테스트·보안 스킬

Audit, design, and migrate Identity and Access Management — cloud provider IAM (AWS, GCP, Azure), identity providers (Okta, Entra ID / Azure AD, Auth0, Google Workspace), application authorization (RBAC, ABAC, ReBAC), and federated identity. Use when the user mentions 'IAM,' 'identity,' 'access management,' 'least privilege,' 'role design,' 'SSO,' 'SAML,' 'OIDC,' 'OAuth,' 'JIT access,' 'just-in-time access,' 'break-glass,' 'service accounts,' 'RBAC,' 'ABAC,' 'privilege creep,' 'role explosion,' 'identity governance,' 'IAM strategy,' 'identity migration,' 'Okta,' 'Entra ID,' 'Azure AD,' 'Auth0,' 'Cognito,' or needs identity consultant-level guidance.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit applications and infrastructure handling Protected Health Information against HIPAA — Security Rule (administrative, physical, technical safeguards), Privacy Rule, Breach Notification Rule, plus HITECH. Covers ePHI scoping, the 18 HIPAA identifiers, Business Associate Agreement (BAA) chain-of-liability, minimum-necessary standard, and breach notification timing. Use when the user mentions 'HIPAA,' 'HIPAA Security Rule,' 'HIPAA Privacy Rule,' 'PHI,' 'ePHI,' 'protected health information,' 'BAA,' 'business associate agreement,' 'covered entity,' 'business associate,' 'minimum necessary,' 'HIPAA breach,' 'HITECH,' 'healthcare compliance,' 'medical data,' 'patient data,' or audits any system that creates, receives, maintains, or transmits PHI.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Triage a single security finding — from a scanner, audit, advisory, or report — to a defensible disposition with a mitigation plan, false-positive justification, or accepted-risk writeup. Use when the user mentions 'triage this finding,' 'is this a real vulnerability,' 'mitigation plan,' 'false positive,' 'accept this risk,' 'compensating controls,' 'risk justification,' 'security ticket,' 'CVSS this,' 'should we fix this,' 'disposition,' 'sign off on,' or has a single security finding and needs to decide what to do.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit project dependencies, frameworks, languages, and dev tools for known vulnerabilities, CVEs, and security anti-patterns. Use when the user mentions 'dependency audit,' 'npm audit,' 'CVE,' 'vulnerable packages,' 'supply chain security,' 'outdated dependencies,' 'known vulnerabilities,' 'security advisory,' 'package security,' 'framework vulnerability,' 'is this package safe,' or needs to check whether their stack has known security issues.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Map your security posture against the NIST Cybersecurity Framework 2.0 (Govern, Identify, Protect, Detect, Respond, Recover). Produce a gap analysis, current/target tier assessment, and roadmap in the governance language that boards, auditors, and CISOs actually use. Use when the user mentions 'NIST CSF,' 'CSF 2.0,' 'cybersecurity framework,' 'security posture,' 'governance mapping,' 'CSF gap analysis,' 'CSF tiers,' 'cybersecurity maturity,' 'security roadmap,' 'CISO report,' 'board reporting,' 'security program,' or needs to translate technical findings into governance language.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit cryptography implementation — algorithm choice, key sizes, KDF parameters, IV/nonce handling, signature verification, randomness, TLS configuration, and key rotation. Deeper than owasp-audit A02. Use when the user mentions 'crypto review,' 'cryptography audit,' 'encryption review,' 'KDF,' 'PBKDF2,' 'Argon2,' 'bcrypt cost,' 'IV reuse,' 'nonce reuse,' 'AES mode,' 'AES-GCM,' 'AES-ECB,' 'signature verification,' 'TLS configuration,' 'cipher suites,' 'key rotation,' 'libsodium,' 'BoringSSL,' or 'is this crypto right.'

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit container images, Dockerfiles, and Kubernetes manifests for misconfigurations, excessive privileges, exposed secrets, and runtime risks. Use when the user mentions 'container security,' 'Docker security,' 'Dockerfile audit,' 'Kubernetes security,' 'K8s security,' 'pod security,' 'container hardening,' 'kubectl audit,' 'image scanning,' 'distroless,' 'rootless containers,' 'pod security policy,' 'pod security standards,' 'PSS,' 'network policy,' 'OPA Gatekeeper,' 'Kyverno,' 'runtime security,' or needs to review container or orchestration security.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit cloud infrastructure (AWS, GCP, Azure) for misconfigurations, excessive permissions, and security gaps. Use when the user mentions 'cloud security,' 'cloud audit,' 'AWS security,' 'GCP security,' 'Azure security,' 'IAM audit,' 'S3 bucket,' 'cloud misconfiguration,' 'cloud hardening,' or needs to review cloud infrastructure security.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Learn from public breach disclosures — extract the audit question each one implies and check your own stack. Capital One IMDS abuse, LastPass vault exfiltration, Okta Lapsus$, Snowflake credential reuse, MOVEit, SolarWinds, Equifax, Target POS, Codecov, Uber, Twilio — what would you check now if your boss said 'could that happen to us?' Use when the user mentions 'breach analysis,' 'lessons learned,' 'security postmortem,' 'breach patterns,' 'breach lessons,' 'has this happened to us,' 'apply breach lessons,' 'preempt breaches,' 'security retrospective,' 'real-world security incidents,' or wants to harden against known attacker playbooks.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Apply the NIST AI Risk Management Framework (AI RMF 1.0) and adjacent guidance to AI / ML systems — model lifecycle governance, fairness and bias evaluation, robustness, transparency, accountability, third-party model risk, monitoring for drift, and AI incident response. Broader than prompt-injection (which is the security slice). Use when the user mentions 'AI risk,' 'AI governance,' 'NIST AI RMF,' 'AI compliance,' 'ML governance,' 'model risk management,' 'AI fairness,' 'AI bias,' 'algorithmic accountability,' 'AI Bill of Rights,' 'EU AI Act,' 'AI transparency,' 'model card,' 'AI red team,' 'AI safety,' 'responsible AI,' 'model drift,' 'concept drift,' 'AI monitoring,' 'AI incident,' or needs to assess or govern an AI / ML system.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Presents options for merge, PR, or cleanup. Use when work is complete, tests pass, and you must decide how to integrate.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Install-time cooldowns for npm/bun plus a sandboxed pre-install scan for bypasses. Use for supply-chain attacks or npm security.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Pre-deployment security audit organized by OWASP Top 10. Use when reviewing code before shipping or going to production.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Web accessibility patterns for news and academic sites. Use for WCAG audits, alt text, accessible data viz, and assistive tech.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit every CLAUDE.md in this project for drift against the last week of git history. Flags sections that reference deleted files, renamed paths, or removed dependencies. Read-only — returns a punch list, never edits.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Scan code, dependencies, containers, IaC and SBOMs with Snyk via its first-party MCP server: authenticate, trust a folder, run the right scanner, read the findings, fix and re-scan. Includes package-health checks before adding a dependency.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Check a mathematical-modeling paper's in-text citations, bibliography, appendix length and content, code, supporting files, reproducibility, consistency, and anonymity. Use when the user provides a paper or related materials and wants one consolidated P0-P3 audit; do not generate or invent missing sources or programs.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

对数学建模竞赛论文进行两层AI痕迹审计——第一层9维检测(语言层面60%：连接词/排比/拔高词/被动句/段落规律/文本复杂度；事实层面40%：引文验证/数值一致性/术语一致性)，第二层模型合理性深度审查。严格判分+一票否决+问题标红。输出分层HTML报告。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Translate a complete mathematical modeling contest problem sentence by sentence into precise modeling language, preserve every substantive condition and definition, expose hidden constraints, draw a mandatory Mermaid cross-question flowchart, audit omissions, and deliver one easy-to-open Markdown report. For Huawei Cup (CPGMCM) graduate-contest problems, additionally prepend a plain-language layer that rewrites the background and questions as a primary-school word problem with a mandatory term-mapping table. Optionally render the finished report as one standalone HTML page on request. Use whenever a user supplies a CUMCM, CPGMCM, or other modeling problem and asks to interpret, translate, unpack, read closely, identify requirements, or avoid missing details before modeling.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Bring an existing codebase into Dryforge, once. Reads the code, asks what code cannot show — business rules, security policy, what is intentional — and writes the project docs at the entry points agents already read. Use when the user invokes the `migration` skill on an existing project. Requires git.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Take screenshots of web pages and UI using Playwright for visual review and iteration

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Implement evaluated findings: load code-style rules, apply the accepted fixes, then close out the change with full or quick QA. Use after $evaluate-findings has tagged findings and they need to be implemented, or when the user asks to "resolve findings", "apply evaluated findings", or "dispatch findings to implementation".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Execute multi-level exploratory testing of the app covering basic functionality, complex operations, adversarial testing, and cross-cutting scenarios, plus usability observations through a UX lens reported separately from defects. Deeper than $smoke-test. Use when the user asks to "exploratory test", "test thoroughly", "test all scenarios", "deep test", "test edge cases", "test everything", "break it", "find bugs by testing", "test usability", or "check the UX while testing".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Launch the app and hands-on verify that it works by interacting with it. Falls back to an existing integration test suite when there is no interactive surface in scope. Use when the user asks to "smoke test", "test it manually", "verify it works", "try it out", "run a smoke test", "check it in the browser", or "does it actually work". Not a unit test runner.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.