「security」の検索結果

Use when designing, evaluating, documenting, modernizing, reviewing, refactoring, or implementing software architecture and code-level structure, including requirements, context, architecture style selection, microservices patterns, WebAssembly/WASI/Component Model, UMA portable capabilities, runtime contracts, capability graphs, governed MCP/agent orchestration, clean code, code smells, Rust crate/library API architecture, Cargo feature/MSRV/SemVer policy, unsafe/FFI/no_std/library testing, modularity, views, NFR tactics, IAM/auth, security patterns, cost estimation, architecture-as-code fitness functions, ADR/RFC work, and engineering execution plans.

日本語の概要は準備中です。原文の説明を表示しています。

Use when advising, planning, reviewing, reporting, operating, or improving CTO and technology leadership work across strategy, cybersecurity management, SME/COE, functional and technical requirements, framework selection, people, organization, delivery, risk, KPI, roadmap, budgeting, governance, audit, R&D, stakeholder communication, culture, politics, and sector-specific leadership.

日本語の概要は準備中です。原文の説明を表示しています。

Android device offensive security, forensic extraction, and mobile app exploitation. Use this whenever the user needs to: break into or bypass the lock screen of an Android phone, extract data from a seized Android device for evidence, analyze or reverse-engineer an APK to find vulnerabilities, intercept communications on an Android device, exploit Android apps via deeplinks, steal crypto wallets or app data, set up rogue WiFi to target a phone, or plan any mobile device investigation or penetration test. Also trigger when the user mentions Android forensics, mobile pentesting, law enforcement phone extraction, device exploitation, WhatsApp or Telegram extraction from a phone, Android app reversing, CVE research for Android, or needing a chain of custody for mobile evidence. Even if the user describes the scenario casually or in another language, if they need to gain access to or pull data from an Android phone, use this skill.

日本語の概要は準備中です。原文の説明を表示しています。

Terraform / OpenTofu / Nix / k8s manifest misconfiguration detection — open security groups, missing encryption, public S3/GCS, IAM wildcards, plaintext secrets, missing tags. Use when reviewing an IaC PR, gating `terraform apply` / `tofu apply`, auditing existing state for drift, or building a compliance report for cloud configuration.

日本語の概要は準備中です。原文の説明を表示しています。

Proactive secure-coding coach scoped to the file or topic you are working on — surfaces relevant SAST rule IDs, CWE patterns, language-specific PASS/FAIL code snippets. Use when about to write auth, crypto, SQL, deserialization, file-handling, or template code; coaching juniors; pair-programming a security-sensitive change.

日本語の概要は準備中です。原文の説明を表示しています。

Static application security testing (SAST) for changed source files — Vulnetix's built-in rule set plus optional Semgrep augmentation when `.semgrep` config is present. Use when reviewing a PR for code-level vulnerabilities, scanning a feature branch before merge, gating CI on critical findings, or running rule-specific checks for a known weakness class.

日本語の概要は準備中です。原文の説明を表示しています。

Show what this repository has already decided about its vulnerabilities, read from the durable record rather than by scanning again — open versus resolved, the decision taken on each, and what is still waiting. Use when picking up triage after a break, auditing past decisions, onboarding to a repository with security history, or checking nothing high-severity is open before a release.

日本語の概要は準備中です。原文の説明を表示しています。

脅威と攻撃面を洗い出し、最小権限と安全な失敗で守るための判断軸。認証/認可、入力検証、秘密情報管理、監査ログ等の設計・実装・レビューで使う。

Verify Rash Studio scenes, ActionScript subset behavior, resource links, portable embeds, exports, and desktop or mobile interaction. Use for Rash acceptance checks, compatibility review, security review, or release validation.

日本語の概要は準備中です。原文の説明を表示しています。

Comprehensive code review for quality, security, performance. Triggers on 'review code', 'code review', 'check this PR', 'audit code'.

日本語の概要は準備中です。原文の説明を表示しています。

Perform comprehensive exploratory testing on a website using browser automation, covering user journeys, forms, errors, accessibility, responsiveness, performance, and security basics. Use when asked to QA a site, explore an app, find bugs, or produce a browser testing report.

日本語の概要は準備中です。原文の説明を表示しています。

Review secret handling, brokered execution, redaction, vault boundaries, host approval, and public hygiene.

日本語の概要は準備中です。原文の説明を表示しています。

Load when working on Tier 0 Sovereign (payments, money, orders), Tier 1 Security (auth, tenancy, migrations), or Tier 2 Privacy (PII, erasure) tasks to enforce advanced model tier, Invariant-Breaker adversarial tests, and zero-PII telemetry validation.

日本語の概要は準備中です。原文の説明を表示しています。

Load when the user asks to be grilled or stress-tested on a plan, OR when starting Tier 0 (Sovereign), Tier 1 (Security), or Tier 2 (Privacy) tasks with underspecified requirements.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from the NIST Framework for Cyber-Physical Systems (SP 1500-201/202/203, v1.0, 2017). Use for engineering and analyzing cyber-physical systems (CPS) and IoT: the CPS Framework's aspect × facet grid (nine aspects of concern examined through conceptualization, realization, and assurance facets), cross-property trustworthiness risk management (safety/security/privacy/reliability/resilience together), data interoperability (syntactical/semantic/contextual, canonical models, identifiers, provenance), the timing aspect (time-interval classes, time domains, time-aware networking) and secure/resilient time (GNSS jamming/spoofing, PTP/NTP attacks, holdover, the clock-error model and Allan/MTIE metrics), plus the use-case requirements method. Bridges IT and OT under a clock. Scope limits: a 2017 living/draft document, thin on post-2017 standards and on detailed control catalogs; it names but does not reproduce ISO/IEC/IEEE 42010 and 15288 process text or permission-licensed third-party figures.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from NIST SP 800-61 Rev. 3 (Incident Response Recommendations for Cybersecurity Risk Management). Use for CSF 2.0-aligned incident response life cycles, IR roles, Community Profile priorities for DE/RS/RC and preparation, playbooks, coordination, and continuous improvement. Covers 800-61r3 only; does not replace CSF 2.0 full text, SP 800-61r2 tactical playbooks, or sector-specific breach-notification law.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from the DoD Systems Engineering Guidebook (OUSD R&E, February 2022). Use for the DoD SE process model — the 16 SE processes (8 technical management + 8 technical) mapped to ISO/IEC/IEEE 15288, the event-driven technical reviews and audits across the Major Capability Acquisition life cycle (ASR, SRR, SFR, PDR, CDR, SVR/FCA, PRR, PCA), the Systems Engineering Plan (SEP), risk/issue/opportunity management, TPMs and leading indicators, system-of-systems and digital engineering, and the 24 design considerations (RAM, system safety, HSI, system security engineering, MOSA, supportability, etc.). Acquisition-program oriented: thin on detailed cost estimating, contracting law, and non-DoD or commercial life cycles.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from the OUSD(R&E) guidebook Implementing a MOSA in DoD Programs (Feb 2025). Use for the Modular Open Systems Approach as a DoD acquisition + design discipline: the statutory/regulatory basis (10 U.S.C. 4401–4403, FY2017/FY2021 NDAA, DFARS), the five OUSD(R&E) pillars, the plan→modularize→identify→define→standardize interface lifecycle, technical levers (WBS/MIL-STD-881F taxonomy, standards profiling, API-first software, COTS/cybersecurity), MOSA assessment metrics and tools (PART/OAAT/KOSS/SEAM/MAUT), technology-change and DMSMS management, roadmaps, MOSA across the six AAF pathways, and contracting/IP/data-rights mechanics. SCOPE LIMITS: this is U.S. DoD weapon-system acquisition policy, not a general open-architecture or interface-standards reference — it names standards (FACE, OMS, DISR) without reproducing them, is light on detailed engineering of any specific standard, and does not cover the underlying SE processes (use dau-se-guidebook / nasa-npr-7123) or general systems-engineering theory (use sebok).

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from CISA Cross-Sector Cybersecurity Performance Goals 2.0. Use for prioritized IT/OT baseline cyber goals aligned to NIST CSF 2.0 (including GOVERN), critical-infrastructure hygiene, MSP/supply-chain expectations, and board-friendly outcome language. Covers CPG 2.0 goals only; does not replace full CSF programs, sector-specific goals (SSGs), or CSET tooling detail.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from the DoD Test & Evaluation Enterprise Guidebook (August 2022 edition 8.02) with DOT&E-facing enterprise emphasis. Use for T&E enterprise roles (DOT&E vs USD(R&E)), DT&E/OT&E/LFT&E, cybersecurity T&E, MOSA/automation/digital enablers, suitability/reliability growth, and TEMP/Strategy/STE planning. Distinct routing from dod-te-guidebook (same guidebook family, pathway-deep pack). Guidance only—defer to DoDI 5000.89 and Title 10 for binding requirements.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from the FAA Human Factors Design Standard (HF-STD-001B, 2016) — the FAA's consolidated human-factors / human-systems-integration design criteria for systems it manages, operates, or maintains. Use for requirement-level design rules on: general human-factors design principles; automation and function allocation; designing equipment for maintenance; displays, controls, and visual indicators; alarms, audio, and voice communications; the computer-human interface (information presentation, coding, interaction styles, windows, dialogue); keyboards, input devices, and workstation/workplace ergonomics; system security, personnel safety, environment, anthropometry, and user documentation; plus intended-use and tailoring guidance. It is a quantified, source-attributed synthesis (heavily citing MIL-STD-1472G, MIL-HDBK-759C, DOD-HFDG-ATCCS, NUREG-0700, NASA-STD-3000, ANSI, OSHA, ISO 9241). Complements nasa-hsi as a parallel HSI tradition from the civil-aviation domain. Scope limits: it is design criteria, NOT an HSI lifecycle/process model (use nasa-hsi, nasa-npr-7123, or dau-se-guidebook for process); it does NOT reproduce the third-party standards it cites; it is FAA-acquisition-oriented (ATC, towers, TRACONs, airway facilities), not a general consumer-UX guide; and it is thin on modern touchscreen/mobile, web, and AI-driven interface patterns and on quantitative human-reliability analysis.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from NASA NPR 7150.2D — NASA Software Engineering Requirements. Use for NASA's Agency-wide software-engineering requirements: the software classification scheme (Classes A–F), the Requirements Mapping Matrix and class-driven applicability, tailoring and Technical Authority governance, the SWE-### 'shall' requirements across software management (Ch 3) and the engineering life cycle (Ch 4), the supporting disciplines (configuration management, risk, peer reviews/inspections, measurement, non-conformance — Ch 5), safety-critical and cybersecurity requirements, IV&V applicability, traceability, and the Appendix A definitions. Does not cover detailed software-assurance/safety procedures (see NASA-STD-8739.8), implementation how-to and document content (see NASA-HDBK-2203), the systems-engineering process framework (see NPR 7123.1), or program/project management (see NPR 7120.5).

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from the FAA Systems Engineering Manual (SEM) v1.0.1. Use for civil-agency systems engineering as the FAA practices it inside the Acquisition Management System (AMS) and the National Airspace System (NAS): the five-phase AMS lifecycle and its decision points; operational concept development and implementation-free functional analysis (ConOps, FFBD/N², CMLs); requirements analysis and architectural design synthesis (PRS→MRS, the PRD ratchet pPRD→iPRD→fPRD, RAM, ISEF/DoDAF views, CPRs); the seven technical management disciplines (Integrated Technical Management/SEMP, Interface Management/IRD-ICD, Risk-Issue-Opportunity, Configuration Management, SE Information Management, Decision Analysis, Verification & Validation); and the specialty disciplines (RMA via Service Threads/STLSC, Life Cycle Engineering, E3/Spectrum, Human Factors, Information Security via the NIST RMF, System Safety via the SMS, and Hazardous Materials/Environmental/EOSH). Scope limits: this is FAA-specific guidance, not policy — it is a tailorable menu that points outward to companion handbooks (FAA-HDBK-006A for RMA, the SMS Manual, the NIST 800-series) rather than restating generic SE theory; it is thin on detailed cost estimating, contracting/FAR law, software-development methodology, named anti-pattern catalogues, and any non-FAA or non-civil-aviation lifecycle. Source has no page numbers in the extracted text (~360 pp.).

日本語の概要は準備中です。原文の説明を表示しています。

Teststrategie-Berater für Softwareprojekte — wählt die richtigen Teststufen (Unit/Integration/System/Abnahme), Testarten (funktional, nicht-funktional, änderungsbezogen) und Testentwurfsverfahren (Äquivalenzklassen, Grenzwerte, Entscheidungstabellen, explorativ) für die jeweilige Situation und SDLC-/CI-Phase, inkl. Testpyramide, CI/CD-Gates, Shift-Left und Best Practices. Nutze diesen Skill IMMER, wenn Tests geschrieben, geplant, priorisiert oder bewertet werden sollen — bei "schreibe Tests", "Teststrategie", "Testplan", "Testkonzept", "was/wie soll ich testen", "welche Tests fehlen", "Testabdeckung verbessern", "QA aufsetzen", Fragen zu Regression/Smoke/Sanity/Last/Stress/Security-Tests oder beim Einrichten einer Test-Pipeline — auch wenn "Test" nur beiläufig fällt. Abgrenzung — für die TDD-Schleife selbst superpowers:test-driven-development, für Bug-Diagnose bugfix-protocol, für systematische Bug-Suche bugsweep nutzen.

日本語の概要は準備中です。原文の説明を表示しています。