테스트·보안 스킬

Executes authorized phishing simulation campaigns to assess an organization's susceptibility to email-based social engineering attacks. The tester designs realistic phishing scenarios, builds credential harvesting infrastructure, sends targeted phishing emails, and tracks open rates, click-through rates, and credential submission rates to measure human security awareness. Activates for requests involving phishing simulation, social engineering assessment, email security testing, or security awareness measurement.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when a feature launch needs experiment design, test sequencing, rollout guardrails, and measurement logic before exposure to users.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Executes comprehensive red team exercises that simulate real-world adversary operations against an organization's people, processes, and technology. The red team operates with stealth as a primary objective, employing the full attack lifecycle from initial reconnaissance through objective completion while testing the organization's detection and response capabilities. This differs from penetration testing by focusing on adversary emulation rather than vulnerability identification. Activates for requests involving red team exercise, adversary simulation, adversary emulation, or full-scope offensive security assessment.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when assessing cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, or IaC security gaps. Covers AWS, Azure, and GCP posture assessment with MITRE ATT&CK mapping.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for attack path analysis, Mimikatz for credential extraction, and Impacket for protocol-level attacks including Kerberoasting, AS-REP Roasting, and delegation abuse. Activates for requests involving Active Directory pentest, AD attack simulation, domain compromise testing, or Kerberos attack assessment.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Red team engagement planning is the foundational phase that defines scope, objectives, rules of engagement (ROE), threat model selection, and operational timelines before any offensive testing begins.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Sets up safe working habits and a change log so you always know what Cowork has done to your files — and can undo anything. Use when setting up file protection guardrails, for establishing safe automation habits, during initial access configuration, when granting file permissions for the first time, or when the user says "is cowork safe", "file safety", "what if it deletes my files", "audit trail", "safety setup", "I'm nervous about file access", "how do I trust cowork with my files", "can cowork mess up my computer", "I heard someone lost files", or "how do I stay in control".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when measuring or rechecking a brand's visibility in AI answers, citations, source lists, or competitor rankings; when resuming an interrupted GEO run; or when another workflow needs captured answers and a portable measurement artifact. Use it even if the user says only “am I recommended?”, “who gets cited instead?”, or “run these questions”. Capture rendered answers through an available engine playbook, persist validated data, and export JSON; add PDF/dashboard only when requested. Accept a query CSV or a semantic-core handoff. Question research requires the separate opt-in harvest flow; this skill does not audit or edit the target website.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when a feature or code change made by Claude is complete and the developer wants to confirm they actually understood it before shipping. Triggers on "handoff", "quiz me", "comprehension check", "did I understand this", "verify I read the code", "test my understanding", or after finishing a feature when the developer wants to take ownership of AI-written code. Also triggers on requests for an interactive or clickable quiz ("interactive mode", "let me answer with the mouse", "mode interactif", "je réponds à la souris"). Quizzes the developer on WHERE the logic lives (file/function) and WHY decisions were made (trade-offs, behavior, debugging), with the number of questions scaled to the size of the change. Multiple-choice questions are clickable by default (asked through `AskUserQuestion`) and fall back to typed answers. Points to file:line on wrong answers, allows one retry, then reveals the answer, and ends with a score plus the weak areas to re-read. Conducts the quiz in the developer's language.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Security scanner for AI Agent skills, plugins, and MCP servers. Use when: user asks to scan a skill, check if a plugin is safe, vet an MCP server, review skill security, detect malicious code, supply chain safety, or says 'is this safe to install', 'scan this skill', 'check this MCP server', 'security scan', 'vetting', 'skill safety', 'prism scan', '安全扫描', '这个插件安全吗', '扫描一下', '检查安全性', '安装前检查', '技能审查'.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when creating new skills, editing existing skills, or verifying skills work before deployment. Applies Test-Driven Development to process documentation — watch agents fail without the skill, write the skill that addresses those failures, then close loopholes.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Security-focused development skill covering OWASP Top 10 and secure coding. Use when implementing authentication, handling user data, or security review. Keywords: security, auth, authentication, authorization, OWASP, XSS, SQL injection, CSRF, secure

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Comprehensive testing skill covering unit, integration, and e2e testing with TDD. Use when writing tests, improving coverage, or setting up testing infrastructure. Keywords: test, TDD, unit test, integration, e2e, coverage, mock, jest, vitest

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when implementing any feature or bugfix, before writing implementation code

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when building autonomous LLM agents operating in live environments. Protects against prompt injection, tool abuse, data exfiltration, and runaway loops. Keywords: guardrails, prompt injection, IPI, safety, sandboxing, NeMo, LLM Guard.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Package entire code repositories into single AI-friendly files using Repomix. Capabilities include pack codebases with customizable include/exclude patterns, generate multiple output formats (XML, Markdown, plain text), preserve file structure and context, optimize for AI consumption with token counting, filter by file types and directories, add custom headers and summaries. Use when packaging codebases for AI analysis, creating repository snapshots for LLM context, analyzing third-party libraries, preparing for security audits, generating documentation context, or evaluating unfamiliar codebases.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Testing patterns and principles. Unit, integration, mocking strategies.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Web application testing principles. E2E, Playwright, deep audit strategies.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when the task requires automating a real browser from the terminal (navigation, form filling, snapshots, screenshots, data extraction, UI-flow debugging) via `playwright-cli` or the bundled wrapper script.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Test-driven development with red-green-refactor loop. Use when user wants to build features or fix bugs using TDD, mentions "red-green-refactor", wants integration tests, or asks for test-first development.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Persistent browser and Electron interaction through `js_repl` for fast iterative UI debugging.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.