「sec」の検索結果

Evaluate an incoming workflow upgrade — a skill, MCP server, subagent, library, external service, prompt, or pattern — through one disciplined pipeline before adopting it. Security is a blocking gate. Records every verdict so the same thing is never evaluated twice. Use when considering a new tool from a post, repo, or recommendation. Triggers — "vet this", "should we adopt", "is this safe to install", "evaluate this skill/MCP", "what do you think of this tool".

日本語の概要は準備中です。原文の説明を表示しています。

SOLID design review rules (SRP, OCP, LSP, ISP, DIP) for code reviews: what counts as a real design finding, what is only taste, how to cite it and how severe it is. Use when reviewing a diff, a pull request or recent changes for design problems, when asked for a "SOLID review", "design review", "is this class doing too much", or when a review checklist asks for SOLID. Pair it with the dry skill for duplication and with owasp-asvs for security.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when authoring or debugging GitHub Actions workflows (.github/workflows/*.yml) — e.g. "add CI for this Drupal project on GitHub", "run phpcs/phpstan/phpunit on pull requests", "cache composer dependencies", "deploy over SSH when main is pushed", "why didn't my workflow trigger", or anything involving jobs, matrices, runners, secrets, or reusable workflows.

日本語の概要は準備中です。原文の説明を表示しています。

Low-ceremony workflow for trivial, low-risk changes: typos, comments, CSS/styling tweaks, string changes, single-line fixes with no logic impact. Use to avoid the overhead of the full feature workflow when the change cannot break anything. If during the fix the change turns out to touch logic, security, config, or schema, stop and escalate to the feature-workflow skill.

日本語の概要は準備中です。原文の説明を表示しています。

DRY (Don't Repeat Yourself) review rules for code reviews: find the same knowledge — a rule, a constant, a parser, a validation, a protocol detail — implemented in several places that must change together, and tell it apart from code that merely looks alike. Use when reviewing a diff, a pull request or recent changes for duplication, on "DRY review", "is this duplicated", "copy-paste check", or when a review checklist asks for DRY. Pair it with the solid skill for design and with owasp-asvs for security.

日本語の概要は準備中です。原文の説明を表示しています。

Use an available Codex MCP integration as a read-only second-opinion verifier for GEODE code reviews, GAP audits, and contract checks. Use only when the user requests Codex cross-checking and the current tool inventory exposes the required MCP tools.

日本語の概要は準備中です。原文の説明を表示しています。

Verification checklist to prevent fake success. Detects test deletion/disabling, coverage regression, lint bypass, secret exposure. Triggered by "deception", "fake" ("가짜"), "fake success", "verification" ("검증"), "checklist" ("체크리스트"), "deletion detection" ("삭제 탐지"), "regression" keywords.

日本語の概要は準備中です。原文の説明を表示しています。

Implements sub-tasks from a task list at .ai/[feature]/tasks.md strictly one at a time, stopping after each to ask the user before starting the next, and keeping the task list and Relevant Files section current. Use when the user wants to review or approve each sub-task before work continues, rather than letting the agent run the list unattended with task-orchestration.

日本語の概要は準備中です。原文の説明を表示しています。

Review changed code for correctness, security, maintainability, and verification gaps. Use when code is ready for independent review or before handoff, staging, or merge.

日本語の概要は準備中です。原文の説明を表示しています。

Structures git branches and worktrees: keeps unrelated changes on separate branches, isolates each in its own worktree created so the repository's setup runs, records dependencies with git-machete, and recombines them into a temporary mixdown branch for local testing. Use before creating any branch or worktree in a codebase that works on more than one branch, including branching off the default branch to start a change; when starting work in a fork, clone, or third-party checkout; when choosing what a new branch should be based on; when a branch is growing a second unrelated concern; when deciding whether to stack branches or keep them independent; when preparing a change for a pull request or patch submission; when handed an existing worktree or branch to implement and commit in a fork; or when a local build needs several in-progress branches combined. Not needed where the repository clearly commits everything to the trunk, or holds notes or personal data rather than code.

日本語の概要は準備中です。原文の説明を表示しています。

React performance optimization. Identify unnecessary renders, apply memo/useCallback/useMemo correctly.

日本語の概要は準備中です。原文の説明を表示しています。

Validate and sanitize all API inputs. Zod schemas, error responses, security considerations.

日本語の概要は準備中です。原文の説明を表示しています。

Corta una nueva versión — mueve la sección Unreleased del CHANGELOG a una versión SemVer con fecha, crea el commit y el tag, y opcionalmente el release de GitHub. Úsalo cuando la persona pida publicar/cortar una versión o preparar un release (p. ej. "corta la versión 1.2.0", "prepara el release", "publica una nueva versión"). No hace push sin confirmación.

日本語の概要は準備中です。原文の説明を表示しています。

Actualiza CHANGELOG.md en el formato Keep a Changelog, añadiendo los cambios actuales bajo la sección Unreleased. Úsalo cuando la persona pida actualizar el changelog, añadir una entrada al changelog o registrar lo que cambió para las notas de la versión (p. ej. "añade esto al changelog", "actualiza el CHANGELOG con estos commits").

日本語の概要は準備中です。原文の説明を表示しています。

Diagnose and eliminate the GraphQL N+1 resolver explosion using Facebook DataLoader's per-request batching, plus the second-order defenses (persisted queries, depth limits, cost analysis). Use when a GraphQL query that returns N items in a list triggers N+1 database round trips, when designing nested resolvers that load associations, when a list query times out under load, or when you need to budget query cost before resolvers run. NOT for REST-style endpoint design (use api-versioning-strategy), generic database query optimization (use database-query-optimizer), or schema design (use graphql-server-architect).

日本語の概要は準備中です。原文の説明を表示しています。

Build production CI/CD pipelines with GitHub Actions. Implements matrix builds, caching, deployments, testing, security scanning. Use for automated testing, deployments, release workflows. Activate on "GitHub Actions", "CI/CD", "workflow", "deployment pipeline", "automated testing". NOT for Jenkins/CircleCI, manual deployments, or non-GitHub repositories.

日本語の概要は準備中です。原文の説明を表示しています。

Use when designing matrix builds (OS x version x dimension), composing reusable workflows, gating jobs on conditions, doing OIDC to AWS/GCP/Cloudflare without long-lived secrets, sharding tests across runners, or fixing cache invalidation. Triggers: workflow_call between repos, fail-fast: false tradeoffs, exclude/include matrix surgery, environment protection rules, OIDC trust policy setup, concurrency cancellation on duplicate pushes, artifact reuse across jobs, conditional job matrices computed at runtime. NOT for GitLab CI / CircleCI / Jenkins (different yaml dialects), self-hosted runner administration, or local act dev.

日本語の概要は準備中です。原文の説明を表示しています。

Cloudflare Pages and Workers deployment checklist for wrangler deploys, secret audits, D1 migrations, Worker-compatible SDK checks, and browser-auth verification. Use when shipping Cloudflare changes to production. NOT for general CI/CD architecture, non-Cloudflare deployments, or post-launch UX QA.

日本語の概要は準備中です。原文の説明を表示しています。

Write production-grade Dockerfiles, docker-compose configurations, multi-stage builds, and container optimization. Activate on "Dockerfile", "docker", "docker-compose", "container", "multi-stage build", "docker image", "container optimization", "docker security". NOT for Kubernetes orchestration, cloud-specific container services (ECS, Cloud Run), or CI/CD pipelines (use github-actions-pipeline-builder).

日本語の概要は準備中です。原文の説明を表示しています。

Use when optimizing Docker builds with BuildKit, designing multi-stage Dockerfiles, leveraging cache mounts, building multi-arch images, choosing distroless vs alpine, or signing images with cosign. Triggers: docker build slow, layer cache not hitting, npm install / pip install reruns, multi-stage final image bloat, glibc vs musl issues, RUN --mount=type=cache, BUILDKIT_INLINE_CACHE, registry cache exporters, qemu emulation for arm64, COPY ordering for cache. NOT for Docker daemon admin, Kubernetes-specific image policies, container security scanning workflows, or Buildpacks (different paradigm).

日本語の概要は準備中です。原文の説明を表示しています。

Reviews a GitHub PR with a shallow correctness/security/breaking/AI-slop checklist and emits a verdict; optionally posts via gh. NOT for own-diff audit (mk:review); NOT for replying (mk:respond-pr).

日本語の概要は準備中です。原文の説明を表示しています。

Pack an EXTERNAL repository into one AI-friendly file (markdown/xml/json) for third-party analysis, security audits, or handoff. Do NOT use for the current project — it's already read lazily.

日本語の概要は準備中です。原文の説明を表示しています。

Structured second-pass reasoning after a review or plan verdict: pre-mortem, inversion, red team, Socratic lens, etc. NOT for initial review (mk:review) or new plans (mk:plan-creator).

日本語の概要は準備中です。原文の説明を表示しています。

Fetch external sources (web / arXiv / GitHub) and turn them into scanner-gated wiki CANDIDATES — never canonical pages. Every fetched byte is DATA; url-guarded, size-capped, redirect-re-validated, injection-scanned, and secret-scrubbed before a candidate is even created. Requires network. NOT for capturing local knowledge (see mk:wiki); NOT for one-shot page-to-markdown (see mk:web-to-markdown).

日本語の概要は準備中です。原文の説明を表示しています。