テスト・セキュリティのスキル

Apply security best practices for Apple Notes automation scripts. Trigger: "apple notes security".

日本語の概要は準備中です。原文の説明を表示しています。

Analyze and apply AssemblyAI secret, region, consent, retention, deletion, and model-training controls. Use when reviewing security or regulated speech workflows. Trigger with "AssemblyAI security", "AssemblyAI privacy", or "data retention".

日本語の概要は準備中です。原文の説明を表示しています。

Audit a Python project's installed dependencies for known CVEs by wrapping pip-audit (PyPA's official vulnerability auditor) and emitting findings in the canonical penetration-tester schema. Detects vulnerable direct AND transitive packages, normalizes pip-audit's severity output via OSV severity bands, falls back to pip list --outdated when pip-audit isn't installed, and supports requirements.txt, pyproject.toml (PEP 621), Pipfile.lock, and poetry.lock as input sources. Use when: pre-merge gate on a Python project, post-incident sweep after a PyPI compromise (e.g. ctx, request-toolbelt typosquats, ultralytics 8.3.42 compromise), SOC2 evidence collection, or inheriting an unfamiliar Python codebase. Threshold: any HIGH or CRITICAL CVE in the resolved dependency tree. MODERATE / LOW reported informationally. Trigger with: "audit python deps", "pip vulnerability scan", "check pypi packages for CVEs", "pip-audit run".

日本語の概要は準備中です。原文の説明を表示しています。

Analyze and gate an AssemblyAI integration across contracts, security, reliability, cost, observability, retention, and rollback. Use when preparing a launch or material change. Trigger with "AssemblyAI production checklist" or "go live".

日本語の概要は準備中です。原文の説明を表示しています。

Audit a Node.js project's installed npm dependency tree for known CVEs by wrapping the npm audit JSON output and emitting findings in the canonical penetration-tester schema. Detects direct AND transitive vulnerabilities, normalizes npm's severity scale (info/low/moderate/ high/critical) to the shared Severity enum, and parses both v1 and v2 audit output formats so the skill works against npm 6 and npm 7+ lockfiles. Use when: pre-merge gate on a Node project, post-incident sweep after a transitive package compromise (e.g. event-stream, ua-parser, node-ipc, color.js), SOC2 vendor-management evidence collection, or auditing an inherited or acquired Node codebase. Threshold: any HIGH or CRITICAL CVE in the resolved dependency tree. MODERATE / LOW reported informationally. Trigger with: "audit npm deps", "npm vulnerability scan", "check node packages for CVEs", "npm audit".

日本語の概要は準備中です。原文の説明を表示しています。

Test automate API endpoint testing including request generation, validation, and comprehensive test coverage for REST and GraphQL APIs. Use when testing API contracts, validating OpenAPI specifications, or ensuring endpoint reliability. Trigger with phrases like "test the API", "generate API tests", or "validate API contracts".

日本語の概要は準備中です。原文の説明を表示しています。

Run a bounded AssemblyAI pre-recorded smoke test with explicit model fallback and safe output. Use when proving a new integration. Trigger with "AssemblyAI hello world", "first AssemblyAI transcript", or "AssemblyAI smoke test".

日本語の概要は準備中です。原文の説明を表示しています。

Build a bounded CI contract gate for an Attio integration using fixtures, schema checks, and an optional read-only smoke request. Use when Attio changes need pull-request evidence without mutating CRM data. Trigger with "Attio CI", "test Attio integration", or "Attio pull request gate".

日本語の概要は準備中です。原文の説明を表示しています。

Audit a target's CORS posture — Access-Control-Allow-Origin handling, reflected-origin bypass, credentials+wildcard mismatch, preflight OPTIONS behavior, Vary header correctness. Use when: a third-party integration is failing CORS preflight and someone proposes "just set Allow-Origin to *" as the fix, OR your bug-bounty inbox has a credential-reuse exploit chain. Threshold: any reflection of arbitrary Origin into Allow-Origin, Allow-Credentials:true with wildcard origin (browser-rejected combo but server config wrong), missing Vary:Origin on per-origin responses, preflight cached over 86400s, OR Allow-Origin trust of attacker- controlled subdomain pattern. Trigger with: "audit cors", "check cors policy", "cors bypass", "preflight check".

日本語の概要は準備中です。原文の説明を表示しています。

Execute automate SOC 2 audit preparation including evidence gathering, control assessment, and compliance gap identification. Use when you need to prepare for SOC 2 audits, assess Trust Service Criteria compliance, document security controls, or generate readiness reports. Trigger with phrases like "SOC 2 audit preparation", "SOC 2 readiness assessment", "collect SOC 2 evidence", or "Trust Service Criteria compliance".

日本語の概要は準備中です。原文の説明を表示しています。

Build AssemblyAI CI with offline REST, Streaming v3, webhook, gateway, secret, and lifecycle tests plus a tightly gated live lane. Use when adding automated verification. Trigger with "AssemblyAI CI" or "contract test".

日本語の概要は準備中です。原文の説明を表示しています。

Harden an Attio integration with least-privilege credentials, tenant isolation, log redaction, raw-body webhook verification, idempotency, and incident-ready rotation. Use when reviewing Attio security controls or preparing production access. Trigger with "Attio security", "secure Attio integration", or "Attio webhook signature".

日本語の概要は準備中です。原文の説明を表示しています。

Establish a repeatable local Attio development loop with sanitized fixtures, a non-production workspace, explicit mutation switches, and cleanup receipts. Use when iterating on Attio mappings or API behavior. Trigger with "Attio local development", "Attio dev loop", or "test Attio locally".

日本語の概要は準備中です。原文の説明を表示しています。

Analyze and design an AssemblyAI architecture spanning pre-recorded jobs, Streaming v3, LLM Gateway, callbacks, queues, retention, and audit evidence. Use when performing system design or review. Trigger with "AssemblyAI architecture" or "design AssemblyAI pipeline".

日本語の概要は準備中です。原文の説明を表示しています。

Diagnostic-only test suite auditor. Classifies repo type, maps against 7-layer testing taxonomy (git hooks → static → unit → integration → system → E2E → acceptance), runs deterministic quality gates (coverage, mutation, CRAP, architecture, escape-scan), builds RTM / personas / journeys traceability, produces TEST_AUDIT.md, updates tests/TESTING.md, and mandatorily hands off to implement-tests when gaps are found. Use when auditing test quality, finding test gaps, or running the full 7-layer sweep. Trigger with "audit tests", "find gaps", "test audit", "check test quality", "full sweep", "7-layer audit", "rtm check".

日本語の概要は準備中です。原文の説明を表示しています。

Audit wallet security by analyzing token approvals, permissions, and transaction patterns. Use when checking wallet security, reviewing approvals, or assessing risk exposure. Trigger with phrases like "audit wallet", "check approvals", "security scan", or "revoke tokens".

日本語の概要は準備中です。原文の説明を表示しています。

Audit access control implementations for security vulnerabilities and misconfigurations. Use when reviewing authentication and authorization. Trigger with 'audit access control', 'check permissions', or 'validate authorization'.

日本語の概要は準備中です。原文の説明を表示しています。

Execute Apollo.io production deployment checklist. Use when preparing to deploy Apollo integrations to production, doing pre-launch verification, or auditing production readiness. Trigger with phrases like "apollo production checklist", "deploy apollo", "apollo go-live", "apollo production ready", "apollo launch checklist".

日本語の概要は準備中です。原文の説明を表示しています。

Apply Apollo.io API security best practices. Use when securing Apollo integrations, managing API keys, or implementing secure data handling. Trigger with phrases like "apollo security", "secure apollo api", "apollo api key security", "apollo data protection".

日本語の概要は準備中です。原文の説明を表示しています。

Secure AppFolio API credentials and tenant data. Trigger: "appfolio security".

日本語の概要は準備中です。原文の説明を表示しています。

Create, read, and list Apple Notes using JXA and AppleScript. Use when learning Notes automation, creating your first automated note, or testing read/write access to Apple Notes from scripts. Trigger: "apple notes hello world", "create apple note", "read apple notes", "apple notes example", "osascript notes".

日本語の概要は準備中です。原文の説明を表示しています。

Set up local Apify Actor development with the Apify CLI and Crawlee. Use when creating Actors locally, testing with the apify run command, inspecting local storage, or establishing a fast develop-test-deploy cycle before pushing to the platform. Trigger with "apify dev setup", "apify local development", "develop actor locally", "apify run local".

日本語の概要は準備中です。原文の説明を表示しています。

Apply Anthropic Claude API security best practices for key management, input validation, and prompt injection defense. Use when securing API keys, validating user inputs before sending to Claude, or implementing content safety guardrails. Trigger with phrases like "anthropic security", "claude api key security", "secure anthropic", "prompt injection defense".

日本語の概要は準備中です。原文の説明を表示しています。

Configure Apollo.io local development workflow. Use when setting up development environment, testing API calls locally, or establishing team development practices. Trigger with phrases like "apollo local dev", "apollo development setup", "apollo dev environment", "apollo testing locally".

日本語の概要は準備中です。原文の説明を表示しています。