テスト・セキュリティのスキル

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

日本語の概要は準備中です。原文の説明を表示しています。

Structured guide for setting up A/B tests with mandatory gates for hypothesis, metrics, and execution readiness.

日本語の概要は準備中です。原文の説明を表示しています。

Use for Nauthilus Redis client, Redis Cluster/Sentinel/topology behavior, Redis-backed token/session/flow/cache/bruteforce state, Lua Redis scripts, `NOSCRIPT` recovery, script upload/retry behavior, redismock tests, local cache coordination, and fail-closed runtime state changes.

日本語の概要は準備中です。原文の説明を表示しています。

Use for Nauthilus Lua plugins, Lua callback tests, policy compiler and registry work, Lua environment and subject sources, Lua actions, hooks, backend scripts, policy facts, obligation targets, `server/lualib`, `server/lua-plugins.d`, `server/policy`, and JSON fixtures under `testdata/lua`.

日本語の概要は準備中です。原文の説明を表示しています。

Use for Nauthilus authentication and identity-provider work touching OIDC, OAuth2, SAML, MFA, TOTP, WebAuthn, recovery codes, LDAP-backed identity, browser login and consent flows, token/session/flow state, `private_key_jwt`, introspection, discovery metadata, endpoint-specific client authentication, and security-sensitive auth tests.

日本語の概要は準備中です。原文の説明を表示しています。

Use when starting, stopping, or inspecting the dev stack for this Hydrolix Grafana datasource plugin — Grafana (with the plugin bind-mounted), ClickHouse, Keycloak (OAuth), and the on-demand playwright runner. Covers `docker compose up` semantics, the `dist/` prerequisite, serving plugin artifacts from an alternate folder (any path, live or frozen, via an ephemeral compose override), switching Grafana versions, hot-reload behaviour, delve attach, log streaming, OAuth/anonymous auth, and ClickHouse fixture access. Apply whenever a task needs the plugin running locally, needs to reset the stack, or needs to debug why Grafana won't come up.

日本語の概要は準備中です。原文の説明を表示しています。

Use when running the dev Grafana stack and/or the Playwright e2e suite against a *packaged* plugin zip (a release/RC artifact like `hydrolix-hydrolix-datasource-<ver>.zip`) rather than the working-tree `dist/`. Unpacks the package into a timestamped `dist_<timestamp>/dist` sandbox alongside copies of the compose artifacts, so the run is reproducible and the folder stays available to experiment with afterwards. Delegates stack bring-up to `stack-run` (frozen mode: read-only mount + `DEV=false` so the mage-watcher can't rebuild the packaged Go binary), verifies signature/version, runs the suite, and treats cleanup as optional — the sandbox is deleted only with the user's approval. Apply whenever the task is "test this plugin package / zip" or "run e2e against the built artifact".

日本語の概要は準備中です。原文の説明を表示しています。

Use when writing, running, or debugging Playwright e2e tests in this Hydrolix Grafana datasource plugin. Covers the docker-compose `playwright` service invocation, locator patterns for Grafana's react-select / Monaco editor / panel chrome, state-dependent interactions in QueryEditor, and timeout/retry expectations. Apply whenever a task touches `tests/*.spec.ts`, `tests/helpers.ts`, the `playwright` service in `docker-compose.yaml`, or the test results under `test-results/`.

日本語の概要は準備中です。原文の説明を表示しています。

Use when building this Hydrolix Grafana datasource plugin — frontend webpack bundle (`dist/module.js*`) or Go backend binary (`dist/gpx_plugin_*`). Covers the split between host-built frontend and container-built Go, when each needs an explicit rebuild, watch vs one-shot, and the verification chain (typecheck / lint / unit tests). Apply for any task that edits `src/**`, `pkg/**`, `Magefile.go`, `webpack.config.ts`, or that needs to confirm `dist/` matches the working tree before running e2e or the dev stack.

日本語の概要は準備中です。原文の説明を表示しています。

Plan or review FriendlyBet architecture, implementation, schema, data flows, scoring, provider integrations, static/PWA behavior, Supabase/RLS impact, migrations, automation, and technical sequencing. Use when a task asks how to build, refactor, generalize, integrate, test, or safely ship FriendlyBet code.

日本語の概要は準備中です。原文の説明を表示しています。

Review FriendlyBet privacy, RLS security, auth, recovery codes, session storage, data minimization, public snapshots, share surfaces, legal/gambling wording, real-money risk, and compliance-sensitive product changes. Use when a task changes data access, user identity, public sharing, money-like language, security posture, or legal risk.

日本語の概要は準備中です。原文の説明を表示しています。

Review FriendlyBet quality, regression risk, test plans, release readiness, version bump discipline, scoring/locking correctness, provider fallback behavior, and dirty-worktree safety. Use before shipping app code, scoring changes, migrations, sports integrations, copy updates, PWA cache changes, or any risky user-facing flow.

日本語の概要は準備中です。原文の説明を表示しています。

Execute per-layer adversarial audit/remediation loop, persist fixes metadata, and manage fresh-run advancement

日本語の概要は準備中です。原文の説明を表示しています。

Layer-by-layer remediation loop using adversarial audits, targeted fixes, and fresh-run verification enforcement

日本語の概要は準備中です。原文の説明を表示しています。

Assess pipeline layer state, detect prerequisite blockers, classify audit status, and persist remediation plan

日本語の概要は準備中です。原文の説明を表示しています。

Scoring rubrics for all 5 pipeline layers (Vision, Architecture, IA, BE, FE). Use when auditing specs, running self-checks, or remediating ambiguity gaps.

日本語の概要は準備中です。原文の説明を表示しています。

Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls.

日本語の概要は準備中です。原文の説明を表示しています。

Execute code-quality gates for a completed phase including tests, coverage, lint, types, build, CI/CD, staging, migrations, and spec coverage

日本語の概要は準備中です。原文の説明を表示しています。

Design and implement comprehensive testing strategies. Use when setting up tests, choosing test types, implementing TDD, or improving code quality. Covers unit tests, integration tests, E2E tests, test-driven development, and testing best practices.

日本語の概要は準備中です。原文の説明を表示しています。

Methodology for writing complete, unambiguous IA, BE, and FE specification documents in the CFSA pipeline. Covers completeness testing, progressive section writing, cross-reference checking, and ambiguity gate application.

日本語の概要は準備中です。原文の説明を表示しています。

Structured methodology for adversarial thinking — generating attack scenarios, abuse cases, race conditions, and security edge cases against specs and implementations. Produces spec-level gap items, not code-level fixes.

日本語の概要は準備中です。原文の説明を表示しています。

Determine ambiguity audit scope, enumerate source documents from filesystem, and persist rubric file bindings

日本語の概要は準備中です。原文の説明を表示しています。

Cascade approved evolution changes through downstream layers, assess impact, run consistency checks, and write evolution audit record

日本語の概要は準備中です。原文の説明を表示しています。

Orchestrate concurrent analysis or implementation across independent domains. Use when a task can be decomposed into independent workstreams (e.g., via simultaneous tool calls or background processes) — spec writing, code review, security audit, feature implementation.

日本語の概要は準備中です。原文の説明を表示しています。