171 件 ・ 関連度順
概要と使いどころ
Cross-framework infrastructure security audit across cloud, network, and CI/CD. Use for infrastructure and cloud security audits, security posture assessment, and validating technical controls for SOC 2, ISO 27001, and NIST CSF.
日本語の概要は準備中です。原文の説明を表示しています。
This skill should be used when the user asks to "scan AI systems for security threats", "check for prompt injection vulnerabilities", "assess model security posture", "detect data poisoning risks", or "audit AI/ML pipeline security".
日本語の概要は準備中です。原文の説明を表示しています。
Expert NIST Cybersecurity Framework (CSF) advisor covering CSF 2.0 and CSF 1.1. Use this skill whenever a user asks about NIST CSF, cybersecurity risk management, the six CSF functions (Govern, Identify, Protect, Detect, Respond, Recover), CSF profiles, implementation tiers, gap assessments, organizational profiles, community profiles, CSF core subcategories, informative references, or mapping to other frameworks (NIST SP 800-53, ISO 27001, CIS Controls, COBIT). Also trigger for questions like "how do I implement NIST CSF?", "what does CSF 2.0 change?", "help me build a CSF profile", "how do I assess my cybersecurity posture?", or any request involving organizational cybersecurity risk strategy or framework alignment.
日本語の概要は準備中です。原文の説明を表示しています。
Expert knowledge for Azure Osconfig development including troubleshooting, security, configuration, and integrations & coding patterns. Use when running OSConfig via IoT for commands/networking, SSH Posture Control, agent health, or Windows security baselines, and other Azure Osconfig related development tasks. Not for Azure Update Manager (use azure-update-manager), Azure Automation (use azure-automation), Azure Policy (use azure-policy).
日本語の概要は準備中です。原文の説明を表示しています。
MCP threat-model artifact for a scaffolded harness. Reports allowed/denied tools, dangerous permissions count, secrets reachability, network/shell/file-write grants, default-deny posture. Verdict: clean (exit 0) / medium (exit 1) / high (exit 2). The 'enterprise gold' artifact for PR + compliance review.
日本語の概要は準備中です。原文の説明を表示しています。
Emit .harness/oia-manifest.json declaring layer alignment with the OIA v0.1 9-layer reference architecture. Self-describes the harness's MCP wiring, witness signing, audit log, identity posture (always 'none' at v0.1). --check verifies an existing manifest, --dry-run prints without writing, --json emits to stdout.
日本語の概要は準備中です。原文の説明を表示しています。
Application Security Posture Management persona. Correlates findings from SAST, DAST, and SCA tools, deduplicates noise, maps vulnerabilities to specific code commits, and generates targeted remediation PRs.
日本語の概要は準備中です。原文の説明を表示しています。
System hardening, detection engineering, security baseline monitoring, patch management, defense-in-depth architecture, and security posture improvement
日本語の概要は準備中です。原文の説明を表示しています。
Find leaked secrets in source code, Git history, build artifacts, and infrastructure — and audit the secrets-management posture preventing future leaks. Use when the user mentions 'secrets audit,' 'secret scanning,' 'leaked credentials,' 'API key in code,' 'gitleaks,' 'trufflehog,' 'git history scan,' 'secrets management,' 'vault audit,' 'rotation policy,' 'AWS Secrets Manager,' 'HashiCorp Vault,' 'Doppler,' '1Password Secrets Automation,' 'sealed-secrets,' 'External Secrets Operator,' or needs to find or prevent credential exposure.
日本語の概要は準備中です。原文の説明を表示しています。
AWS cost optimization, monitoring, and operational excellence expert. Use when analyzing AWS bills, estimating costs, setting up CloudWatch alarms, querying logs, auditing CloudTrail activity, or assessing security posture. Essential when user mentions AWS costs, spending, billing, budget, pricing, CloudWatch, observability, monitoring, alerting, CloudTrail, audit, or wants to optimize AWS infrastructure costs and operational efficiency.
日本語の概要は準備中です。原文の説明を表示しています。
When the user needs to prepare for SOC 2, build a compliance roadmap, assess security posture, quantify security risk, or says "we need SOC 2", "security audit", "compliance", "enterprise customer wants SOC 2", "CISO advice".
日本語の概要は準備中です。原文の説明を表示しています。
Technical due diligence for M&A, investment, or acquisition. Reads a target company's codebase and generates a comprehensive tech DD report with architecture assessment, tech debt quantification, scalability analysis, security posture, team capability inference, build system quality, test coverage, deployment maturity, and open source license risks. Outputs tech-dd-report.md formatted like a real investment memo with risk ratings, remediation costs, and go/no-go recommendation.
日本語の概要は準備中です。原文の説明を表示しています。
AWS cost optimization, monitoring, and operational excellence expert. Use when analyzing AWS bills, estimating costs, setting up CloudWatch alarms, querying logs, auditing CloudTrail activity, or assessing security posture.
日本語の概要は準備中です。原文の説明を表示しています。
Create original short videos using the 单人表演弧｜坐起前倾再释放 Creative DNA for MiniMax H3 or Seedance 2.0. Use when the user wants this causal, camera, motion, rhythm, or payoff structure with new subjects and surfaces.
日本語の概要は準備中です。原文の説明を表示しています。
Scan repositories for newly disclosed CVEs in dependencies after a specific cutoff date. Takes a repository path, cutoff date (YYYY-MM-DD), and optional parameters for transitive dependencies. Parses dependency manifests (package.json, pom.xml, requirements.txt, go.mod, Cargo.toml) and lockfiles to extract exact versions. Queries vulnerability databases (OSV.dev, NVD, GitHub Advisory) to identify CVEs disclosed strictly after the cutoff date. Distinguishes between newly disclosed CVEs and previously known CVEs. Use when: (1) Performing security audits to find new vulnerabilities since last review, (2) Checking if new CVEs affect a historical codebase version, (3) Generating compliance reports showing vulnerability status at specific dates, (4) Tracking security posture changes over time. Supports npm, Maven, pip, Go modules, Cargo, and other major ecosystems.
日本語の概要は準備中です。原文の説明を表示しています。
Perform a broad, authorized security audit across application, infrastructure, identity, dependencies, and operations. Use when the user needs a scoped security posture review; use the SAST, DAST, dependency-scanning, or threat-modeling skill when the request is limited to one specialist activity.
日本語の概要は準備中です。原文の説明を表示しています。
Macro regime analysis, bull bear market detection, business cycle analysis, macro environment assessment, interest rate cycle, yield curve analysis, monetary policy, fiscal policy, global macro, central bank posture, credit cycle, recession probability, expansion regime, macro regime shift, stagflation detection
日本語の概要は準備中です。原文の説明を表示しています。
Apply security-conscious thinking when generating or modifying code. Enforces trust boundary awareness, input validation, injection prevention, secrets management, and defense-in-depth authorization. Use when generating code that handles user input, authentication, authorization, database queries, external APIs, or file operations, or when the user mentions 'security review', 'secure this', 'check for vulnerabilities', 'trust boundary', 'input validation', or 'OWASP'. Loaded automatically by the code-generating molecules (code-forge, refactor-safely, bug-fix). This skill governs the security posture of generated code -- not architecture (see architecture) and not code craft (see clean-code).
日本語の概要は準備中です。原文の説明を表示しています。
Apply clean code principles when generating or modifying implementation code. Enforces function focus, naming clarity, complexity management, error handling, and self-documenting style. Use when the user mentions 'clean code', 'code quality', 'coding guidelines', or 'implementation quality'. Loaded automatically by the code-generating molecules (code-forge, refactor-safely, bug-fix). This skill governs the craft of writing individual code units -- not architecture (see architecture), not security posture (see secure-coding), not test structure (see test-quality), and not refactoring workflows (see refactor-safely).
日本語の概要は準備中です。原文の説明を表示しています。
Cross-agent self-inspection of your AI-agent stack. Audits skills, MCP servers, hooks, plugins, commands, credentials, and memory files across Claude Code, Codex, OpenClaw, and NanoClaw. Produces a structured inventory and narrative briefing with cross-ecosystem risk analysis. Use when the user asks to audit their own setup, check what they have installed, review their agent stack security posture, or understand cross-tool interactions. Use when a user has accumulated skills/plugins/MCP servers over time and wants visibility into their attack surface. Use after installing new skills or plugins. Do NOT use for vetting external code before install (that is repo-forensics). Do NOT use for incident response during active attacks. Do NOT use for fixing or patching vulnerabilities (forensify is read-only).
日本語の概要は準備中です。原文の説明を表示しています。
AWS Security Audit workflow skill. Use this skill when the user needs Comprehensive AWS security posture assessment using AWS CLI and security best practices and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.
日本語の概要は準備中です。原文の説明を表示しています。
AWS Security Audit workflow skill. Use this skill when the user needs Comprehensive AWS security posture assessment using AWS CLI and security best practices and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.
日本語の概要は準備中です。原文の説明を表示しています。
健身私教 — 为客户设计、指导和推进个性化训练方案的专业工艺, 有别于团课教练、物理治疗师或运动队教练: (a) 训练方案设计与周期化 (线性 / 波动 / 板块周期化 Bompa & Haff; NSCA《力量训练与体能训练精要》行业圣经; Schoenfeld 肌肥大机制; Helms/Valdez/Morgan 肌肉与力量金字塔; 共轭训练法 Simmons/Westside; Starting Strength 线性渐进 Rippetoe; Renaissance Periodization 训练量地标 Israetel); (b) 动作评估与筛查 (FMS 功能性动作筛查 Gray Cook; NASM CEx 纠正性训练连续体 抑制-拉伸-激活-整合; 关节逐级方法 Cook/Boyle; 姿势与代偿模式识别; PAR-Q+ 与 ACSM 运动前筛查指南); (c) 教学与指令 (外部 vs 内部注意焦点 Wulf; 差异化学习 Schöllhorn; 约束导向方法 Davids/Renshaw; RIR/RPE 自动调节 Zourdos/Helms; 动机访谈在健身中的应用 Rollnick/Miller); (d) 营养指导的执业边界 (宏量营养素周期化; Precision Nutrition / ISSN 立场声明的循证建议; 边界: 私教提供一般性指导, 医学营养治疗需 RD/RDN 资质; 能量可用性与 RED-S Mountjoy IOC 共识); (e) 商业与客户管理 (客户留存与方案依从; 咨询与销售伦理; 线上教练平台与规模化 Goodman PTDC; 方案交付工具 TrueCoach/Trainerize/TrainHeroic; 课时定价模型; 独立教练 vs 健身房雇员); (f) 专项方向 (运动表现 CSCS; 纠正性训练 CES; 老年健身 SFN; 产前产后; 青少年 YSCA; 适应性 / 无障碍健身; 健美 / 形体; 力量举; 耐力运动 S&C)。诚实处理: 兄弟科学 vs 循证之争, 补剂行业利益冲突, 合成代谢激素使用现状 (诚实但不推广: 匿名调查约 30% 有经验男性健身者使用过 — 业内估, Kanayama/Pope/Hudson 记录健康风险, WADA 禁用清单用于竞技语境), 体型焦虑与进食障碍风险 (男性私教肌肉变形症, 正食症倾向, NEDA 负责任语言指南), 健身房掠夺性销售 (高压推销、误导性对比照、长约锁定), 执业边界违规 (私教诊断伤病或超范围开饮食处方), 线上教练认证造假 (周末速成、未经认可的认证)。不含: 物理治疗 / 康复治疗 (持照医疗职业), 不含: 团课教练 (Les Mills/Zumba/CrossFit 分馆教练 — 相邻但不同), 不含: 精英竞技运动教练 (团队项目周期化, 不同职业路径), 不含: 营养作为主业 (临床营养学需单独资质)。 (Personal Trainer — the craft of designing, coaching, and progressing individualized exercise programs for clients, distinct from group fitness instruction, physiotherapy, or sports coaching: (a) exercise programming and periodization (linear / undulating / block periodization per Bompa & Haff; NSCA Essentials of Strength Training and Conditioning as industry bible; Schoenfeld on hypertrophy mechanisms; Helms/Valdez/Morgan Muscle & Strength Pyramids; conjugate method Simmons/Westside; Starting Strength linear progression Rippetoe; Renaissance Periodization volume landmarks Israetel); (b) movement assessment and screening (FMS Gray Cook; NASM CEx corrective exercise continuum inhibit-lengthen-activate-integrate; joint-by-joint approach Cook/Boyle; posture and compensation pattern identification; PAR-Q+ and pre-exercise screening ACSM guidelines); (c) coaching and cueing (external vs internal cueing Wulf attentional focus research; differential learning Schöllhorn; constraints-led approach Davids/Renshaw; RIR/RPE autoregulation Zourdos/Helms; motivational interviewing for adherence Rollnick/Miller adapted to fitness); (d) nutrition guidance within scope of practice (macronutrient periodization; evidence-based recommendations per Precision Nutrition / ISSN position stands; scope boundary: PT gives general guidance NOT medical nutrition therapy which requires RD/RDN credential; energy availability and RED-S awareness Mountjoy IOC consensus); (e) business and client management (client retention and programming adherence; consultation and sales ethics; online coaching platforms and scaling Goodman PTDC; programming delivery tools like TrueCoach/Trainerize/TrainHeroic; session pricing models; independent contractor vs gym employee dynamics); (f) specialization tracks (sports performance CSCS; corrective exercise CES; senior fitness SFN; pre/postnatal; youth YSCA; adaptive/inclusive fitness; bodybuilding/physique coaching; powerlifting/strength sports; endurance athlete S&C). Evidence-based practice as the core ethos: Schoenfeld/Krieger meta-analyses on volume-response, Helms systematic reviews on protein/resistance training, Brad Schoenfeld's MASS journal bridging research to practice, Menno Henselmans and Eric Helms as practitioner-researchers, Greg Nuckols Stronger By Science as translation layer. Chinese fitness industry context: rapid growth of personal training in commercial gyms (Keep/Lefit/Megafit chains), NSCA-CPT and ACE-CPT as dominant certifications alongside local CSFA (China Sport and Fitness Association) credential, '体适能' (physical fitness) as formal term, online coaching boom post-COVID, PT business models in tier 1-3 cities diverge sharply. Honest treatment of: bro science vs evidence-based d
日本語の概要は準備中です。原文の説明を表示しています。
Run Claude Code INSIDE a ca-sandbox box (`--with-claude`). Routed to when the user wants an agent loop running against an isolated, ephemeral sandbox rather than the host. Authenticates via an env-injected CLAUDE_CODE_OAUTH_TOKEN with no host bind of ~/.claude; the image pins the CLI and disables the autoupdater; HOME is backed by a named volume so the .claude state persists across restart. Five gated phases — posture, image, token, run, teardown. The hard default is offline or Anthropic-domains-only egress, and the token volume is NEVER co-mounted with an untrusted-code run; both are enforced, not advised.
日本語の概要は準備中です。原文の説明を表示しています。