993 件 ・ 関連度順
概要と使いどころ
Review or audit a design/UI across 6 weighted dimensions with Nielsen's 10 heuristics and a prioritized findings table. Use when the user wants a design critique, quality score, heuristic evaluation, or audit of an existing screen, page, or product before/after build.
日本語の概要は準備中です。原文の説明を表示しています。
Keeps a project's to-do list and memory in GitHub issues — files each finding (from a review, an audit, or the user) as its own issue without duplicates, lists the open issues that bear on the current work, and closes an issue with a comment recording what was wrong, what was tried, what worked, and how it was fixed. Use when review findings or a list of problems should become tracked work (a paper's misleading claims, a codebase's bugs, improvements for later), when starting or resuming work and deciding what to do next, or when a fix has landed and its issue should be closed with a record. Needs the GitHub CLI; warns before posting to a public repository.
日本語の概要は準備中です。原文の説明を表示しています。
For authorized security review of code, auth, or APIs you control, model the attacker, map the attack surface, and report only findings with a reproducible exploit path and verified mitigation.
日本語の概要は準備中です。原文の説明を表示しています。
Full-sweep mode: runs a unified analysis across all quality dimensions — code decay, architecture, tech debt, and test quality — then applies fixes directly to the codebase. Safe changes are auto-applied; risky changes are confirmed before execution. Drawing on twelve classic engineering books. Triggers when: user wants to "fix everything", "sweep the codebase", "auto-fix all issues", "clean up the whole project", or asks for a single command that both diagnoses and remediates quality problems. Do NOT trigger for: read-only audits or health reports where the user only wants findings without code changes; single-dimension reviews (use the focused skill instead: brooks-review / brooks-audit / brooks-debt / brooks-test); server health checks, HTTP /health endpoints, Kubernetes probes, database health, or application uptime.
日本語の概要は準備中です。原文の説明を表示しています。
PR code review that surfaces decay risks, design smells, and maintainability issues with concrete Symptom → Source → Consequence → Remedy findings, drawing on twelve classic engineering books. Triggers when: user asks to review code, check a PR, shares a diff or pastes code asking "does this look right?" / "any issues here?" / "ready to merge?", or asks for feedback on a function, class, or file. Also triggers when user mentions: code smells / refactoring / clean architecture / DDD / SOLID principles / Hyrum's Law / deep modules / tactical programming / conceptual integrity / Brooks's Law / Mythical Man-Month / second system effect. Do NOT trigger for: questions about how to write code from scratch, language syntax questions, or framework/tool questions where no existing code is shared.
日本語の概要は準備中です。原文の説明を表示しています。
Independently assess an RPI plan without editing it. Use when an implementation-ready plan needs a credibility check or a revised plan needs its earlier findings reconciled.
日本語の概要は準備中です。原文の説明を表示しています。
Security planning and plan-drift analysis for STRIDE, standards, controls, backlog handoff, current findings, and TM7 generation.
日本語の概要は準備中です。原文の説明を表示しています。
Research-only RPI playbook that gathers task evidence, writes dated research artifacts under .copilot-tracking/research/ or a caller's trusted evidence root, and hands off planning-ready findings. Use when the user needs evidence, alternatives, or task framing first.
日本語の概要は準備中です。原文の説明を表示しています。
Compare RPI planning and implementation evidence, record review findings, and route follow-up work. Use when an implementation needs acceptance review.
日本語の概要は準備中です。原文の説明を表示しています。
Create, improve, refactor, replace, review, or validate prompts, instructions, agents, subagents, and skills. Use for Copilot customization cleanup, extending HVE workflows with project-specific capabilities, and parent-owned correction of material review findings.
日本語の概要は準備中です。原文の説明を表示しています。
Review code changes from multiple perspectives with context bootstrap, depth-tier rigor, and structured findings output.
日本語の概要は準備中です。原文の説明を表示しています。
Generate a bounded task plan (and the agent prompt for it) that runs the 5-layer profiling methodology in .claude/skills/model-profiling/METHODOLOGY.md against one model, stops for human confirmation before any GPU work starts, then delegates the actual run to a background agent, verifies its completion claim, and routes findings into a gitignored .profiling-runs/<model>/ directory — durably tracked as a sub-issue under the tracking issue named in SKILL.md's "Result tracking" section — plus the methodology doc.
日本語の概要は準備中です。原文の説明を表示しています。
Audit one, several, or all existing Octane bindings; implement selected maintenance findings or remove redundant copied files with evidence matched to source ownership. Use for binding updates, lifecycle fixes, dependency or metadata maintenance, and convenience-import requests.
日本語の概要は準備中です。原文の説明を表示しています。
结构化压力测试一个论点（devil's advocate / 魔鬼代言人）：把论点拆成显性断言与隐性假设（A1/A2 编号）， 逐条在用户给定的证据材料里检索带出处的反方论证，标 High/Medium/Low 风险等级，补基础比率外部视角， 最后给出「可监测的证伪信号」清单；输出结构化 findings + 人读叙事双层结果。找不到反证时如实声明「未找到」， 绝不编造。复刻自 LinqAlpha（对冲基金 AI 产品）公开的 Devil's Advocate 架构，叠加 CIA 结构化分析技术与 RAND 假设规划。当用户要「压力测试 / 唱反调 / 找盲点 / 拆假设 / 挑战这个论点 / bear case / 红队这个方案 / 上投委会前过一遍 / pressure test my thesis」，或拿着投资论点、IC memo、研究结论、商业决策要人挑刺时， 用本 skill——即使用户没说出"魔鬼代言人"这个词。
日本語の概要は準備中です。原文の説明を表示しています。
Multi-path parallel product analysis with cross-model test-time compute scaling. Spawns parallel agents (Claude Code agent teams + Codex CLI) to explore product from multiple perspectives, then synthesizes findings into actionable optimization plans. Can invoke competitors-analysis for competitive benchmarking. Use when "product audit", "self-review", "发布前审查", "产品分析", "analyze our product", "UX audit", or "信息架构审计".
日本語の概要は準備中です。原文の説明を表示しています。
Runs a 6-dimension evidence-based health audit of this skills marketplace repo — code safety, docs/SSOT, security/PII, PR/issue triage, manifest integrity — via a parallel workflow, then verifies findings by priority. Use for 全面体检 / 检查仓库状态 / 审计一下仓库, a pre-release sweep, or "is this repo OK" even without saying "workflow". Not for building marketplace.json (use marketplace-dev) or cache drift (use skill-governance).
日本語の概要は準備中です。原文の説明を表示しています。
Review an LLM agent design and find where it will be unreliable, expensive, or unsafe. Use when asked to review an agent architecture, critique a multi-step/tool-using agent, debug an agent that loops or goes off-task, or harden an agent before launch. Produces a structured review — task fit, control flow, tools, memory/context, failure handling, cost, and safety — with prioritised findings and fixes.
日本語の概要は準備中です。原文の説明を表示しています。
Audit whether AI agents can actually use your product — docs, APIs, onboarding, errors, and discoverability, evaluated from a non-human user's perspective. Use when asked if a product is agent-ready, to audit a site or API for AI usability, to prepare for agentic traffic, or when agents keep failing against your product. Produces a scored readiness report with per-surface findings and a prioritised fix list. For optimising a single article for AI citation use aeo-optimizer; for designing the MCP server itself use mcp-server-spec.
日本語の概要は準備中です。原文の説明を表示しています。
Review AI-authored code for its characteristic failure modes — plausible-but-wrong logic, hallucinated APIs, over-engineering, dead scaffolding, and silent security shortcuts. Use when reviewing an AI-generated or heavily AI-assisted PR, when AI-written code keeps shipping subtle bugs, or when setting review standards for a team using coding agents. Produces a focused review with AI-specific findings, verification steps per risk class, and a team checklist for AI-authored changes. For general PR review use code-review-checklist — this skill covers what that one assumes a human wouldn't do.
日本語の概要は準備中です。原文の説明を表示しています。
Scan application source, agent skills, and MCP components; run penetration tests against scoped web test deployments, validate findings, and configure scan gates. Use oma-qa for broad quality reviews and domain skills for remediation.
日本語の概要は準備中です。原文の説明を表示しています。
Detect GraphQL injection vulnerabilities in a codebase using a three-phase approach: recon (confirm GraphQL usage and find unsafe operation document assembly sites), batched verify (trace user input to those sites in parallel subagents, up to 3 candidate sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/graphql-results.md. If no GraphQL technology is found in Phase 1, later phases are skipped. Use when asked to find GraphQL injection, unsafe GraphQL document construction, or operation string injection bugs.
日本語の概要は準備中です。原文の説明を表示しています。
Detect business logic vulnerabilities in a codebase using a three-phase approach: threat modeling (domain analysis and attack scenarios), batched verify (check exploitable gaps in parallel subagents, 3 scenarios each), and merge (consolidate batch results). Covers price manipulation, workflow bypass, limit violations, race conditions, reward abuse, etc. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/businesslogic-results.md. Use when asked to find business logic, logic flaws, or abuse-of-function bugs.
日本語の概要は準備中です。原文の説明を表示しています。
Detect Remote Code Execution (RCE) vulnerabilities in a codebase using a three-phase approach: recon (find dangerous execution sinks), batched verify (trace user input to sinks in parallel subagents, 3 sinks each), and merge (consolidate batch results). Covers OS command injection, eval-like sinks, and unsafe deserialization. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/rce-results.md. Use when asked to find RCE, command injection, or unsafe deserialization bugs.
日本語の概要は準備中です。原文の説明を表示しています。
Detect hardcoded sensitive data (API keys, access tokens, private keys, passwords, etc.) in publicly accessible code — frontend JavaScript, mobile apps, client-side bundles, and HTML templates. Uses a three-phase approach: recon (find secret candidates), batched verify (confirm real secrets in public code paths, 3 candidates each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/hardcodedsecrets-results.md. Use when asked to find hardcoded secrets, leaked API keys, or exposed credentials.
日本語の概要は準備中です。原文の説明を表示しています。