「advisory」の検索結果

Triage a single security finding — from a scanner, audit, advisory, or report — to a defensible disposition with a mitigation plan, false-positive justification, or accepted-risk writeup. Use when the user mentions 'triage this finding,' 'is this a real vulnerability,' 'mitigation plan,' 'false positive,' 'accept this risk,' 'compensating controls,' 'risk justification,' 'security ticket,' 'CVSS this,' 'should we fix this,' 'disposition,' 'sign off on,' or has a single security finding and needs to decide what to do.

日本語の概要は準備中です。原文の説明を表示しています。

Audit project dependencies, frameworks, languages, and dev tools for known vulnerabilities, CVEs, and security anti-patterns. Use when the user mentions 'dependency audit,' 'npm audit,' 'CVE,' 'vulnerable packages,' 'supply chain security,' 'outdated dependencies,' 'known vulnerabilities,' 'security advisory,' 'package security,' 'framework vulnerability,' 'is this package safe,' or needs to check whether their stack has known security issues.

日本語の概要は準備中です。原文の説明を表示しています。

Research a specific CVE or vulnerability disclosure end-to-end — what version is affected, is your code reachable, is there a public PoC, is there a patch, what's the exposure window, what's the mitigation if you can't patch immediately. Use when the user mentions 'CVE,' 'vulnerability research,' 'is this CVE relevant,' 'zero-day,' 'CISA KEV,' 'GitHub Security Advisory,' 'reachability analysis,' 'patch analysis,' 'exploit availability,' 'EPSS,' 'CVSS,' or 'should we drop everything and patch this.'

日本語の概要は準備中です。原文の説明を表示しています。

Audits dependency supply chains for bad versions, lockfile drift, and artifact integrity. Use when adding deps, handling incidents, or releasing a plugin.

日本語の概要は準備中です。原文の説明を表示しています。

Ingest a CVE writeup, blog post, advisory, or GitHub repo into the wiki - fetch, dedup via sources:, update the right technique/tool page(s), re-index. Generic knowledge only; never client data.

日本語の概要は準備中です。原文の説明を表示しています。

Drive responsible disclosure of a proven finding to a CVE. Package the report, find the vendor contact, report privately, coordinate a timeline, request the CVE (vendor CNA / GitHub / MITRE), and publish an advisory. Closes the research loop. Triggers - "disclose", "request a cve", "report this to the vendor".

日本語の概要は準備中です。原文の説明を表示しています。

N-day / patch-diff workflow - given a CVE/advisory or a suspicious patch, diff pre- vs post-patch to locate the fixed bug, build a PoC for the unpatched version, and run variant analysis for a fresh bug. Triggers - "n-day", "patch diff", "diff the patch", "bindiff".

日本語の概要は準備中です。原文の説明を表示しています。

Run developer customer discovery via a Technical Advisory Board (TAB). Use when the user has never interviewed a user who isn't a friend, is inventing messaging from a conference room, or is guessing at the roadmap instead of hearing the pain firsthand.

日本語の概要は準備中です。原文の説明を表示しています。

Use when writing, testing, or preparing ANY contribution or pull request to the JSONbored/awesome-claude (HeyClaude) repo — adding a community content entry (agent/MCP server/skill/hook/command/rule/guide/collection/statusline), or making a platform/code change (website, registry package, MCP package, scripts). The repo has two separate review paths: a private, one-shot "HeyClaude submission gate" that decides single-file content PRs, and the shared gittensory-orb bot that posts an advisory readiness/linked-issue comment on platform/code PRs but does not itself merge or close content PRs. Unlike JSONbored/gittensory and JSONbored/metagraphed, a linked issue is OPTIONAL here — do not import their mandatory-linked-issue rule into this repo. Invoke for any "contribute to / open a PR against / submit an entry to / fix a bug in awesome-claude (HeyClaude)" task.

日本語の概要は準備中です。原文の説明を表示しています。

Scan repositories for newly disclosed CVEs in dependencies after a specific cutoff date. Takes a repository path, cutoff date (YYYY-MM-DD), and optional parameters for transitive dependencies. Parses dependency manifests (package.json, pom.xml, requirements.txt, go.mod, Cargo.toml) and lockfiles to extract exact versions. Queries vulnerability databases (OSV.dev, NVD, GitHub Advisory) to identify CVEs disclosed strictly after the cutoff date. Distinguishes between newly disclosed CVEs and previously known CVEs. Use when: (1) Performing security audits to find new vulnerabilities since last review, (2) Checking if new CVEs affect a historical codebase version, (3) Generating compliance reports showing vulnerability status at specific dates, (4) Tracking security posture changes over time. Supports npm, Maven, pip, Go modules, Cargo, and other major ecosystems.

日本語の概要は準備中です。原文の説明を表示しています。

Use only after explicit Codex `$superloopy:superloopy-research` or Claude Code `/superloopy:superloopy-research` invocation, a research task started with a leading `loopy` or `루피` (such as `loopy research`), or an active Superloopy loop explicitly routing a research deliverable here. Evidence-backed Superloopy research orchestration with automatic advisory usage targets, parallel read-only lanes, per-retrieval verdicts, graded and dated sources, empirical verification, a priced claim ledger, cited synthesis, and optional reports. Do not activate from research, investigate, look-up, summarize, deep-dive, report, or similar vocabulary alone, in any language; ordinary questions, debugging, and implementation context-gathering stay with their primary workflows.

日本語の概要は準備中です。原文の説明を表示しています。

Run quokka's real-device E2E layer (QA strategy layer 5): drive the real qk binary against connected iPhone/Android devices through tmux, apply deterministic verifiers, and write a report. Use when the user asks to "run /qa", "run the device QA suite", "test against the real device", or before a release. Optionally finishes with an advisory exploratory UX pass (layer 6).

日本語の概要は準備中です。原文の説明を表示しています。

Channeling the documented thinking of named notable figures (an 'itako' medium) — their mental models, heuristics, and decision-style as advisory lenses. Not for decisions (Magi) or personas (Cast).

日本語の概要は準備中です。原文の説明を表示しています。

Deliberating decisions and founder priorities through multi-perspective, named-expert, and YC-style advisory lenses. Use for verdicts, office hours, or expert critique; not implementation.

日本語の概要は準備中です。原文の説明を表示しています。

Discoverability shim for the Retail-Agentic-Commerce CVE remediation Codex skill. Use for CVE, BDSA, GHSA, OSV, Dependabot, Black Duck, Snyk, npm, PyPI, or package advisory remediation.

日本語の概要は準備中です。原文の説明を表示しています。

A C-level strategy advisory board, run as a team of named specialist agents, that takes an executive from a raw strategic question to a defended, board-ready recommendation. Use this skill whenever the user faces a significant business decision or wants strategic analysis — market entry, build-vs-buy, M&A, digital transformation, annual planning, portfolio prioritization, pricing, a big investment, a competitive threat, a turnaround. Trigger on requests like "should we invest in / build / buy / enter…", "develop a strategy for…", "evaluate this opportunity", "make the business case", "stress-test this plan", "run a pre-mortem", or "prepare a board presentation" — in any language, even when the user doesn't say the word "strategy". Also trigger when the user names a board member (Drucker, Porter, Christensen, Graham, Grove, Wack, Taleb, Minto) or asks to convene the board / open a boardroom session.

日本語の概要は準備中です。原文の説明を表示しています。

Financial services advisory skill for consulting engagements. Use when preparing research briefs on banking, insurance, capital markets, or wealth management, building performance benchmarking frameworks, regulatory impact assessments, or stakeholder materials for CFOs, CROs, and technology leaders.

日本語の概要は準備中です。原文の説明を表示しています。

Analyze raw prompts, identify intent and gaps, match ECC components (skills/commands/agents/hooks), and output a ready-to-paste optimized prompt. Advisory role only — never executes the task itself. TRIGGER when: user says "optimize prompt", "improve my prompt", "how to write a prompt for", "help me prompt", "rewrite this prompt", or explicitly asks to enhance prompt quality. Also triggers on Chinese equivalents: "优化prompt", "改进prompt", "怎么写prompt", "帮我优化这个指令". DO NOT TRIGGER when: user wants the task executed directly, or says "just do it" / "直接做". DO NOT TRIGGER when user says "优化代码", "优化性能", "optimize performance", "optimize this code" — those are refactoring/performance tasks, not prompt optimization.

日本語の概要は準備中です。原文の説明を表示しています。

Use whenever the user wants to find, shortlist, vet, or enrich US accounting and tax firms (CPA firms) — financial-statement audit, SOC 1/2 audit, corporate tax, bookkeeping for businesses, advisory/fractional CFO, M&A diligence, 409A valuations, R&D tax credits, IPO readiness, sales-and-use tax. Triggers on "find me a CPA firm for our delaware c-corp series A audit", "shortlist three audit firms with SaaS experience", "we need a tax advisor for our M&A", or "pull contact info for these 10 accounting firm domains", even when described indirectly (audit our books, fractional CFO support, file our 1120). Drives the ServiceGraph API (api.servicegraph.co) — a 100k+ US firm catalog filterable by industry, services, location, size, ratings. Skip personal/consumer tax preparation (1040, individual estate, retirement planning), in-house controller/CFO hires, "how do I file my taxes" DIY questions, accounting-software comparisons (QuickBooks vs Xero), non-US firms, individual freelance bookkeepers.

日本語の概要は準備中です。原文の説明を表示しています。

Prepares credit rating agency presentations with methodology alignment, peer positioning, and target rating analysis. Use when advising on credit ratings, preparing rating agency meetings, or analyzing rating methodology impact.

日本語の概要は準備中です。原文の説明を表示しています。

Evaluates board composition, compensation alignment, and governance practices with proxy advisory and institutional investor standards. Use when analyzing governance, evaluating board effectiveness, or assessing shareholder alignment.

日本語の概要は準備中です。原文の説明を表示しています。

Author a new agent-almanac workflow — a self-contained `.mjs` orchestration script run by Claude Code's Workflow tool. Covers choosing a workflow over a team, copying the template, the triple-name discovery contract, the pure-literal meta and sidecar frontmatter, building the body with the injected primitives, the advisory/implementing capability contract, the adversarial-verification fail-safes, validation, and manual installation. Use when you have a repeatable, parameterized procedure that coordinates several agents and want it captured as a reusable, auditable artifact whose control flow is fixed in code.

日本語の概要は準備中です。原文の説明を表示しています。

Audit project dependencies for version staleness, security vulnerabilities, and compatibility issues. Covers lock file analysis, upgrade path planning, and breaking change assessment. Use before a release to ensure dependencies are current and secure, during periodic maintenance reviews, after receiving a security advisory, when upgrading to a new language version, before submitting to CRAN or npm, or when inheriting a project to assess its dependency health.

日本語の概要は準備中です。原文の説明を表示しています。

Appraise gemstone value using the four Cs (color, clarity, cut, carat), origin assessment, treatment detection, and market factor analysis. Advisory educational guidance only — not a certified appraisal. Use when understanding factors that determine a gemstone's value, pre-screening stones before a professional appraisal, evaluating whether a seller's asking price is reasonable, learning gemstone grading methodology, or understanding how treatment status affects value.

日本語の概要は準備中です。原文の説明を表示しています。