「sec」の検索結果

Run or maintain the full tdmcp repo quality-audit team: command sweeps, all package/Makefile/CI gates, security review, usability/flow review, refactor/test-gap analysis, coverage hardening, QA, and follow-up fix waves. Use whenever the user asks for a complete audit, improve repo/code quality, test all commands, find security/usability failures, refactor debt, add missing tests, re-run the audit, continue a previous quality wave, or verify the repo is ready.

日本語の概要は準備中です。原文の説明を表示しています。

Use only when the user explicitly asks to fix and verify a validated or plausible security vulnerability. Do not use for ordinary bug fixes, correctness or design review findings, general validation, or full PR, commit, branch, patch, or repository scans.

日本語の概要は準備中です。原文の説明を表示しています。

Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

日本語の概要は準備中です。原文の説明を表示しています。

Merge the public openai/codex-security main branch into this fork's main branch and push the result to the fork remote. Use when asked to sync or merge upstream main for this repository.

日本語の概要は準備中です。原文の説明を表示しています。

Use to run the second-brain loop — turn captures in raw/ into clean, cross-linked knowledge in wiki/, and to answer questions from past thinking. Trigger on "/wiki", "process my raw notes", "update the wiki", "add this to my brain/wiki", "what did I think about X", "what do my notes say about X". Follows references/sops/wiki-translate.md. Enforces the admission policy: no PHI, no live financials, no secrets in the committed wiki.

日本語の概要は準備中です。原文の説明を表示しています。

Code quality assurance strategies. Parent skill for quality-related skills: security (security review) and debug (systematic debugging).

日本語の概要は準備中です。原文の説明を表示しています。

Use when writing Playwright tests, fixing flaky tests, debugging failures, implementing Page Object Model, configuring CI/CD, optimizing performance, mocking APIs, handling authentication or OAuth, testing accessibility (axe-core), file uploads/downloads, date/time mocking, WebSockets, geolocation, permissions, multi-tab/popup flows, mobile/responsive layouts, touch gestures, GraphQL, error handling, offline mode, multi-user collaboration, third-party services (payments, email verification), console error monitoring, global setup/teardown, test annotations (skip, fixme, slow), test tags (@smoke, @fast, @critical, filtering with --grep), project dependencies, security testing (XSS, CSRF, auth), performance budgets (Web Vitals, Lighthouse), iframes, component testing, canvas/WebGL, service workers/PWA, test coverage, i18n/localization, Electron apps, or browser extension testing. Covers E2E, component, API, visual, accessibility, security, Electron, and extension testing.

日本語の概要は準備中です。原文の説明を表示しています。

Manage pinned tags and commit SHAs for GitHub Actions security, resolving mutable tags to immutable commit references. Use when the task involves `Unpinned tag for a non-immutable Action`, `pin GitHub Action to commit SHA`, `resolve git tag to SHA`, or `GitHub Actions security hardening`.

日本語の概要は準備中です。原文の説明を表示しています。

Apply modern web development best practices for security, compatibility, and code quality. Use when the task involves `apply best practices`, `security audit`, `modernize code`, `code quality review`, or `check for vulnerabilities`.

日本語の概要は準備中です。原文の説明を表示しています。

OWASP secure design review for code and architecture. Checks input validation, authentication, authorization, data protection.

日本語の概要は準備中です。原文の説明を表示しています。

Work with the Toss Securities Open API for Korean and US stock market data, stock info, exchange rates, market calendars, account and holdings lookups, order history, buying power, sellable quantity, commissions, conditional orders, rankings, trading trends, market indicators, realtime WebSocket integration, and delegated trading workflows. Use when an agent needs to run user-delegated buy/sell/order-management loops, call or build against developers.tossinvest.com, inspect the Toss OpenAPI schema, generate client code, or operate with TOSS_API_KEY/TOSS_SECRET_KEY credentials.

日本語の概要は準備中です。原文の説明を表示しています。

Analyzes securities lending market with borrow cost, short interest dynamics, and fail-to-deliver monitoring. Use when analyzing lending markets, tracking borrow costs, or evaluating short selling dynamics.

日本語の概要は準備中です。原文の説明を表示しています。

Builds recovery waterfall models with absolute priority, secured vs unsecured claims, and plan of reorganization distribution analysis. Use when modeling bankruptcy recoveries, analyzing claim priorities, or estimating creditor distributions.

日本語の概要は準備中です。原文の説明を表示しています。

Structures warehouse lending for securitization programs with advance rates, eligibility criteria, and ramp-up analysis. Use when managing warehouse lines, structuring ramp facilities, or analyzing warehouse economics.

日本語の概要は準備中です。原文の説明を表示しています。

Structures industry-level credit assessment with cyclicality analysis, regulatory risk, and sector-specific credit metrics. Use when analyzing industry credit conditions, evaluating sector risk, or building industry-level views.

日本語の概要は準備中です。原文の説明を表示しています。

Assesses GP track records for secondary pricing with fund-level attribution, unrealized portfolio assessment, and consistency analysis. Use when evaluating GP track records, analyzing fund performance consistency, or assessing manager quality.

日本語の概要は準備中です。原文の説明を表示しています。

Evaluates synthetic CDO and CRT structures with credit default swap mechanics and funded/unfunded tranche analysis. Use when analyzing synthetic structures, evaluating credit risk transfer, or modeling CDS-based securitizations.

日本語の概要は準備中です。原文の説明を表示しています。

Evaluates secondary offering types including overnight blocks, marketed deals, ATMs, and bought deals with dilution analysis. Use when analyzing follow-on options, structuring secondary offerings, or evaluating dilution impact.

日本語の概要は準備中です。原文の説明を表示しています。

This skill should be used when the user asks to "build a scroll animation", "add ScrollTrigger", "pin a section while scrolling", "scrub an animation to scroll", "create a hero timeline", "do a horizontal scroll section", "split text and animate words", "animate a layout change with GSAP Flip", "sync ScrollTrigger with Lenis", "Lenis smooth scroll jittery", "ScrollTrigger markers drift", "ScrollTrigger pins break with Lenis/Locomotive", or "set up smooth scroll with GSAP pinning". Covers GSAP timelines, ScrollTrigger, SplitText, Flip, and Lenis/Locomotive smooth-scroll sync for code-driven web motion.

日本語の概要は準備中です。原文の説明を表示しています。

Use on any core for first-run planning intake — Phase 0 runs the vendored BMAD-METHOD planning shelf, shared by every core, and Phase 1 (mining `04-prd.md` into intent records plus the Add-ons/sync-and-remote-entities decision) is full-stack-app's and pwa-app's shared procedure — identical mechanics, a different decision at step 5/8. Phase 0 also defines compressed intake, the path a user's explicit "just build it" choice takes on full-stack-app, pwa-app, authored, and copywriting cores: one batched round of questions in place of the shelf, writing a thinned archive at the same paths so Phase 1 (or, on copywriting, that core's own mining step), `ux-planner`, and the Re-entry pass all keep their documented source. Also use for the Re-entry pass, which mines new scope into additional intents without re-running the shelf, on any core with a module axis to add an intent to (full-stack-app, pwa-app, authored) — landing-page has none, so its own new-scope path runs through `hedgehog-landing-loop`'s Correction Protocol instead. Invoked by the `planner` agent, which decides the path; don't run standalone. landing-page runs this skill's Phase 0 on first run, then mines the same archive through `hedgehog-landing-loop`'s own planning-intake section, that core's counterpart to this skill's Phase 1. copywriting runs this skill's Phase 0 the same way (full or compressed), then mines the same archive through `hedgehog-copywriting-loop`'s own planning-intake section into a what/audience/register brief — no module axis, so its own new-scope path runs through that loop's Correction Protocol rather than the Re-entry pass below. An authored core runs this skill's Phase 0, then `hedgehog-core-design`, then this skill's Phase 1 mining against the designed layer sequence. A brownfield adoption (`hedgehog-adopt`) never runs this skill's shelf at all — the drivers BMAD elicits are already settled facts of a repo that already exists.

日本語の概要は準備中です。原文の説明を表示しています。

Hunt vulnerabilities in LLM-powered applications — direct/indirect prompt injection, system prompt extraction, ASCII smuggling, RCE via code tools, agentic AI exploits (ASI01-ASI10), data exfiltration via response channels, IDOR in chat history, jailbreak chains, RAG poisoning. Use when target has a chatbot, AI assistant, copilot, or agentic AI features.

日本語の概要は準備中です。原文の説明を表示しています。

Hunt cloud misconfigurations exposed externally — open S3/GCS buckets, exposed IAM-tied EC2 metadata, Cognito misconfig, GitHub Actions secret leakage, exposed Kubernetes API, public Elastic / Kibana / Mongo, Firebase RTDB rules, weak AWS access keys discovered in JS/mobile. Use when leveraging leaked credentials or hunting cloud surface in scope.

日本語の概要は準備中です。原文の説明を表示しています。

Hunt Insecure Direct Object Reference (IDOR) — test horizontal and vertical privilege escalation across user IDs, org IDs, tenant boundaries, and unguessable identifiers. Use when the user has an API endpoint with an identifier in the path/body that may be tested for unauthorized cross-user access.

日本語の概要は準備中です。原文の説明を表示しています。

Mobile (Android) app recon and analysis — decompile APK, extract secrets, find hardcoded endpoints, exposed Firebase / AWS / API keys, deeplink abuse, intent vulnerabilities, exported components, WebView XSS, MobSF static analysis. Use when target's scope includes Android apps (.apk).

日本語の概要は準備中です。原文の説明を表示しています。