「ty」の検索結果

Web サーバ（nginx/apache、Linux 中心）の Phase 1 設定セキュリティレビュー。 target_profile.yaml で対象を確定し、MANIFEST.txt + manifest_attestation.txt で証跡 integrity を検証。 SSH 直接または証跡受領モードで 9 観点 (OS/リソース/ログ/ネットワーク/サービス/認証/監視/バックアップ/証明書) を read-only 走査。6 階層ガード (allowed/conditional/conditional_sensitive/ask-first/exceptional_sensitive_read/forbidden)、 3 軸補助 (Exploitability/Blast Radius/Service Criticality) の重大度判定、 observation_status による未確認の独立管理、evidence_dir/raw_evidence_store 分離、自己レビュー必須。 Windows/IIS は v1 hard fail。 Use when: Web サーバの設定セキュリティレビュー、Phase 1 監査、nginx/apache 構成監査、 EOL ランタイム調査、ログローテーション不備調査、ドキュメントルート漏えい調査。

Use when performing cybersecurity operations - offensive or defensive - including threat detection and hunting, SOC operations, incident response, digital forensics and DFIR, malware analysis and reverse engineering, threat intelligence, cloud/container/network/application/API security, identity-access and zero-trust, OT/ICS and endpoint security, vulnerability and supply-chain management, DevSecOps, cryptography, AI security, compliance and governance, and red-team or penetration testing under signed rules of engagement; routes to one of 800+ technique playbooks mapped to MITRE ATT&CK, D3FEND, and NIST CSF.

日本語の概要は準備中です。原文の説明を表示しています。

Two-phase code quality skill: (1) review codebase for structural smells — file LOC, method LOC, accidental complexity, test readability — producing a structured report, then (2) fix all smells via provable refactorings with ACN micro commits and green-bar-at-all-times discipline. Use this skill when the user says 'sweep', 'code review', 'find code smells', 'check method lengths', 'review for complexity', 'tidy up the codebase', 'refactor smells', or asks about long methods, test readability, or accidental complexity. Also trigger when users ask to 'clean up' or 'improve code quality' across multiple files.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from NASA NPR 7150.2D — NASA Software Engineering Requirements. Use for NASA's Agency-wide software-engineering requirements: the software classification scheme (Classes A–F), the Requirements Mapping Matrix and class-driven applicability, tailoring and Technical Authority governance, the SWE-### 'shall' requirements across software management (Ch 3) and the engineering life cycle (Ch 4), the supporting disciplines (configuration management, risk, peer reviews/inspections, measurement, non-conformance — Ch 5), safety-critical and cybersecurity requirements, IV&V applicability, traceability, and the Appendix A definitions. Does not cover detailed software-assurance/safety procedures (see NASA-STD-8739.8), implementation how-to and document content (see NASA-HDBK-2203), the systems-engineering process framework (see NPR 7123.1), or program/project management (see NPR 7120.5).

日本語の概要は準備中です。原文の説明を表示しています。

Reviews the text and structure of a document, slide deck or web page against the accessibility rules the user supplies, or a default set covering heading structure, image alternative text, colour used as the only cue, link text, reading order, tables and language, and returns numbered findings with location, rule, severity and a ready-to-apply fix for the author, plus proposed alt text and a list of checks that need a tool or a person. Use when the user asks to "check this document for accessibility", "review the alt text in this deck", "is this page accessible", "run an accessibility check on these slides", "find accessibility issues before I publish" or "check my headings and link text". Do not use for brand or template compliance of slides, use branded-deck-builder instead. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Reviews a proposal, business case, deck or plan in character as a Chief Information Security Officer archetype and returns a DRAFT review with a verdict, findings cited to specific passages, security and compliance risks and the five interrogation questions a real CISO would ask. Use when the user asks to "run a CISO review", "pressure-test the security of this plan", "what would our CISO say about this" or "check the privacy and third-party risk". Do not use for contract, liability or regulatory-interpretation reviews, use general-counsel-reviewer instead. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Manage the NV oOS Pro Toolkit Security Operations system — audit events, security training, maintenance windows, and incident records. Covers the full security ops lifecycle: audit logging, incident detection/response, maintenance scheduling, and compliance training tracking. Use when working with security audit trails, investigating incidents, scheduling maintenance windows, managing security training programs, or troubleshooting security operations data.

日本語の概要は準備中です。原文の説明を表示しています。

Design and implement typography systems for web and brand projects. Covers font pairing, type scales, variable fonts, web font loading strategies (font-display, subsetting), CSS typography best practices, and WordPress theme typography integration. Use when selecting fonts, building type scales, loading web fonts, configuring theme.json typography, or fixing font performance issues.

日本語の概要は準備中です。原文の説明を表示しています。

差分が「その差分自身を審査するレビュー基準・品質ゲート」を弱めていないかを diff-time で検出する。Check 1 レビュールールの削除・弱体化（.river/rules.md / .river/rules.d/*）、Check 2 実行時コンフィグの閾値・ゲート緩和（.river-review.{json,yaml,yml} の review.severity 引き下げ / exclude 拡大 / memory.suppressionEnabled 無効化 / selection.skills.exclude 追加）、Check 3 suppression entry の新規追加、Check 4 lint・静的解析設定からのルール削除や無効化、Check 5 branch protection・required check の緩和、の 5 Check を対象とし、これらが機能変更と同一 PR に混在し、かつ意図の宣言が無い場合に指摘する。report-only。workflow の permissions / action pin は gha-workflow-security、既存 suppression entry の使い分けは suppression-feedback、設定ファイルの一般的妥当性は config-json、.only / .skip / @ts-ignore / @ts-nocheck は heuristic-review.mjs の決定論検出器、リファクタと機能追加の混在は behavior-structure-separation へ委譲する

Enforce null/undefined safety for changed TypeScript code and suggest safer patterns.

日本語の概要は準備中です。原文の説明を表示しています。

How to use the Adaptyv Bio Foundry API and Python SDK for protein experiment design, submission, and results retrieval. Use this skill whenever the user mentions Adaptyv, Foundry API, protein binding assays, protein screening experiments, BLI/SPR assays, thermostability assays, or wants to submit protein sequences for experimental characterization. Also trigger when code imports `adaptyv`, `adaptyv_sdk`, or `FoundryClient`, or references `foundry-api-public.adaptyvbio.com`.

日本語の概要は準備中です。原文の説明を表示しています。

Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do not trigger for general maintainer lists or non-security ownership questions.

日本語の概要は準備中です。原文の説明を表示しています。

Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.

日本語の概要は準備中です。原文の説明を表示しています。

AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.

日本語の概要は準備中です。原文の説明を表示しています。

Build a throwaway prototype to answer a design question, as UI variations or a state-model walkthrough. Use when the user types /prototype, wants to sanity-check whether a state model or logic feels right, wants to explore what a UI should look like, or as the prototype step of the web design flow with brainstorm or grill before the final plan goes to plan-canvas (annotate the running prototype with the plan-canvas annotation tool).

日本語の概要は準備中です。原文の説明を表示しています。

コード品質の最終確認。Skill: code-review (built-in) で correctness bug を検出 → main agent が findings を修正 → lint/ty 静的解析 → 条件付きで security-reviewer / critic を spawn (security 関連変更 or plan/requirements.md がある時のみ)。「品質チェックして」「品質ゲート通して」「レビューして」「コードを確認して」「PR 出す前にチェック」「セキュリティ大丈夫？」「コード見て」で発動。

Expert guidance on iOS accessibility best practices, patterns, and implementation. Use when developers mention: (1) iOS accessibility, VoiceOver, Dynamic Type, or assistive technologies, (2) accessibility labels, traits, hints, or values, (3) automated accessibility testing, auditing, or manual testing, (4) Switch Control, Voice Control, or Full Keyboard Access, (5) inclusive design or accessibility culture, (6) making apps work for users with disabilities.

日本語の概要は準備中です。原文の説明を表示しています。

Performs comprehensive FiveM resource security, performance, and compatibility audits. Detects backdoors, RATs, SQL injection, event exploitation, NUI vulnerabilities, dupes, crash/DoS vectors, npm and build-chain supply chain attacks, and malware patterns across ESX, QBCore, QBox, ox_lib, and ND_Core frameworks, on both GTA V Legacy and Enhanced builds. Use whenever a FiveM/cfx resource is being reviewed — even if not explicitly asked — including: audit FiveM script, review FiveM security, optimize FiveM resource, check FiveM performance, FiveM code review, review Lua script security, audit ESX resource, audit QBCore resource, audit QBox resource, check for exploits, FiveM vulnerability scan, GTA V Enhanced migration check, resmon optimization, or asking whether a leaked, cracked, nulled or unknown-origin script is safe to run.

日本語の概要は準備中です。原文の説明を表示しています。

Implement Kubernetes Pod Security Admission to enforce baseline and restricted security profiles at namespace level using built-in admission controller.

日本語の概要は準備中です。原文の説明を表示しています。

Configure GitHub Advanced Security with CodeQL to perform automated static analysis and vulnerability Tespit across repositories at enterprise scale.

日本語の概要は準備中です。原文の説明を表示しています。

The NIST Cybersecurity Framework (CSF) 2.0, released in February 2024, provides a comprehensive taxonomy for managing cybersecurity risk through six core Functions - Govern, Identify, Protect, Detect, Respond, and Recover. bu skill covers conducting a maturity assessment against the CSF using Implementation Tiers to measure organizational cybersecurity posture and create improvement roadmaps.

日本語の概要は準備中です。原文の説明を表示しています。

Performing comprehensive security assessments of Google Cloud Platform environments using Forseti Security, Security Command Center, and gcloud CLI to audit IAM policies, firewall rules, storage permissions, and compliance against CIS GCP Foundations Benchmark.

日本語の概要は準備中です。原文の説明を表示しています。

Implementing AWS Security Hub to aggregate security Bul:ings across AWS accounts, enable compliance standards like CIS AWS Foundations and PCI DSS, configure automated remediation with EventBridge and Lambda, and create custom security insights for organizational risk management.

日本語の概要は準備中です。原文の説明を表示しています。

Implementing Cloud Security Posture Management (CSPM) to continuously monitor multi-cloud environments for misconfigurations, compliance violations, and security risks using Prowler, ScoutSuite, AWS Security Hub, Azure Defender, and GCP Security Command Center.

日本語の概要は準備中です。原文の説明を表示しています。