against one requirement set (standard, regulation, contract schedule or customer requirement) clause by clause and returns a draft gap review: each requirement element, the policy clause that appears to address it, an apparent match state, and every gap as a question with the clause reference on both sides. Never concludes that the policy complies; the owner decides. Use when the user asks to "gap our policy against the standard", "map this policy to the regulation clause by clause", "check the security policy against the customer's contract schedule", "compare our policy with the new edition" or "where does our policy fall short of the requirements". Do not use for mapping a requirement to the operating controls that implement it, use controls-gap-pack instead; for what a regulatory change means for the organisation, use regulatory-change-impact-note. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Reads one export transaction, order or shipment description and returns a DRAFT export review pack: parties to screen with a screening checklist, an item classification worksheet, a red-flag review, licence-determination questions and open items. Use when the user asks to "prepare the export review for this order", "pre-check this shipment for export control", "who do we need to screen on this deal", "build the classification worksheet for this item" or "assemble the trade-compliance file for this technology transfer". Do not use for vendor security or due-diligence screening of a supplier's questionnaire answers; use vendor-risk-screening-brief instead. Never classifies, screens, clears, decides licence need or releases a shipment; trade compliance does. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Sweeps a SharePoint library listing (an export or a listing the agent can reach, with file name, link, review-date column and owner column) for documents past their review date and returns a dated DRAFT review sweep report (Overdue, Due soon, No review date, Summary) plus one ready-to-paste reminder per document owner for the user to send. Never changes metadata, sends a message or invents a document, date or owner. Use when the user asks to "find the documents past their review date", "run the review sweep on the policies library", "which documents are overdue for review", "audit the review dates in this library export" or "draft reminders to owners about stale documents". Do not use for duplicate, conflict and ownership checks across knowledge files, use knowledge-base-hygiene-review instead; for gaps in an engineering deliverables register, use master-document-register-check. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Reviews the instructions text and skills of a declarative agent, with its stated capabilities, knowledge sources and audience, for prompt-injection exposure, data-leakage paths, over-broad permissions and missing refusals, and returns an attack-surface map, a findings table with severity, quoted evidence and attack path, one pasteable fix per finding, a probe pack the owner can run and a refusal-coverage table. Use when the user asks to "red-team this agent", "check these instructions for prompt injection", "could this agent leak data", "review the permissions on my agent" or "what should this agent refuse". Do not use for checking a SKILL.md against the format rules, use skill-file-reviewer instead; do not use for designing the launch test set, use agent-evaluation-plan instead. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Reviews one employee software request (tool, purpose, users, data handled, cost, urgency) against the approved-tools list and the policies the user provides and returns a draft review for the reviewer: match state on the list with the row quoted, approved tools the list itself describes as covering the same need, policy clauses that bear on the request with quoted text, questions for the requester and the reviewer, and one suggested decision with its basis. Never approves, procures, installs or adds a tool to the list. Use when the user asks to "review this software request", "is this tool on the approved list", "check this request against our software policy", "do we already have something approved that does this" or "prepare the decision note for this tool request". Do not use for a full vendor security assessment, use vendor-risk-screening-brief instead; for sorting mixed requests, use request-intake-triage. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Reviews one SKILL.md against the format rules and returns a findings table: strict YAML front matter with exactly name and description, name equal to the folder, description as the trigger, the eight-heading skeleton, capability-neutral wording, safety boundaries. Each finding carries severity, rule identifier, location, quoted evidence and replacement text; the verdict READY, REVISE or BLOCKED is an apparent state and the owner decides. Use when the user asks to "review this SKILL.md", "check my skill file before upload", "lint this skill description", "validate the front matter of this skill" or "score this skill folder". Do not use to write an agent's instructions field, use agent-instructions-drafter instead; for injection or leakage exposures use agent-instructions-red-team; for launch tests use agent-evaluation-plan. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Prepares a change request pack (description and justification, scope, schedule, implementation plan, risk as stated, rollback, test evidence as provided, communications, approvals route) from an engineer's notes, ticket or pull request description, with UNKNOWN for anything not provided and a question list for the engineer. Never rates risk or marks a change tested or approved. Use when the user asks to "write the change request for this", "fill in the change ticket from my notes", "prepare the CAB submission" or "turn this pull request into an RFC". Do not use for the step-by-step procedure with commands and rollback, use runbook-drafter instead; for release notes describing what shipped, use release-notes-writer. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Reads a purchase order extract (spreadsheet, CSV or pasted table) and returns a DRAFT question sheet for the buyer: possible split orders, round amounts, amounts just under an approval threshold, first-seen or near-duplicate vendors, duplicate orders and missing or self approvals, each a neutral question naming the PO numbers, never a finding. Use when the user asks to "review these purchase orders", "screen the PO log", "spot anomalies in this spend extract", "sanity-check the PO register" or "prepare buyer questions before the audit". Do not use for an expense claim or travel request checked against policy, use expense-policy-precheck instead. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Designs a pre-launch evaluation plan for a declarative agent from its instructions text, skills, capabilities, knowledge sources and sample requests: a behaviour contract of testable statements quoted from the text, test prompts by scenario family and tier with setup, expected behaviour, pass and fail criteria and red flags, a red-flag catalogue, a blank scoring sheet, a coverage table and a go or no-go checklist the owner completes and decides. Use when the user asks to "write test cases for my agent", "how do I evaluate this agent before launch", "build a test plan for the agent", "what should I check before publishing this agent" or "give me a go no-go checklist". Do not use for finding injection or leakage exposures in the instructions, use agent-instructions-red-team instead; do not use for reviewing one SKILL.md, use skill-file-reviewer instead. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Reviews a proposal, business case, deck or plan in character as an Investor archetype and returns a DRAFT review in the chat with a verdict whose conditions read as terms, findings that cite the exact passage, capital-allocation risks, what would change the verdict and five interrogation questions. Use when the user asks to "run an investor review", "what would an investor say about this", "pressure-test the capital case" or "prepare me for the investment committee". Do not use for internal budget, cost or finance-function review, use cfo-reviewer instead; for revenue forecast and pipeline, use cro-reviewer. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Reviews a proposal, business case, deck or vendor contract in character as a Head of Procurement archetype and returns a DRAFT review in the chat with a verdict, findings that cite the exact passage or clause, commercial risks, what would change the verdict and five interrogation questions. Use when the user asks to "review this from a procurement angle", "what would procurement say about this proposal", "pressure-test this vendor contract commercially", "find the holes before the sourcing committee" or "check the renewal terms like a Head of Procurement would". Do not use for liability, IP, regulatory or signing-authority questions, use general-counsel-reviewer instead; for whether the spend fits the budget, use cfo-reviewer; for vendor security, use ciso-reviewer. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Reviews a proposal, business case, deck or plan in character as a Chief Technology Officer archetype and returns a DRAFT review in the chat with a verdict, findings cited to the exact passage, technology risks (architecture, build versus buy, vendor lock-in, security of design, engineering capacity), what would change the verdict and five interrogation questions. Use when the user asks to "run a CTO review", "pressure-test the technical side of this plan", "what would a CTO ask about this" or "rehearse the technology seat before the review". Do not use for cash, payback or budget questions, use cfo-reviewer instead; for capacity and timeline questions, use coo-reviewer; for security controls, privacy or compliance, use ciso-reviewer. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Reviews a proposal, business case, deck, pricing plan, go-to-market plan or forecast in character as a Chief Revenue Officer archetype and returns a DRAFT review in the chat with a verdict, findings cited to exact passages, revenue risks, what would change the verdict and five interrogation questions. Use when the user asks to "run a CRO review", "pressure-test the revenue plan", "what would sales leadership say about this" or "challenge this forecast". Do not use for partnership, deal-structure or market-positioning reviews, use cbo-reviewer instead; for the finance seat use cfo-reviewer. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。