680 件 ・ 関連度順
概要と使いどころ
Guides data subject and stakeholder consultation requirements during Data Protection Impact Assessments under GDPR Article 35(9). Covers consultation planning, data subject engagement methods, DPO involvement per Art. 35(2), and documentation of views received. Keywords: DPIA consultation, stakeholder engagement, Art. 35(9), data subject views, DPO advice, public consultation, representative groups.
日本語の概要は準備中です。原文の説明を表示しています。
Provides a structured risk scoring methodology for Data Protection Impact Assessments aligned with ENISA threat taxonomy and ISO 29134. Covers likelihood and severity assessment, risk matrix construction, inherent vs residual risk calculation, and risk appetite thresholds per EDPB WP248rev.01 guidance. Keywords: risk scoring, DPIA risk matrix, likelihood, severity, ENISA, ISO 29134, residual risk, risk appetite.
日本語の概要は準備中です。原文の説明を表示しています。
Conducts Data Protection Impact Assessments for employee monitoring systems per EDPB Guidelines 3/2019 on workplace data processing. Covers video surveillance, email monitoring, GPS tracking, keystroke logging, and productivity tools. Applies proportionality testing under Art. 35 GDPR. Keywords: DPIA, employee monitoring, surveillance, proportionality, EDPB, workplace privacy, keystroke logging, GPS tracking.
日本語の概要は準備中です。原文の説明を表示しています。
Guides compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA, S.C. 2000, c. 5). Covers the 10 fair information principles in Schedule 1, consent requirements, cross-border transfer obligations, breach notification under Division 1.1, and OPC enforcement. Keywords: PIPEDA, Canada privacy, fair information principles, OPC, breach notification, cross-border transfer, consent.
日本語の概要は準備中です。原文の説明を表示しています。
Implements Children's Online Privacy Protection Act (COPPA) compliance under 16 CFR Part 312. Covers verifiable parental consent methods including signed forms, credit card verification, government ID, knowledge-based authentication, and video call. Includes FTC safe harbor programs and enforcement actions. Keywords: COPPA, FTC, children, parental consent, safe harbor, verifiable consent.
日本語の概要は準備中です。原文の説明を表示しています。
Implements 42 CFR Part 2 protections for substance use disorder patient records. Covers written consent requirements stricter than HIPAA, re-disclosure prohibition, court order procedures, qualified service organization agreements, and 2024 amendments aligning Part 2 with HIPAA. Keywords: 42 CFR Part 2, substance use disorder, SUD records, re-disclosure, consent, Part 2 amendments.
日本語の概要は準備中です。原文の説明を表示しています。
Guides assessment of third-country adequacy decisions under GDPR Article 45 for international data transfers. Covers the current EC adequacy decisions list, adequacy assessment criteria, partial adequacy handling, and monitoring of adequacy decision reviews. Keywords: adequacy decision, Article 45, third country, adequate protection, EC adequacy list.
日本語の概要は準備中です。原文の説明を表示しています。
Conducts Data Protection Impact Assessments for AI and ML systems per EDPB Guidelines 04/2025 on AI processing. Covers training data lawfulness evaluation, model risk assessment, automated decision triggers, and AI-specific DPIA methodology. Keywords: AI DPIA, machine learning impact assessment, EDPB AI guidelines, model risk, training data.
日本語の概要は準備中です。原文の説明を表示しています。
This skill should be used when the user asks to "add turnstile", "implement bot protection", "validate turnstile token", "fix turnstile error", "setup captcha alternative", or encounters error codes 100*/300*/600*, CSP errors, or token validation failures. Provides CAPTCHA-alternative protection for Cloudflare Workers, React, Next.js, and Hono.
日本語の概要は準備中です。原文の説明を表示しています。
Implements CSRF protection using synchronizer tokens, double-submit cookies, and SameSite attributes. Use when securing web forms, protecting state-changing endpoints, or implementing defense-in-depth authentication.
日本語の概要は準備中です。原文の説明を表示しています。
Comprehensive expertise in automated crypto trading systems, including DEX sniping bots, arbitrage strategies, MEV protection, Telegram trading bots, and anti-rug protection. Use when "trading bot, sniping bot, arbitrage bot, Telegram trading, DEX bot, MEV bot, copy trading, auto trading, token sniper, " mentioned.
日本語の概要は準備中です。原文の説明を表示しています。
Expert guidance for Arcjet, the developer-first security platform that provides rate limiting, bot protection, email validation, and attack detection as a code-first SDK. Helps developers add security layers to Next.js, Node.js, and other JavaScript/TypeScript applications without managing infrastructure.
日本語の概要は準備中です。原文の説明を表示しています。
Focuses on routing, CSRF protection, context handling, and template usage within the internal handlers directory.
日本語の概要は準備中です。原文の説明を表示しています。
Use when a task needs the judgment of a Customs and Border Protection officer — scoring a shipment or traveler for secondary-inspection referral, evaluating a manifest discrepancy for contraband risk, deciding whether a traveler is admissible under immigration law, structuring a seizure or penalty referral, or triaging a primary-inspection queue under time pressure.
日本語の概要は準備中です。原文の説明を表示しています。
Shopify/DTC brand protection toolkit. Detect counterfeit stores, unauthorized resellers, and trademark violations. Includes DMCA takedown templates, domain monitoring, and social media infringement detection. No API key required.
日本語の概要は準備中です。原文の説明を表示しています。
AI-powered calendar management and agent-based scheduling coordination. Covers calendar APIs (Google Calendar, CalDAV/iCal), AI scheduling assistants (Reclaim, Clockwise, Motion, Cal.com), building custom calendar agents with MCP, multi-calendar merging, timezone management, focus block protection, meeting fatigue detection, and agent-to-agent meeting negotiation protocols. Activate on: "calendar agent", "AI scheduling", "calendar coordination", "meeting scheduling", "calendar API", "focus time protection", "calendar optimization", "Google Calendar MCP", "Reclaim", "Clockwise", "Motion", "Cal.com", "smart scheduling", "calendar-aware agent", "timezone scheduling", "agent negotiation meetings". NOT for: manual calendar UI component design (use form-validation-architect), project management scheduling or Gantt charts (use project-management-guru-adhd), general time-tracking or pomodoro apps (use adhd-daily-planner for time-awareness), building the agent itself from scratch (use agent-creator).
日本語の概要は準備中です。原文の説明を表示しています。
Expert-level power systems covering power generation, transmission, distribution, power flow analysis, fault analysis, protection, and power electronics.
日本語の概要は準備中です。原文の説明を表示しています。
Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use when analyzing protected binaries, bypassing anti-debugging for authorized analysis, or understanding software protection mechanisms.
日本語の概要は準備中です。原文の説明を表示しています。
Detects and responds to OAuth token theft and replay attacks in cloud environments, focusing on Microsoft Entra ID (Azure AD) token protection, conditional access policies, and sign-in anomaly detection. Covers access token theft, refresh token replay, Primary Refresh Token (PRT) abuse, and pass-the-cookie attacks. Activates for requests involving OAuth token theft detection, token replay prevention, Azure AD conditional access token protection, or cloud identity attack investigation.
日本語の概要は準備中です。原文の説明を表示しています。
Use Intel CHIPSEC to assess platform firmware configuration, SPI flash write protection, BIOS lock, SMM/SMRR, and Secure Boot variable state, dump SPI flash, and triage UEFI variables for firmware-level threats.
日本語の概要は準備中です。原文の説明を表示しています。
Knowledge base from NIST SP 800-37 Revision 2, the Risk Management Framework (RMF) for information systems and organizations. Use for the seven RMF steps (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) and their tasks; the three-tier organization-wide risk model; authorization boundaries; the requirements-to-controls relationship; security categorization (FIPS 199/200 high-water mark) and control selection/tailoring (SP 800-53/53B baselines); assessment, the authorization decision and risk acceptance, continuous monitoring and ongoing authorization; the security/privacy distinction; and supply chain risk management. This is the security-and-privacy-risk-governance edge of systems engineering — it governs how much protection and whether to accept residual risk, complementing the disciplines that decide how protection is built. Does NOT reproduce the SP 800-53 control catalog or its baselines, the FIPS impact tables, or the ISO/IEC/IEEE 15288 process text; it names and routes to them rather than restating them.
日本語の概要は準備中です。原文の説明を表示しています。
Flags where a P&ID draft raises a process safety question and points to the candidate evidence an engineer would review (HAZOP register, relief study, SIL assessment, isolation philosophy), as questions and quoted passages with UNKNOWN for missing documents, plus safety functions, relief devices and isolation requirements carried over as stated. Never rates, sizes, classifies, resolves or declares protection adequate. Use when the user asks to "write the process safety flags", "produce the process safety section of the P&ID enrichment", "list which protection questions this P&ID raises" or "map the HAZOP and relief study evidence to the draft" after gate G2, once the piping and instrumentation sections exist. Do not use for proposing loops, alarms or trips from the control philosophy, use instrumentation-and-control-enrichment instead; do not use for checking identifiers, use tagging-and-numbering. Drafts for human review; never approves, authorises or signs off.
日本語の概要は準備中です。原文の説明を表示しています。
Reads a project or processing description and returns a DRAFT data protection impact assessment pack: processing description, necessity and proportionality questions, a risk table with blank rating cells, mitigations to consider and open questions. Never rates risk, determines the lawful basis or judges adequacy; the DPO assesses and signs. Works from descriptions, never personal data. Use when the user asks to "start a DPIA for the new monitoring tool", "draft a data protection impact assessment", "scaffold a DPIA from this processing description" or "what would the DPO need for a DPIA on this". Do not use for redacting or de-identifying a document, use document-deidentification-pass instead; do not use for working out what data an incident exposed, use data-incident-impact-brief instead. Drafts for human review; never approves, authorises or signs off.
日本語の概要は準備中です。原文の説明を表示しています。
差分が「その差分自身を審査するレビュー基準・品質ゲート」を弱めていないかを diff-time で検出する。Check 1 レビュールールの削除・弱体化（.river/rules.md / .river/rules.d/*）、Check 2 実行時コンフィグの閾値・ゲート緩和（.river-review.{json,yaml,yml} の review.severity 引き下げ / exclude 拡大 / memory.suppressionEnabled 無効化 / selection.skills.exclude 追加）、Check 3 suppression entry の新規追加、Check 4 lint・静的解析設定からのルール削除や無効化、Check 5 branch protection・required check の緩和、の 5 Check を対象とし、これらが機能変更と同一 PR に混在し、かつ意図の宣言が無い場合に指摘する。report-only。workflow の permissions / action pin は gha-workflow-security、既存 suppression entry の使い分けは suppression-feedback、設定ファイルの一般的妥当性は config-json、.only / .skip / @ts-ignore / @ts-nocheck は heuristic-review.mjs の決定論検出器、リファクタと機能追加の混在は behavior-structure-separation へ委譲する