「risk register」の検索結果

Detect image copyright infringement risks by comparing against a database of registered copyrighted works with similarity scoring, TRO litigation history, and radar-based infringement assessment. Triggered when users mention copyright detection, image infringement check, copyright risk analysis, TRO risk, copyright similarity search, rights owner lookup, or copyright compliance verification. Even if the user does not explicitly say "copyright," this skill should be triggered whenever the need involves checking whether an image may infringe registered copyright works.

日本語の概要は準備中です。原文の説明を表示しています。

Reviews one deal's notes and timeline (CRM opportunity record, activity log, emails, meeting notes, forecast entries) for risk signals such as a single contact thread, no identified budget owner, slipped or missing dates, silence after a proposal, an undefined decision process or a competitor named late, and returns a DRAFT risk register: each signal with the quoted evidence and its date, a severity on a stated scale, and one proposed next action with an owner role for the user to decide on. Use when the user asks to "review the risks on this deal", "why is this opportunity stalling", "is this deal single-threaded", "deal health check before the forecast call" or "what should we do next on <opportunity>". Do not use for a whole-account plan, use account-plan-builder instead; for scoring early leads against a rubric use lead-qualification-scorer. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Ranks any list of impediments and their countermeasures using a value-stream scoring model (ROI, Cost to Implement, Ease of Deployment, Risk Factor) and a fixed prioritization formula. Use when someone asks to prioritize, rank, sequence, or triage impediments, countermeasures, remediation items, risks, findings, gaps, action items, or backlog entries; or mentions value-stream prioritization, A3 / lean countermeasure ranking, ROI vs. effort scoring, or building a remediation / improvement backlog. Works with GHQR findings, audit results, retrospective action items, risk registers, architecture review gaps, or any free-form `{impediment, countermeasure}` list.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks to "plan my launch tier", "how big should this launch be", or "build a launch risk register with kill criteria"; produces a tier decision (Tier 1 flagship all-channel / Tier 2 targeted / Tier 3 changelog-level), a launch-type declaration (new-product / feature / relaunch / partnership with co-marketing split), an effort calibration matrix (tier to channel intensity and asset scope), D0/W1/M1 KPI targets (labeled Estimated), a risk register (likelihood x blast-radius, owners, mitigations, kill criteria / rollback thresholds), and a T-8w to T+4w timeline skeleton. Not for picking the launch date or window — use launch-window-planner; not for creator-channel launch campaigns — use campaign-planner. 发布分级/发布类型/风险登记册/kill criteria

日本語の概要は準備中です。原文の説明を表示しています。

AI leadership advisor on AI strategy, governance, risk, investment, and org design. Use when defining an AI strategy, building an AI governance program, scoring AI maturity, or drafting an AI risk register.

日本語の概要は準備中です。原文の説明を表示しています。

Expert ISO 27001 compliance assistant for security and compliance teams. Use this skill whenever a user asks about ISO 27001 or ISO/IEC 27001, including any of the following: gap analysis, auditing, compliance assessments, control checklists, policy writing, document generation, Statement of Applicability (SoA), risk assessment, risk registers, risk treatment plans, Annex A controls, ISMS implementation, clause requirements, certification readiness, transitioning from 2013 to 2022, control implementation guidance, incident response policies, access control policies, supplier security, or any information security management system (ISMS) topic. Trigger even if the user doesn't say "skill" — any ISO 27001 or ISMS question should use this skill.

日本語の概要は準備中です。原文の説明を表示しています。

Detect graphic trademarks in product images by comparing against registered trademark databases across 15 major trademark offices using YOLO-based object detection and visual similarity. Triggered when users mention graphic trademark detection, logo infringement check, trademark similarity analysis, image trademark risk assessment, product image trademark screening, or logo detection. Even if the user does not explicitly say "trademark detection," this skill should be triggered whenever the need involves comparing a product image against registered graphic trademarks or assessing trademark infringement risk.

日本語の概要は準備中です。原文の説明を表示しています。

Draft a project charter that defines scope, stakeholders, success criteria, and initial risk register. Covers problem statement, RACI matrix, milestone planning, and scope boundaries for both agile and classic methodologies. Use when kicking off a new project or initiative, formalizing scope after an informal start, aligning stakeholders before detailed planning begins, or transitioning from discovery to active project work.

日本語の概要は準備中です。原文の説明を表示しています。

"Conduct FMEA to systematically identify, prioritize, and mitigate potential failure modes. Use this skill when the user needs to assess product or process risks, prioritize corrective actions, or build a risk register — even if they say 'failure mode analysis', 'risk assessment', 'what could go wrong', or 'RPN calculation'.".

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks to "plan my launch tier", "how big should this launch be", or "build a launch risk register with kill criteria"; produces a tier decision (Tier 1 flagship all-channel / Tier 2 targeted / Tier 3 changelog-level), a launch-type declaration (new-product / feature / relaunch / partnership with co-marketing split), an effort calibration matrix (tier to channel intensity and asset scope), D0/W1/M1 KPI targets (labeled Estimated), a risk register (likelihood x blast-radius, owners, mitigations, kill criteria / rollback thresholds), and a T-8w to T+4w timeline skeleton. Not for picking the launch date or window — use launch-window-planner; not for creator-channel launch campaigns — use campaign-planner. 发布分级/发布类型/风险登记册/kill criteria

日本語の概要は準備中です。原文の説明を表示しています。

ISO/IEC 42001:2023 AI Management System (AIMS) specialist for compliance teams running internal audits. Three decisions: (1) Where are the gaps against Clauses 4-10 and what do we close first? (2) What goes in the AI risk register and which Annex A controls treat each risk? (3) What's the 12-month internal audit plan that satisfies Clause 9.2? Use when preparing for certification, scoping internal audit cycles, or onboarding AI systems into an existing ISMS (27001) / QMS (13485) program. NOT an executive AI strategy skill (see chief-ai-officer-advisor). NOT EU AI Act compliance (see compliance-team-eu-ai-act).

日本語の概要は準備中です。原文の説明を表示しています。

EU AI Act per-system inventory — track each AI system's role (provider, deployer, importer, distributor, authorized representative, product manufacturer) and risk tier (prohibited, high-risk, limited, minimal, GPAI, GPAI+systemic). Role and tier are assessed per system, not per company. Use when the user says "ai inventory", "add an ai system", "what systems do we have", "classify this ai system", "eu ai act register", or "ai system registry".

日本語の概要は準備中です。原文の説明を表示しています。

Use when asked 个人信息保护影响评估怎么做, 写一份 PIA, 处理敏感个人信息要评估吗, 自动化决策评估, PIPL 第五十五条, or assess a processing activity under China's Personal Information Protection Law. Produces a personal information protection impact assessment (个人信息保护影响评估) covering the PIPL Article 55 triggers, the Article 56 questions (lawful, legitimate and necessary; impact and risk; adequacy of protection), a risk register with mitigations and owners, and a record kept for at least three years.

日本語の概要は準備中です。原文の説明を表示しています。

Analyse a construction bid or tender package for scope gaps, risk-shifting exclusions, unit-rate red flags, and front-loading in the schedule of values. Use when asked to review a bid, level bids, check a tender for gaps, compare sub quotes, or vet a schedule of values before award. Produces a structured bid review with a gap register, exclusion risk table, pricing red flags, and an award recommendation with pre-award clarifications.

日本語の概要は準備中です。原文の説明を表示しています。

GDPR Art. 35 Data Protection Impact Assessment with threshold checking, risk registers, and EDPB criteria scoring. Use for DPIA evaluations.

日本語の概要は準備中です。原文の説明を表示しています。

Build a preliminary, evidence-based EU AI Act readiness assessment across AI-system inventory, territorial scope, operator roles, prohibited-practice screening, risk classification, transparency, high-risk controls, general-purpose AI obligations, governance, and implementation milestones. Use when an organization needs to triage an AI use case, vendor, model, product, or portfolio for Regulation (EU) 2024/1689; prepare an AI inventory, gap register, implementation roadmap, or counsel briefing; assess provider, deployer, importer, distributor, product-manufacturer, authorised-representative, or GPAI-provider responsibilities; or re-check readiness after regulatory or product changes.

日本語の概要は準備中です。原文の説明を表示しています。

Design, implement, or audit a Change Advisory Board (CAB) process for Salesforce deployments: change classification (standard, normal, emergency), required approvals, deployment gate sequencing, and integration with external ITSM tooling. NOT for scoring how risky one release is - use admin/deployment-risk-assessment. NOT for executing or troubleshooting the deployment itself - use admin/change-management-and-deployment. Also covers: the CAB charter (membership, quorum, decision rights), the CAB decision record artefact and its linter, the change classification matrix, the deployOptions a CAB decision pins (checkOnly, testLevel, rollbackOnError, ignoreWarnings, runTests), the 10-day quick-deploy validity window, the deploy-window vs freeze-register check, and the emergency (ECAB) path with its mandatory retrospective.

日本語の概要は準備中です。原文の説明を表示しています。

Builds a DRAFT stakeholder map for one project from the charter, organisation chart, RACI, governance terms, steering minutes, meeting notes and messages the user provides: a stakeholder register, interest and influence ratings each with its stated basis, stance as evidenced by a verbatim fragment with source and date, gaps, and a proposed engagement plan per stakeholder, every line traced to a source and every missing fact marked UNKNOWN. Use when the user asks to "build the stakeholder map", "who are the stakeholders on this project", "map interest and influence", "where does each stakeholder stand", "draft the stakeholder engagement plan" or "refresh the stakeholder register". Do not use for a customer account's stakeholders, use account-plan-builder instead; for a one-page brief before one meeting, use meeting-prep-onepager; for logging decisions and risks against the project, use project-status-tracker. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Audit MCP (Model Context Protocol) server configurations for security issues. Use this skill when: - Reviewing .mcp.json files for security risks - Checking MCP server args for hardcoded secrets or shell injection patterns - Validating that MCP package-runner dependencies use exact reviewed versions, not bare names, @latest, or ranges - Detecting mutable npm/npx, bunx, pnpm dlx, yarn dlx, and npm exec references in MCP configurations - Auditing which MCP servers a project registers and whether they're on an approved list - Checking for environment variable usage vs. hardcoded credentials in MCP configs - Any request like "is my MCP config secure?", "audit my MCP servers", or "check .mcp.json" keywords: [mcp, security, audit, secrets, shell-injection, supply-chain, governance]

日本語の概要は準備中です。原文の説明を表示しています。

Generate domain permutations with dnstwist and check DNS resolution to detect typosquatting, homograph phishing, and brand impersonation domains registered against your organization. Use when asked to monitor for lookalike domains, investigate a phishing domain, or assess brand-impersonation risk.

日本語の概要は準備中です。原文の説明を表示しています。

Rigorous, defensible email-spoofability verdict and SPF supply-chain risk analysis computed from published DNS alone. Deepens the record-level SPF/DMARC/DKIM/BIMI/MTA-STS/DNSSEC fetch recipes in the offensive-osint arsenal (§16.14) with the reasoning that section doesn't do: a priority-ordered composite verdict for whether an attacker can actually land header-From-spoofed mail in an inbox, and by which vector (exact-domain vs subdomain) — grounded in the single most-misunderstood distinction in email security: the envelope MAIL FROM that SPF authenticates vs the visible header From: that only DMARC governs. Explains precisely why SPF -all/~all alone is NOT spoof-proof without DMARC enforcement, and why SPF +all bypasses DMARC even under p=reject pct=100. Covers RFC 7208 §4.6.4's 10-DNS-lookup / 2-void-lookup PermError fail-open condition with a runnable stdlib-only lookup-counter script, plus the SPF-include-takeover supply-chain vector (an attacker re-registering a dead include inherits SPF-pass authority over the victim domain) with strict transient-vs-NXDOMAIN discrimination discipline so a temporary SERVFAIL is never mistaken for a takeover lead. Fully passive: DNS TXT reads only, no mail sent, no RCPT TO probe, no API keys. Use when auditing a domain's real spoofing resistance (not just its published records), explaining to a client why 'we have SPF -all' does not mean they're covered, investigating an SPF PermError or an unusually long include chain, evaluating a dead SPF include as a takeover lead, or writing a defensible spoofability finding for a deliverable.

日本語の概要は準備中です。原文の説明を表示しています。

Your operations manager. Works out how the business actually runs on day one: suppliers and what they cost, who works when, the step-by-step routines for opening, serving or shipping and closing, the tools to run it, the licences and permits to check, and a risk register with what to do when each thing goes wrong. Feeds real costs back to the CFO. Use when the user says "how do I run this", "operations", "suppliers", "staffing", "SOPs", "what do I need to open", "permits", or "day one".

日本語の概要は準備中です。原文の説明を表示しています。

Find and score legitimate external authority and backlink opportunities as a dry-run register, using relevance, platform rules, risk, target-page fit, and explicit user approval gates. Use this skill when the user asks where links to a target site could be placed effectively, but never post, submit, DM, email, open PRs, or edit external accounts without separate explicit approval.

日本語の概要は準備中です。原文の説明を表示しています。

Active Directory security audit using the MITRE ATT&CK framework. Full domain enumeration, trust mapping, GPO analysis, ACL abuse paths, ADCS attacks (ESC1-ESC8), delegation abuse (constrained/unconstrained/RBCD), fine-grained password policies, LAPS deployment, service account security, and Kerberos configuration. Uses enum4linux-ng, netexec, impacket, ldapsearch, certipy-ad, bloodhound-python, and rpcclient. Produces attack path diagrams, prioritized risk register, and PoCs. Chains into /gh-export for issue filing.

日本語の概要は準備中です。原文の説明を表示しています。