1.3万 件 ・ 人気順
概要と使いどころ
変更が波及する全モジュール・全フローを特定し、集計ルール、状態遷移、符号反転、 コピペ差分、表示/帳票/APIの整合性を監査するスキル。Impact Mapで変更核から 影響範囲を可視化し、Consistency Matrixで横断整合を検証し、Copy Propagation Review戦略でコピペ実装を効率的にレビューする。 Use when one change affects multiple modules, reports, flows, or copied implementations. Audits aggregation totals, state transitions, sign inversion, and cross-module consistency.
Review skills in any project using a dual-axis method: (1) deterministic code-based checks (structure, scripts, tests, execution safety) and (2) LLM deep review findings. Use when you need reproducible quality scoring for `skills/*/SKILL.md`, want to gate merges with a score threshold (for example 90+), or need concrete improvement items for low-scoring skills. Works across projects via --project-root.
日本語の概要は準備中です。原文の説明を表示しています。
This skill should be used when creating bug/defect reports during system testing. Use this skill when you discover a bug, need to document test failures, or want to create comprehensive bug tickets with proper reproduction steps, severity assessment, and environment details. Guides users through interactive questioning to gather all necessary information and generates professional bug ticket documents in Markdown format. Supports Japanese (default) and English.
日本語の概要は準備中です。原文の説明を表示しています。
事業継続計画（BCP）と災害復旧計画（DRP）の策定支援スキル。ビジネスインパクト分析、リスク評価、復旧戦略策定、 BCP/DRP文書作成、テスト・訓練計画を提供。ISO 22301準拠。 Use when developing business continuity plans, disaster recovery strategies, or conducting business impact analysis. Triggers: "BCP", "business continuity", "disaster recovery", "DRP", "business impact analysis", "BIA", "contingency planning".
Review audit-related documents (control design documents, bottleneck analyses, requirements definitions, etc.) for quality, scoring them 0-100 with a severity-rated findings list. Use when reviewing audit documents, checking control design quality, or verifying cross-document consistency. Supports documents governed by US GAAP, IFRS, or J-GAAP.
日本語の概要は準備中です。原文の説明を表示しています。
Generate audit-ready internal control design documents from As-Is business process inventories. Produces control IDs, assertion mappings, procedures, SoD analysis, KPIs, materiality thresholds, and implementation roadmaps. Use when building internal controls for new audit engagements, SOX/J-SOX compliance, or process improvement initiatives.
日本語の概要は準備中です。原文の説明を表示しています。
ISO規格（ISO 9001品質、ISO 27001情報セキュリティ、ISO 22301事業継続等）の認証取得支援スキル。 ギャップ分析、文書化支援、内部監査、認証準備を提供。 Use when pursuing ISO certification, conducting gap analysis, or implementing ISO-compliant management systems. Triggers: "ISO 9001", "ISO 27001", "ISO 22301", "ISO certification", "quality management", "ISMS", "gap analysis".
設計文書、分析レポート、報告書などを批判的な視点で徹底レビューするスキル。 6つの異なる立場（開発者、PM、顧客、QA、セキュリティ、運用）のペルソナを持つサブエージェントが並列でレビューを実行し、 「本当にそうか？」「根拠は何か？」「テストできるか？」「運用できるか？」という視点で 曖昧さ、根拠不足、論理飛躍、テスト不能、セキュリティリスク、運用懸念を検出する。 Use when reviewing design documents, analysis reports, incident reports, or any document requiring rigorous validation of claims and evidence.
Coordinate Codex work across the current task, internal subagents, user-owned tasks, worktrees, handoffs, formal review gates, or recurring automation. Use for delegation, parallel roles, another Codex task, cross-repo work, QA/review handoffs, scheduled follow-up, or task inspection and continuation. Chinese triggers include 子Agent/子进程/子对话, 另一个对话接手, 并行处理, 分给QA, 多仓库收口, 巡检, 持续推进, 定时自动继续, 创建/读取/转交任务.
日本語の概要は準備中です。原文の説明を表示しています。
Use when designing, evaluating, documenting, modernizing, reviewing, refactoring, or implementing software architecture and code-level structure, including requirements, context, architecture style selection, microservices patterns, WebAssembly/WASI/Component Model, UMA portable capabilities, runtime contracts, capability graphs, governed MCP/agent orchestration, clean code, code smells, Rust crate/library API architecture, Cargo feature/MSRV/SemVer policy, unsafe/FFI/no_std/library testing, modularity, views, NFR tactics, IAM/auth, security patterns, cost estimation, architecture-as-code fitness functions, ADR/RFC work, and engineering execution plans.
日本語の概要は準備中です。原文の説明を表示しています。
Use when performing cybersecurity operations - offensive or defensive - including threat detection and hunting, SOC operations, incident response, digital forensics and DFIR, malware analysis and reverse engineering, threat intelligence, cloud/container/network/application/API security, identity-access and zero-trust, OT/ICS and endpoint security, vulnerability and supply-chain management, DevSecOps, cryptography, AI security, compliance and governance, and red-team or penetration testing under signed rules of engagement; routes to one of 800+ technique playbooks mapped to MITRE ATT&CK, D3FEND, and NIST CSF.
日本語の概要は準備中です。原文の説明を表示しています。
Android device offensive security, forensic extraction, and mobile app exploitation. Use this whenever the user needs to: break into or bypass the lock screen of an Android phone, extract data from a seized Android device for evidence, analyze or reverse-engineer an APK to find vulnerabilities, intercept communications on an Android device, exploit Android apps via deeplinks, steal crypto wallets or app data, set up rogue WiFi to target a phone, or plan any mobile device investigation or penetration test. Also trigger when the user mentions Android forensics, mobile pentesting, law enforcement phone extraction, device exploitation, WhatsApp or Telegram extraction from a phone, Android app reversing, CVE research for Android, or needing a chain of custody for mobile evidence. Even if the user describes the scenario casually or in another language, if they need to gain access to or pull data from an Android phone, use this skill.
日本語の概要は準備中です。原文の説明を表示しています。
Use when advising, planning, reviewing, reporting, operating, or improving CTO and technology leadership work across strategy, cybersecurity management, SME/COE, functional and technical requirements, framework selection, people, organization, delivery, risk, KPI, roadmap, budgeting, governance, audit, R&D, stakeholder communication, culture, politics, and sector-specific leadership.
日本語の概要は準備中です。原文の説明を表示しています。
大規模システムリプレース・移行プロジェクトについて、マルチベンダー管理に長けたPMOの視点で「見落とされがちな潜在リスク」を洗い出す。正常系設計や特定ベンダーの担当範囲内には現れにくい「ベンダー間の隙間」「業務影響」「異常系」の死角を、4視点の分析フレームワークで特定し、Backlog起票用のリスク表とキラークエスチョンを生成する。要件定義・運用設計・負荷試験フェーズ特化フレームワークへの切替にも対応。総合テスト終盤・移行リハーサル前・負荷試験計画時のリスク総ざらいに使用する。Do NOT use for 個別インシデントの根本原因分析（incident-rca）、要求の追加・変更・矛盾検証（requirement-management）、運用設計書そのものの新規作成（operations-design）。
エラー・バグ・問題を体系的に分析し修正方針を策定する。テスト失敗、ビルドエラー、実行時エラー、動作不良、バグ報告に対応し、根本原因を分析してから修正を行う。Do NOT use for 根本原因分析が不要な軽微な修正（typo、設定値変更、フォーマット修正など）。
SaaSサービス向けのサービス仕様書を作成します。運用設計書や要件定義書をインプットとして活用し、経済産業省「SaaS向けSLAガイドライン」に準拠したサービス仕様書を生成します。ガイドライン準拠の7カテゴリ（可用性、信頼性、データ管理、セキュリティ、サポート、拡張性、コンプライアンス）に加え、サービス概要・料金・責任分界を含む全10セクションを網羅します。
Dockerfile / Containerfile / compose analysis plus optional Trivy / Grype / Syft composition when those binaries are present. Use when reviewing a Dockerfile PR, gating `docker build`, building an image SBOM, evaluating base-image risk, or auditing a registry image for CVEs.
日本語の概要は準備中です。原文の説明を表示しています。
Hardcoded-secret detection — AWS keys, GitHub PATs, Slack tokens, Stripe keys, generic high-entropy strings. Pre-commit (`--staged-only`), explicit paths, or full repo. Use when guarding `git commit`, auditing a repo for leaked credentials, validating no secrets entered the diff before push, or producing a rotation list for an exposed-secret incident.
日本語の概要は準備中です。原文の説明を表示しています。
Static application security testing (SAST) for changed source files — Vulnetix's built-in rule set plus optional Semgrep augmentation when `.semgrep` config is present. Use when reviewing a PR for code-level vulnerabilities, scanning a feature branch before merge, gating CI on critical findings, or running rule-specific checks for a known weakness class.
日本語の概要は準備中です。原文の説明を表示しています。
Answer whether a specific advisory reaches anything in THIS repository — which manifest declares the package, at what version, whether the version is in range, and whether the vulnerable code is reachable. Use when someone asks "does CVE-… affect us", when triaging an advisory against a real codebase, or before spending effort on a fix.
日本語の概要は準備中です。原文の説明を表示しています。
Package license analysis — detect copyleft conflicts against a permissive policy, surface AGPL / SSPL / GPL contaminants, output SPDX SBOM with per-package license findings. Use when auditing a release for license compliance, vetting a new dependency's license, building an OSS-attribution document, or producing a customer-facing license disclosure.
日本語の概要は準備中です。原文の説明を表示しています。
Dependency-conflict resolution when a `fix` version bump fails — diagnose the peer-dep tree, find a compatible safe version set, propose package-manager overrides (`overrides`/`resolutions`/`replace`/`[patch]`), fall back to safe-harbour inline patching. Use when an upgrade is blocked by transitive constraints, a peer-dep conflict surfaces, or you need to override a vulnerable transitive without bumping the parent.
日本語の概要は準備中です。原文の説明を表示しています。
Terraform / OpenTofu / Nix / k8s manifest misconfiguration detection — open security groups, missing encryption, public S3/GCS, IAM wildcards, plaintext secrets, missing tags. Use when reviewing an IaC PR, gating `terraform apply` / `tofu apply`, auditing existing state for drift, or building a compliance report for cloud configuration.
日本語の概要は準備中です。原文の説明を表示しています。
End-of-life detection for runtimes (Node, Python, Java, Go, .NET) and key packages — surfaces past-EOL items, items reaching EOL within 90 days, and EOL base images for containers. Use when planning a runtime upgrade, auditing for unsupported versions, gating a deploy against EOL deps, or producing a remediation roadmap.
日本語の概要は準備中です。原文の説明を表示しています。