テスト・セキュリティのスキル

Programmatically clear WP Rocket cache from a third-party plugin / theme when data changes — the public rocket_clean_* function family (rocket_clean_post, rocket_clean_files, rocket_clean_term, rocket_clean_user, rocket_clean_home, rocket_clean_minify, rocket_clean_cache_busting, rocket_clean_domain, rocket_clean_cache_dir). Critical detection rule — WP Rocket is a PAID plugin not on Packagist; always feature-detect via function_exists('rocket_clean_post') OR defined('WP_ROCKET_VERSION') before calling, since not every site has it. Never raw-unlink the cache directory or call wp_cache_flush() expecting it to clear WP Rocket — wp_cache_flush is WP object cache, WP Rocket is FILE cache. The before_*_clean_* / after_*_clean_* action lifecycle hooks fire around every clean — useful for audit logging, monitoring, custom invalidation chains. Use when integrating cache invalidation in a companion plugin, WC integration, custom data plugin. Triggers on rocket_clean_, before_rocket_clean, af...

日本語の概要は準備中です。原文の説明を表示しています。

Per-toolkit hardening audit loop for NV oOS Pro tools. Systematically scans each addons/pro/includes/tools/<toolkit> (and its plugins/nvoos-content-graph-pro mirror) for the four recurring production failure classes — unguarded shell calls that fatal on exec-disabled hosts, calls to nonexistent client methods, string-assuming parsing of provider responses that may be arrays, and provider enum/service mismatches — then fixes, tests (Docker PHPUnit), and validates (phpcs both standards) before moving to the next toolkit. Use when asked to audit a toolkit, review the X tools for similar issues, do the same for the other toolkits, or continue the toolkit audit loop. The first case study (document-generation) found 3 fatal bugs + 1 broken regex.

日本語の概要は準備中です。原文の説明を表示しています。

Make a WooCommerce plugin HPOS-compatible (High-Performance Order Storage, default-on in WC 10.x) — declare via FeaturesUtil::declare_compatibility on before_woocommerce_init, replace $wpdb->postmeta / WP_Query order code with wc_get_orders + WC_Order::get_meta / update_meta_data, gate runtime branches on OrderUtil::custom_orders_table_usage_is_enabled, build admin hook names dynamically with OrderUtil::get_order_admin_screen (HPOS = woocommerce_page_wc-orders, legacy = shop_order). Use when scaffolding an order-touching plugin, auditing existing code for HPOS readiness, or fixing post-WC-10 silent breakage. Triggers on shop_order, get_post_meta with order context, FeaturesUtil, OrderUtil, custom_order_tables, before_woocommerce_init.

日本語の概要は準備中です。原文の説明を表示しています。

Repair and triage guide for the NV oOS PHPUnit test suite — Docker test environment (incl. cross-worktree one-off runners), CI log triage, and 71 recurring root-cause patterns (hook resets, singleton interference, WP_Error envelope drift, coverage-manifest drift, preset-accounting gaps, and more — see the patterns section). Covers the cluster-by-cluster PR workflow against alpha-working and validation gates. Use when fixing failing PHPUnit tests, triaging CI logs, repairing test drift, deciding between a production fix and a test fix, or starting a new fix cluster.

日本語の概要は準備中です。原文の説明を表示しています。

Audits WordPress plugin/theme code for secret-handling and credential issues — hardcoded API keys, DB credentials, or signing secrets in source; weak randomness (rand, mt_rand, uniqid) used for security tokens, password reset links, nonces, or session IDs; password storage with md5/sha1/crypt instead of password_hash; insecure cookie flags (missing Secure, HttpOnly, SameSite) on sensitive cookies; secrets logged via error_log / var_dump in production code paths. Use before plugin release, when reviewing auth/registration/login features, when integrating third-party APIs, or when the user mentions "API key", "token", "session", "password reset".

日本語の概要は準備中です。原文の説明を表示しています。

Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.

日本語の概要は準備中です。原文の説明を表示しています。

Audits WordPress plugin or theme PHP code for internationalization (i18n) correctness — text-domain consistency, use of escaped translation helpers (esc_html__, esc_attr__, esc_html_e), correct placeholder helpers (sprintf with translator comments, _n for plurals, _x for context), no variable text-domains, no concatenation inside __() calls, presence of load_plugin_textdomain or load_theme_textdomain, and matching declared Text Domain in the plugin/theme header. Use before plugin/theme release, when reviewing contributor PRs, when adding new strings, when migrating to a new text domain, or when a translator reports issues with the .pot file.

日本語の概要は準備中です。原文の説明を表示しています。

Audits WordPress plugin or theme PHP code for the most common security mistakes — missing nonce checks, capability checks, input sanitization, output escaping, unslashing, SQL preparation, AJAX nopriv exposure, file/path traversal, and unsafe redirects. Use when reviewing pull requests, before releasing a plugin, when the user asks "is this secure", or when handling code that touches $_GET / $_POST / $_REQUEST / $_COOKIE / $_FILES / $_SERVER, admin-ajax / admin-post, REST endpoints, options, user meta, custom DB queries, or file uploads.

日本語の概要は準備中です。原文の説明を表示しています。

Deep security audit for WordPress plugin/theme PHP code, covering issues beyond the basic sanitize/escape/nonce checklist — PHP object injection (unserialize), SSRF in remote requests, CSRF on state-changing GET handlers, mass assignment via $_POST loops, insecure file include / template injection, mail header injection, ZipSlip in archive extraction, type-juggling in auth comparisons, and TOCTOU race patterns in option/meta locks. Use after or alongside wp-security-audit when reviewing complex plugins, REST APIs, integrations that fetch remote URLs, file processors, or any code that handles uploads, archives, or self-rolled auth tokens.

日本語の概要は準備中です。原文の説明を表示しています。

Picks the right WordPress storage primitive for plugin data: options, user/post/term/comment meta, transients, site options, site transients, or custom tables. Covers grouped settings, autoload management, transient TTL rules, serialized/JSON blob trade-offs, multisite storage caveats, and naming conventions. Use when scaffolding settings, choosing persistence for plugin-owned data, or auditing update_option/get_option/get_post_meta/set_transient/autoload usage.

日本語の概要は準備中です。原文の説明を表示しています。

Generate production-quality Excalidraw architecture diagrams from natural language. Visual structure maps to conceptual structure — fan-out for one-to-many, timelines for sequences, convergence for aggregation. Includes self-validation via Playwright render review.

日本語の概要は準備中です。原文の説明を表示しています。

Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, update or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.

日本語の概要は準備中です。原文の説明を表示しています。

Manage the NV oOS Pro Toolkit Security Operations system — audit events, security training, maintenance windows, and incident records. Covers the full security ops lifecycle: audit logging, incident detection/response, maintenance scheduling, and compliance training tracking. Use when working with security audit trails, investigating incidents, scheduling maintenance windows, managing security training programs, or troubleshooting security operations data.

日本語の概要は準備中です。原文の説明を表示しています。

Autonomous AI security pen testing. Executes real exploits against web applications to find SQL injection, XSS, SSRF, authentication flaws, and IDOR vulnerabilities. Reports only confirmed, reproducible findings — no false positives.

日本語の概要は準備中です。原文の説明を表示しています。

Audit on-page SEO and GEO (generative engine optimization) signals across the site — title tags, meta descriptions, H1/H2/H3 hierarchy, canonical tags, Open Graph, structured data, content length, internal link density, and AI-citation readiness. Use this skill whenever the user asks to "audit SEO", "check metadata", "review titles and descriptions", "check heading structure", "run an SEO audit", "GEO audit", "check schema markup", "find SEO issues", or review any on-page signal affecting organic or AI-search visibility. Output is a prioritized issue list with per-page findings and fixes.

日本語の概要は準備中です。原文の説明を表示しています。

Audit an existing sitemap.xml / robots.txt or generate new ones following sitemaps.org protocol and Google Search Central guidance, with a growth-first default that allows every crawler including AI search and AI training bots. Use this skill whenever the user asks to "build a sitemap", "generate sitemap.xml", "audit the sitemap", "refresh sitemap", "write robots.txt", "check robots", "allow AI crawlers", "block AI crawlers", "fix crawl budget", "submit to Google", or any other discovery / indexing configuration task. Output is a valid sitemap.xml (or sitemap index) and/or robots.txt, plus a written audit when auditing.

日本語の概要は準備中です。原文の説明を表示しています。

Generate or audit an `/llms.txt` file at the site root that makes the site legible to LLMs and AI answer engines at inference time, following the llms.txt proposal (Jeremy Howard, 2024). Use this skill whenever the user asks to "build llms.txt", "create llms.txt", "generate llms.txt", "audit llms.txt", "make my site LLM-friendly", "expose the site to AI assistants", "let ChatGPT / Claude / Perplexity cite my site", "add an AI assistants index", or asks about `.md` companion pages for LLM consumption. Output is a valid `llms.txt` file (or an audit) plus optional `.md` companion page generation for top pages.

日本語の概要は準備中です。原文の説明を表示しています。

Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions "grill me".

日本語の概要は準備中です。原文の説明を表示しています。

Use test-driven development for behavior-changing feature or fix work, and whenever the user mentions TDD, test-first, red-green-refactor, tracer bullets, integration tests, or public-interface behavior tests. Skip for docs-only, path-only rename, formatting-only, or purely mechanical chores unless explicitly requested.

日本語の概要は準備中です。原文の説明を表示しています。

Classify GitHub issues into the factory's live label queue and write an auditable snapshot. Use for backlog triage or a scheduled triage run.

日本語の概要は準備中です。原文の説明を表示しています。

Inspect factory health, stale work, CI, security advisories, and recent run evidence without implementing fixes.

日本語の概要は準備中です。原文の説明を表示しています。

Classify incoming issues into the live GitHub label queue, reproduce where cheap, and write an auditable QUEUE.md snapshot. Use when triaging a backlog, running the scheduled triage routine, or deciding what the factory should pick up next.

日本語の概要は準備中です。原文の説明を表示しています。

Scheduled health sweep that closes the factory loop - reads CI failures, recent commits, dependency and security advisories, and live queue labels, then files issues and writes an immutable run record. Use for the nightly or weekly monitor routine.

日本語の概要は準備中です。原文の説明を表示しています。

Independently verify a factory pull request, including fail-closed gates, negative test proof, scope, and load-bearing review.

日本語の概要は準備中です。原文の説明を表示しています。