「trust」の検索結果

Use when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face ID, Touch ID), CryptoKit (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, secure credential storage (OAuth tokens, API keys), certificate pinning (SecTrust, SPKI), keychain sharing across apps/extensions, migrating secrets from UserDefaults or plists, or OWASP MASVS/MASTG mobile compliance on Apple platforms.

日本語の概要は準備中です。原文の説明を表示しています。

Audit RuField tests, trust boundaries, privacy projections, and evidence promotion. Use for conformance review, security regression review, release validation, or checking whether field accuracy claims have support.

日本語の概要は準備中です。原文の説明を表示しています。

Log a bias-log / vipassana observation to the memex store the moment a reasoning pattern surfaces, mid-session or at close. Use when you catch a bias in your own reasoning (anchoring, confirmation, trust-the-summary), when a pace tell or verification gap appears, or when meditate/observe produces a reflection worth persisting across sessions. Primary path pipes the body to `memex add` over stdin (`--title` required) then runs the `meditate-vipassana` extractor to make it queryable; secondary path appends a numbered bullet to `docs/OBSERVATIONS.md`.

日本語の概要は準備中です。原文の説明を表示しています。

Apply GitHub repository security protections tier by tier — rulesets, read-only Actions token, secret scanning + push protection, Dependabot, and (gated) required status checks / required PR with a GitHub App bypass for a CI auto-commit bot. Mutating and confirmation-gated: always assess first, apply the no-regret baseline, then decide required checks separately. Use when hardening a public user-owned repo after an audit, when a repo has no branch protection, when adding required checks without breaking a bot that pushes to the default branch, or when provisioning a GitHub App bypass actor for trusted automation.

日本語の概要は準備中です。原文の説明を表示しています。

Statically enforce a privacy/redaction boundary on an artifact tree before publication, the way an AST checker enforces a code contract. Builds a two-tier gate — a shape-based deny-list (regex over identifier shapes) plus a structure-aware tier that parses JSON/HTML/SVG/Markdown/code and asserts sensitive content cannot appear in meaningful positions — with a strict exit-code contract, label-only output that never echoes the patterns themselves, and false-positive narrowing instead of suppressions. Use when gating a public mirror, a disclosure draft, a wire-capture export, or any artifact that must pass a leak check before it ships, and when a plain line-grep is too coarse to trust.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user runs /toolchain-health and wants a trustworthy green/yellow/red verdict on the installed toolchain with ranked repairs. Not for tasks that require source or remote-system changes.

日本語の概要は準備中です。原文の説明を表示しています。

Use when repo content crosses into working context or synthesized knowledge. Flags injections and blocks derived instructions. Not for tasks requiring source or remote-system changes.

日本語の概要は準備中です。原文の説明を表示しています。

Use when crossing a public API boundary, guarding complex invariants, or hardening untrusted input or integration seams. Not for remote or irreversible changes.

日本語の概要は準備中です。原文の説明を表示しています。

Integrate one already reviewed Proto UI pull request at its exact head when current-user or active standing authorization, live GitHub permission, trusted CI, review state, and repository rules all agree. Use only after pui-review; do not use to manufacture approval or bypass a blocked pull request.

日本語の概要は準備中です。原文の説明を表示しています。

Pre-landing PR review. Analyzes diff against the base branch for SQL safety, LLM trust boundary violations, conditional side effects, and other structural issues. Use when asked to "review this PR", "code review", "pre-landing review", or "check my diff".

日本語の概要は準備中です。原文の説明を表示しています。

Create high-converting free resources that capture emails and build trust. Produces complete lead magnets (ebooks, checklists, templates, toolkits, quizzes) with landing page copy, thank-you page, and follow-up email sequence. Use when someone needs a list-building asset, wants to grow their email list, needs an opt-in incentive, a content upgrade, a gated download, or top-of-funnel content. Triggers on 'lead magnet', 'ebook', 'checklist', 'template', 'free resource', 'opt-in', 'grow my list', 'email capture', 'content upgrade', 'list building', 'gated content', or 'free download'. Even if someone just says 'I need something to capture emails' or 'how do I get more subscribers', this is the skill. Every lead magnet passes a 4-gate quality test before shipping.

日本語の概要は準備中です。原文の説明を表示しています。

Provides a complete workflow for implementing verified email retrieval on Android Credential Manager API. Use this skill to integrate a secure, OTP-less email verification flow into an Android app. This skill solves the problem of high-friction sign-up processes by leveraging cryptographically verified credentials from trusted providers like Google.

日本語の概要は準備中です。原文の説明を表示しています。

Work with the upstash-box Python SDK for sandboxed cloud containers with AI agents, shell, filesystem, git, cron schedules, snapshots, and a headless browser. Use when building with Upstash Box in Python, creating a sandbox or isolated environment to run untrusted or agent-generated code, running AI coding agents in containers, giving an agent a cloud dev environment with a shell and repository, browser automation from a box, scheduling recurring jobs inside a box, saving and restoring snapshots, or orchestrating parallel boxes.

日本語の概要は準備中です。原文の説明を表示しています。

Work with the @upstash/box TypeScript/JavaScript SDK for sandboxed cloud containers with AI agents, shell, filesystem, git, cron schedules, snapshots, and a headless browser. Use when building with Upstash Box, creating a sandbox or isolated environment to run untrusted or agent-generated code, running AI coding agents in containers, giving an agent a cloud dev environment with a shell and repository, browser automation from a box, scheduling recurring jobs inside a box, saving and restoring snapshots, or orchestrating parallel boxes.

日本語の概要は準備中です。原文の説明を表示しています。

Use when cutting, debugging, or verifying a pythinker-code (TSC monorepo) release — changesets flow, the ci release-packages version PR, release.yml anatomy, npm Trusted Publishing OIDC, native assets, brew tap, CDN redeploy, and their failure modes. Invoked by /release.

日本語の概要は準備中です。原文の説明を表示しています。

DNS C2 operator skill for the AgentCore sandbox breakout demo. This skill should be used when the user asks to run C2 verification, attack a victim chatbot, send commands to a compromised session, retrieve exfiltrated data, or interact with the DNS C2 system.

日本語の概要は準備中です。原文の説明を表示しています。

Operate and debug the DNS C2 system non-interactively. This skill should be used when Claude needs to launch an exploit, send commands to a compromised session and collect output, diagnose why a payload is not calling home, or inspect C2 server state. Triggers on requests like "run the exploit", "send whoami to the session", "why isn't the payload calling back", "check what sessions are active", or "debug the C2".

日本語の概要は準備中です。原文の説明を表示しています。

REQUIRED before writing code for any feature touching auth, payments, credentials, tokens, sessions, file upload, user data, untrusted input, deserialization, network endpoints, or data deletion. Scope by that surface, not the task label — a research/experimental/local-only feature with none of it doesn't need this. Invoke it, record answers inline in the design doc or PR description, then write the code. Skipping this is how auth bypass, token leakage, and delete-the-wrong-record bugs ship. If the feature touches any of those surfaces and this hasn't run, the design is incomplete — do not proceed to implementation.

日本語の概要は準備中です。原文の説明を表示しています。

Entry point for rafter. Invoke when a sub-skill is unclear, or when the task needs `rafter run` (remote SAST+SCA), `rafter secrets` (local secrets-only), `rafter audit`, policy checks, or command-risk evaluation. Scope by security surface, not task label: engage when the diff touches auth, credentials/secrets/tokens, untrusted input, SQL, shell/exec, file paths, deserialization, crypto, network endpoints, data deletion, or dependencies; for research/experimental/local-only code with none of that, a quick surface check is enough. When such surface IS present and no rafter skill or CLI call has been made, invoke this before handing the task off — an un-evaluated "done" on genuine security surface is not done.

日本語の概要は準備中です。原文の説明を表示しています。

Sets up safe working habits and a change log so you always know what Cowork has done to your files — and can undo anything. Use when setting up file protection guardrails, for establishing safe automation habits, during initial access configuration, when granting file permissions for the first time, or when the user says "is cowork safe", "file safety", "what if it deletes my files", "audit trail", "safety setup", "I'm nervous about file access", "how do I trust cowork with my files", "can cowork mess up my computer", "I heard someone lost files", or "how do I stay in control".

日本語の概要は準備中です。原文の説明を表示しています。

Use when evidence needs grading before anyone reasons from it — the user asks "how reliable is this?", "grade this source", "check this report", "can I trust this article?", "is this corroborated?", or hands over a URL, a pasted report or a Liberty91 event ahead of an ACH or assessment. The Quality of Information Check from the CIA Tradecraft Primer, adapted for vendor and press CTI reporting. Resolves each document to its originating source, splits it into claims, and grades every claim on two written elements, access level (how the source knows) and claim support (what backs the statement), with a stated rationale, using a fixed rubric with hard caps. The grade is not an Admiralty rating. Five outlets citing one vendor report count as one source; anything that cannot be traced to a primary is capped, not guessed. Returns a graded claim table, gaps, a deception screen and JSON. /ach, /threat-assessment and /writing-assessments run it first by default.

日本語の概要は準備中です。原文の説明を表示しています。

Investigate a question against high-trust primary sources and capture the findings as a Markdown file in the repo. Use when the user wants a topic researched, docs or API facts gathered, or reading legwork delegated to a background agent.

日本語の概要は準備中です。原文の説明を表示しています。

Design reliable, safe, and trustworthy agent systems that fail gracefully and operate within bounds. Use when building guardrails, handling edge cases, preventing harmful outputs, monitoring for failures, implementing safety constraints, or designing error recovery. Covers failure modes, constraint systems, oversight mechanisms, and safety validation.

日本語の概要は準備中です。原文の説明を表示しています。

This skill should be used when building AI agents using prompt-native architecture where features are defined in prompts, not code. Use it when creating autonomous agents, designing MCP servers, implementing self-modifying systems, or adopting the "trust the agent's intelligence" philosophy.

日本語の概要は準備中です。原文の説明を表示しています。