테스트·보안 스킬

Use this skill when the user asks about accident registers, DOT-recordable accident definitions, what counts as a "reportable accident" under 49 CFR 390.5 + 390.15, accident register retention, post-accident testing trigger logic, FMCSA accident reporting (no longer required to FMCSA directly for non-fatal accidents), insurance reporting timelines, and what to do after a CMV crash. Cite 49 CFR 390.5 + 390.15.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when FMCSA conducts an off-site investigation (less formal than CR). Covers the document-request approach and how to respond efficiently.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when the user asks about FCRA adverse action procedures — what to do when a background check (MVR, criminal, drug test) returns information that may lead to denying employment or terminating a CDL driver. Covers the 5-business-day pre-adverse-action notice, FCRA Summary of Rights, final adverse action notice, state-specific add-ons (CA, NY, etc.), and how to handle disputes. Cite 15 USC § 1681 (FCRA) and 49 CFR 391.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill if you're a new motor carrier expecting your first FMCSA safety audit. Covers what to expect, focus areas, and common findings.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill to run an internal audit before FMCSA does. Covers what to check, common gaps, and remediation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when the user asks about cybersecurity for a trucking carrier — protecting ELD data, customer information, financial systems, EDI integrations, fleet telematics, ransomware risk, vendor / shipper data sharing, incident response, and FMCSA cyber-recommendations. Reference NIST + CISA cybersecurity frameworks.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when you receive an FMCSA Compliance Review notification. Covers what to expect, what documents to produce, and best preparation strategies.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Rigorous benchmarking of multi-agent coordination systems: experiment design, statistical analysis, human evaluation protocols, and reproducible reporting. NOT FOR ML model evaluation (use llm-evaluation-harness), A/B testing for web products, survey design, or general data science.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Refute-before-prove research discipline: automated counterexample sweeps before any formalization, meter-integrity audits for information-bound experiments, mutation-tested model checkers, pre-registered commit-or-cut gates for speculative directions, wrong-turn reporting, and numeric-claim provenance. Use when validating any new theorem, bound, equilibrium, or security claim; when building or trusting a checker, simulator, or experiment; or when deciding whether a speculative research direction lives or dies. NOT for exploratory brainstorming, product prioritization, writing style, or literature review.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Create and review Cloudflare Durable Objects. Use when building stateful coordination (chat rooms, multiplayer games, booking systems), implementing RPC methods, SQLite storage, alarms, WebSockets, or reviewing DO code for best practices. Covers Workers integration, wrangler config, and testing with Vitest. Biases towards retrieval from Cloudflare docs over pre-trained knowledge.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when introducing a feature flag system, choosing between release flags / experiment flags / operational flags / kill switches / permission flags, designing percentage rollouts, building kill-switch + circuit-breaker patterns, structuring evaluation contexts (user IDs, plan tier, region), or building flag-cleanup discipline. Triggers: LaunchDarkly / GrowthBook / Unleash / Flagsmith / OpenFeature, percentage ramp, sticky bucketing, kill switch wired to alerting, "we still have flags from 2 years ago", flag debt, OpenFeature provider, evaluation context, default value on provider failure. NOT for A/B test statistical analysis (separate skill), traffic-split routing at the edge, build-time bundler defines, or environment-based config.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Architects the encryption, codec/transport, and premium-feature layer of a group video-calling product, on top of an already-chosen SFU topology. Covers E2EE patterns (Zoom leader-fan-out, Signal pairwise-fan-out, MLS/TreeKEM as in Discord's DAVE, Telegram's ledger consensus), the SFrame (RFC 9605) + WebRTC Insertable Streams mechanism letting an SFU relay encrypted frames it can't read, codec/transport choice (AV1/VP9 SVC vs. simulcast, Opus, congestion control, Media-over-QUIC, WHIP/WHEP), and which "premium" features (virtual backgrounds, live captions, recording, breakout rooms, spatial audio) survive E2EE vs. structurally can't. Use when adding E2EE to an SFU-based call, choosing a 2026 codec/SVC strategy, or deciding which features to disable under E2EE mode. NOT for call topology/platform choice (see webrtc-adhoc-video-chat, which this composes with). NOT for one-way broadcast (see managed-video-streaming-pipeline). NOT for the DM/group-chat text backend (see realtime-messaging-backend-architecture).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit whether a "current product focus receipt" (Decision/Now/Why-now/Evidence/Not-now/Cut-suspend/First-visible-proof/ Acceptance-gate/Kill-revisit-trigger/Owner/Review-date) and the work order it gates state a real, testable decision and a real agent launch — not planning-placeholder prose that sounds like an assignment but can't be proven. Use when deciding whether to launch an agent chain against a milestone or a stated "focus," when a work order lacks explicit input/output/owner/proof-gate, or when an acceptance gate would only prove a cached UI state instead of daemon truth. NOT for distinguishing roadmap items from energy-driven sidequests (legible-roadmap-with-sidequests), reviewing a PRD/prototype for product-completeness gaps like cold start or pricing (product-reality-reviewer), or accepting already-finished work against a personal acceptance bar (port-daddy-user-surrogate-pm-review).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Managing third-party dependencies — version pinning, security auditing, license compliance, update workflows, lockfile management, supply chain security. Activate on "npm audit", "dependabot", "renovate", "pin versions", "dependency update", "supply chain", "license compliance", "lockfile", "security advisory", "typosquatting", "SBOM". NOT for internal monorepo package management (use monorepo-management) or publishing your own packages to npm/PyPI.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit and maintain design system consistency, UX/UI patterns, color palettes, and design best practices across frontend applications

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit or design server-side indexes, directories, reputations, or aggregates that are DERIVED from traffic a platform witnesses (chain heads, run verdicts, heartbeats, publish activity) so that consent gates the derivation, not merely the read: no shadow index over non-consenting principals, post-consent-only evidence windows, retention bounds and delete-propagation into derived rows, activity-oracle threat modeling, and audit-logged ranking discretion. Use when building a capability directory / whois from witnessed activity, a reputation ledger from settled outcomes, vitals aggregation across tenants, or any "the yellow pages can't lie because they index signatures" feature. Keywords: shadow index, derived index, consent gates derivation, activity oracle, phone book not a log, delist propagation, ranking weight audit, k-anonymous aggregate, subpoena surface. NOT for the consent-screen UX and scope-ladder mechanics themselves (use local-first-tenancy-boundary), reputation scoring math and Sybil economics (use agent-identity-continuity-reputation), or discovery-layer architecture L1/L2/L3 (use agent-discovery-directories-guilds).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Classify every destructive/gated action an agent body can attempt (git, filesystem, network, shell, github) into block/approve/allow tiers, and audit whether the pre-tool and post-tool governance backing that classification is real: blocked actions proven zero-side-effect by a negative fixture, every denial backed by a receipt and a transcript event, every block-tier denial paired with a safe alternative, and no unmanaged or same-UID body ever marked "contained." Use when building or reviewing Agent Harbor's C5 governance gate (destructive git blocker, approval request/result, denial receipts), gating a new tool surface before it can run destructive commands, or auditing whether an existing "destructive-action blocked" claim actually has evidence behind it. NOT for proving an existing sandbox boundary actually contains an adversary once an action is isolated (use sandboxed-adversarial-test-harness), deciding where in a DAG to place a human review node or designing the approval UX itself (use human-gate-designer), or designing the general work-receipt schema across an entire agent task (use agent-work-receipt-designer).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit designs, color palettes, and UI components for WCAG 2.1 accessibility compliance, providing specific fixes for contrast, touch targets, focus indicators, and screen reader support. NOT for color harmony aesthetics or design system creation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Designs and audits data retention and file compaction for an embedded SQLite datastore in a long-lived service — a unified retention registry (one declared policy per table), TTL / absolute-age / row-count-cap policies, a fail-loud coverage guard, WAL/checkpoint tuning, and auto_vacuum/incremental-vacuum so pruning actually shrinks the file. Use when a SQLite DB grows unbounded, a table has an index but no DELETE, a pruned DB never shrinks on disk, metrics are stored as raw events forever, or a new table needs bounding. Keywords retention policy, TTL, reaper, prune, VACUUM, auto_vacuum, incremental_vacuum, WAL checkpoint, freelist, DB bloat, row cap, per-tenant quota. NOT for Postgres/MySQL/server-DB partitioning or TTL, log-line rate-limiting/sampling, backup/replication, schema migrations, or query-performance indexing.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Threat-models protocols where authority, scarce resources, bonds, bounties, escrow, reputation, ordering, adjudication, or settlement create strategic incentives. Use to test attack utility, conservation, collusion, Sybil resistance, oracle capture, griefing, custody, liquidity, and residual risk. NOT for choosing payment or bond amounts without evidence, smart-contract code audit, legal or employment classification, DeFi trading, admitting workers, or settling claims.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Runtime enforcement of file system boundaries and tool access restrictions. Blocks unauthorized operations and logs violations. Activate on 'enforce scope', 'access control', 'boundary enforcement', 'tool restrictions', 'runtime security'. NOT for validation (use dag-permission-validator) or isolation management (use dag-isolation-manager).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Validates versioned permission requests against a grant scope and records comparison evidence. Activate on 'validate permissions', 'permission check', 'inheritance validation', 'permission matrix', 'security validation'. NOT for runtime enforcement (use dag-scope-enforcer) or isolation management (use dag-isolation-manager).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit LLM token cost estimates against actual API usage. Activate on 'cost verification', 'token estimate accuracy', 'API cost audit', 'estimation variance'. NOT for pricing lookups, budget planning, or cost optimization strategies.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.