テスト・セキュリティのスキル

Identifies what could go wrong in a system before it is built or changed — the assets worth attacking, the entry points, the trust boundaries, and the controls that actually address the realistic threats. Use this when designing a feature or system, when a change touches authentication, data handling, payments, or external input, before a security review, or when deciding which security work is worth doing at all.

日本語の概要は準備中です。原文の説明を表示しています。

Splits work across multiple agents or sessions running at once, keeping their surfaces disjoint so results merge cleanly. Use this when facing several independent tasks with no shared state, when a plan has parallelizable steps, when a broad search or audit would be faster fanned out, or when deciding whether work can safely be split at all.

日本語の概要は準備中です。原文の説明を表示しています。

Explores the problem and the range of possible approaches before any code is written — clarifying what is actually being asked, surfacing options with their tradeoffs, and converging on one. Use this at the start of any feature, component, or behavior change, when a request is ambiguous, when the first idea is the only idea on the table, or when a design decision needs pressure-testing before commitment.

日本語の概要は準備中です。原文の説明を表示しています。

Runs the loop from discovering a weakness to confirming it is fixed — scanning, triage, prioritization by real exploitability, remediation tracking, and patch policy. Use this to stand up or fix a vulnerability program, triage scanner output, decide what to fix first, set patch SLAs, handle a disclosure from an outside researcher, or report posture to leadership.

日本語の概要は準備中です。原文の説明を表示しています。

Runs environment, health and safety on an operating site — hazard controls in order of effectiveness, incident recording and reporting obligations, and safety measurement that does not reward silence. Use this to build or audit a safety program, decide what controls a hazard actually needs, work out whether an injury is recordable or reportable, investigate an incident, or fix safety metrics that have stopped producing reports.

日本語の概要は準備中です。原文の説明を表示しています。

Drives implementation by writing a failing test first, then the smallest code that passes it. Use this before writing implementation code for any feature or bugfix, when a bug needs a regression test, when existing code is hard to change safely, or when someone asks whether a change is covered. Also use to decide what is worth testing and what is not.

日本語の概要は準備中です。原文の説明を表示しています。

Reviews a design or change for security before it ships — authentication and authorization, data handling, secrets, dependencies, and the secure-development practices around it. Use this to review an architecture or pull request for security, set secure coding standards, choose or tune SAST and DAST tooling, assess a third-party integration, or decide whether a design is safe to build.

日本語の概要は準備中です。原文の説明を表示しています。

Writes down what is being built so a team can build it and know when they are done — problem and success measure before solution, scope stated by exclusion, user-visible behavior including the states everyone forgets, acceptance criteria someone can test, and the open questions named rather than buried. Use this to write a specification, review one that is causing rework, or work out why a delivered feature technically matched the request and still was not what anyone wanted.

日本語の概要は準備中です。原文の説明を表示しています。

Builds and interrogates a project schedule — logic-driven sequencing, dependency types and lags, float and the critical path, resource loading and leveling, schedule risk analysis, and measuring progress against a baseline rather than against optimism. Use this to construct a schedule, audit one you have inherited, find out why a plan keeps slipping, work out what a date change actually costs, or judge whether a reported percentage complete means anything.

日本語の概要は準備中です。原文の説明を表示しています。

Audits a website, app, onboarding flow, or design for usability, conversion, and product problems, tying every finding to a business outcome and a severity. Use this to review an interface, diagnose low conversion or activation, find where users drop off, get structured product feedback, or decide which UX fixes to ship first. For raising visual quality rather than finding problems, use `interface-craft`.

日本語の概要は準備中です。原文の説明を表示しています。

Runs the pay cycle so it is right, on time, and provable — the calendar and cutoffs, what feeds pay from the HRIS and time systems, gross-to-net and the deductions in it, multi-jurisdiction registration and tax filing, off-cycle payments and corrections, and the reconciliation to the general ledger. Use this to design or audit a payroll process, work out what happens when someone is paid wrong, or understand what changes when you hire in a new state or country.

日本語の概要は準備中です。原文の説明を表示しています。

Designs and audits who can reach what — authentication, authorization models, privileged access, service credentials, and joiner-mover-leaver process. Use this to design a permissions model, run an access review, reduce standing privilege, handle offboarding, set up SSO or MFA, manage service and machine credentials, or diagnose why permissions have sprawled.

日本語の概要は準備中です。原文の説明を表示しています。

Defines and applies visual brand — logo usage, palette, typography, imagery direction, and the guidelines that keep expression consistent across product and marketing surfaces. Use this to establish a brand from scratch, audit whether an existing brand is being applied consistently, build brand guidelines, or decide how a brand should express itself in an unfamiliar format.

日本語の概要は準備中です。原文の説明を表示しています。

Runs a security incident from detection to closure — triage, containment, investigation, communication, and the review afterward. Use this when a compromise is suspected or confirmed, when preparing an incident response plan or running an exercise, when deciding whether something is an incident, or when a breach may trigger notification obligations.

日本語の概要は準備中です。原文の説明を表示しています。

Owns the security posture of the organization — architecture, program strategy, risk acceptance, incident command, and the authority to stop work that creates unacceptable exposure. Use this for a security strategy or program decision, when a technical choice creates security risk that needs a verdict, when deciding whether to accept or block a risk, when standing up a security function, or when security and delivery priorities conflict and someone has to decide.

日本語の概要は準備中です。原文の説明を表示しています。

Finds out whether a problem is real and a solution would work, before building it — recruiting the right people, interviewing without leading them, separating what users say from what they do, naming the riskiest assumption and testing that one first, and reaching a decision rather than a summary. Use this to validate a problem, test an idea cheaply, decide whether to build something, or fix a discovery process that keeps confirming what the team already believed.

日本語の概要は準備中です。原文の説明を表示しています。

Identifies, assesses, and tracks organizational risk — building and maintaining a risk register, scoring exposure, assigning owners and treatments, and preparing for audit. Use this to stand up a risk program, assess the risk in a decision or initiative, prepare for a certification or audit, decide whether a risk should be accepted, mitigated, transferred, or avoided, or report risk posture to leadership.

日本語の概要は準備中です。原文の説明を表示しています。

Runs content as an operation — the production pipeline, editorial calendar, repurposing engine, competitive content intelligence, and audits of what already exists. Use this to build or fix a content production system, plan a calendar, decide how one piece becomes many, rank content ideas by expected impact, or audit an existing library for what to update, consolidate, or retire. For deciding what territory to own and why, use `content-strategy` first.

日本語の概要は準備中です。原文の説明を表示しています。

Tracks hardware and software assets through their life — procurement, ownership, licensing, refresh, and disposal. Use this to build an asset register, prepare for a software audit, plan a refresh cycle, control license spend, or dispose of equipment safely.

日本語の概要は準備中です。原文の説明を表示しています。

Executes joiner, mover and leaver processes — provisioning, group membership, access changes on role change, and complete deprovisioning. Use this to set up or fix joiner-mover-leaver, deprovision someone completely, clean up accumulated access, audit group membership, or find accounts that outlived their owners.

日本語の概要は準備中です。原文の説明を表示しています。

Designs, runs, and reads A/B tests and growth experiments — hypothesis, sample size, duration, and honest interpretation. Use this to plan a test, judge whether a result is real, build an experimentation program, decide what to test next, or diagnose why tests keep producing inconclusive or non-replicating results.

日本語の概要は準備中です。原文の説明を表示しています。

Audits and rewrites landing pages, homepages, and sales pages to increase conversion — diagnosing why a page is not converting, rewriting headlines, hero copy and calls to action, and prioritizing which changes to test first. Use this when a page underperforms, when someone pastes a URL or screenshot asking what is wrong, when writing a new page, or when deciding which conversion changes are worth testing.

日本語の概要は準備中です。原文の説明を表示しています。

Plans under genuine uncertainty — building scenarios, identifying which assumptions are load-bearing, setting early-warning indicators, and stress-testing a plan against futures rather than forecasting one. Use this when a decision depends on something unknowable, when a plan assumes conditions that may not hold, before a large irreversible commitment, or when a market, regulatory, or technology shift could invalidate the strategy.

日本語の概要は準備中です。原文の説明を表示しています。

Evaluates a software or startup idea against problem, market, competition, monetization, defensibility, and execution, and returns a verdict rather than encouragement. Use this when an idea needs pressure-testing before anyone builds, when deciding whether something is worth pursuing, when assessing competition or willingness to pay, or when a validated idea needs a first-customers and MVP plan. Default to scrutiny; the useful answer is usually the unwelcome one.

日本語の概要は準備中です。原文の説明を表示しています。