8,704 件 ・ 関連度順
概要と使いどころ
This skill details how to conduct cloud security audits using Center for Internet Security benchmarks for AWS, Azure, and GCP. It covers interpreting CIS Foundations Benchmark controls, running automated assessments with tools like Prowler and ScoutSuite, remediating failed controls, and maintaining continuous compliance monitoring against CIS v5 for AWS, v4 for Azure, and v4 for GCP.
日本語の概要は準備中です。原文の説明を表示しています。
Craft, send, sniff, and dissect network packets using Scapy for protocol analysis, network reconnaissance, and traffic anomaly detection in authorized security testing
日本語の概要は準備中です。原文の説明を表示しています。
Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat detection rules from audit event patterns. Use when investigating Kubernetes cluster compromise or building k8s-specific SIEM detection rules.
日本語の概要は準備中です。原文の説明を表示しています。
Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements across 14 families, compute the SPRS score with the DoD Assessment Methodology, manage a compliant POA&M, and ready the organization for a C3PAO assessment. Use when an organization handles Controlled Unclassified Information (CUI) under a DoD contract, when a contract carries DFARS clause 252.204-7012/7019/7020/7021, when preparing for or responding to a CMMC assessment, when computing or improving an SPRS score, when building a System Security Plan or POA&M for 800-171, or when scoping which systems are in the CUI boundary. Keywords: CMMC, CMMC Level 2, NIST 800-171, SP 800-171 Rev 2, CUI, FCI, SPRS, DFARS 7012, C3PAO, POA&M, System Security Plan, DoD Assessment Methodology, 110 controls, defense industrial base, DIB, FedRAMP equivalency.
日本語の概要は準備中です。原文の説明を表示しています。
Runtime iOS app security testing with Objection (Frida): inspect keychain and filesystem data, explore app internals at runtime, and validate/bypass client-side protections during authorized mobile assessments.
日本語の概要は準備中です。原文の説明を表示しています。
Telegram Bot API の long-polling を cloud routine 上で常駐させ、認可済みチャットからのメッセージに秘書エージェント（SecretaryRole）が即応する対話チャネル。Webhook 不可な cloud routine 環境制約を long-polling + /goal deadline 駆動ループで回避する。
Proactive secure-coding coach scoped to the file or topic you are working on — surfaces relevant SAST rule IDs, CWE patterns, language-specific PASS/FAIL code snippets. Use when about to write auth, crypto, SQL, deserialization, file-handling, or template code; coaching juniors; pair-programming a security-sensitive change.
日本語の概要は準備中です。原文の説明を表示しています。
Reconstructed reference notes on US FDA medical-device software regulation, built from seven public-domain FDA sources (the QMSR final rule 89 FR 7496, FDA device software guidance documents, and the eSTAR program page; pinned 2026-10-12). Use for regulatory pathways and premarket submissions (510(k), De Novo, PMA, eSTAR), premarket software documentation levels (Basic or Enhanced), software validation and Computer Software Assurance, the Quality Management System Regulation (QMSR, 21 CFR 820), medical-device cybersecurity (secure product development, SBOMs, FD&C Act section 524B, labelling), clinical decision support boundaries, off-the-shelf software, MDDS and other software-function scope questions, and the 510(k) software-change trigger. SCOPE LIMITS: US FDA device regulation only; no EU MDR or UKCA content (see `med-device-eu`); no ISO 13485, ISO 14971, or IEC 62304 text, which are named and summarized only as FDA obligations; no drug, biologic, or combination-product rules; reflects the pinned source dates, not later FDA actions; synthesized reference notes, not legal advice and not a substitute for the guidance documents. LICENCE: Public Domain (US Government work, 17 U.S.C. 105).
日本語の概要は準備中です。原文の説明を表示しています。
Knowledge base from NIST Cybersecurity Framework (CSF) 2.0. Use for cybersecurity risk management, GOVERN, IDENTIFY, PROTECT, DETECT, RESPOND, RECOVER, Organizational Profiles, CSF Tiers, supply chain risk, enterprise risk management, incident response. Covers the CSF 2.0 document only; does not cover specific SP 800-53 controls, NIST RMF system authorization steps, or sector-specific regulations.
日本語の概要は準備中です。原文の説明を表示しています。
Synthesized reference notes from three US Government vehicle-safety sources: NHTSA Cybersecurity Best Practices for the Safety of Modern Vehicles (updated 2022, final), NHTSA Automated Driving Systems 2.0: A Vision for Safety (2017), and a 16-section selection of 49 CFR Part 571 (FMVSS) pinned at eCFR versioner date 2025-01-01. Use for voluntary vehicle cybersecurity practices, the ADS 2.0 twelve priority safety design elements, and FMVSS occupant protection, brakes/stability/lighting, and fuel/EV integrity requirements. Not ISO 26262, not ASPICE, not ISO/SAE 21434, not UNECE R155/R156, not SAE J3016, and not the full Part 571; the FMVSS material is a selection of vehicle-level minimum performance standards, not a process standard.
日本語の概要は準備中です。原文の説明を表示しています。
Knowledge base from NIST SP 800-37 Revision 2, the Risk Management Framework (RMF) for information systems and organizations. Use for the seven RMF steps (Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor) and their tasks; the three-tier organization-wide risk model; authorization boundaries; the requirements-to-controls relationship; security categorization (FIPS 199/200 high-water mark) and control selection/tailoring (SP 800-53/53B baselines); assessment, the authorization decision and risk acceptance, continuous monitoring and ongoing authorization; the security/privacy distinction; and supply chain risk management. This is the security-and-privacy-risk-governance edge of systems engineering — it governs how much protection and whether to accept residual risk, complementing the disciplines that decide how protection is built. Does NOT reproduce the SP 800-53 control catalog or its baselines, the FIPS impact tables, or the ISO/IEC/IEEE 15288 process text; it names and routes to them rather than restating them.
日本語の概要は準備中です。原文の説明を表示しています。
Knowledge base from the DoD Manufacturing Readiness Level (MRL) Deskbook (Version 2022, OSD ManTech / Joint Service–Industry MRL Working Group). Use for assessing and managing manufacturing maturity and producibility risk in defense acquisition: the 10-level MRL scale and its non-linear, target-not-grade nature; the five demonstration environments (laboratory → production-relevant → production-representative → pilot line → production line); the nine manufacturing-risk threads and sub-threads; how MRL targets map onto Adaptive Acquisition Framework milestones (MRL 4/6/7/8/9); conducting an MRL Assessment; building a Manufacturing Maturation Plan; putting MRL maturity into contract language (Section L/M, SOW, AS6500A, DIDs); tailoring criteria for S&T, single-system, ship, sustainment, and industry contexts; and screening operational-technology cybersecurity. Manufacturing-readiness focused — it measures producibility risk and frames mitigation; it is NOT a technology-readiness (TRL) guide, a full systems-engineering process model, a cost-estimating or schedule guide, or a deep cybersecurity audit method (see sibling packs for those).
日本語の概要は準備中です。原文の説明を表示しています。
Knowledge base from CISA Cross-Sector Cybersecurity Performance Goals 2.0. Use for prioritized IT/OT baseline cyber goals aligned to NIST CSF 2.0 (including GOVERN), critical-infrastructure hygiene, MSP/supply-chain expectations, and board-friendly outcome language. Covers CPG 2.0 goals only; does not replace full CSF programs, sector-specific goals (SSGs), or CSET tooling detail.
日本語の概要は準備中です。原文の説明を表示しています。
Erstellt oder überarbeitet einen Skill FÜR DIESES ÖKOSYSTEM: delegiert die generische Interview-/Entwurfs-/Eval-Schleife an das offizielle skill-creator-Plugin (Anthropic, Apache-2.0), setzt aber zusätzlich die ellmos-Anforderungen durch, die das offizielle Plugin nicht kennt — Haus-Frontmatter (9 Felder), Kategorie/Sichtbarkeits-Regeln, anbieter-/nutzer-/ellmos-neutrale aber ellmos-sensitive Erkennung via grounding-seed, mitgelieferte config.json (inkl. Lernvertrag) + connections.json, Anbieter-/Vendor-Bewusstsein (State-of-the-Art-Alternativen inkl. eigener ellmos-Komponenten vorschlagen), einen Selbstaktualisierungs-Abschnitt UND einen wiederverwendbaren Lern-/Abdeckungs-Dateisatz (user-usecases.json, usecase-gaps.json, known-providers-and-abilities.json, gap-closing-analysis.json — an skill-creators evals.json und A2A/AgentSkill angelehnt, kein Parallelstandard). IMMER nutzen, wenn ein NEUER Skill für dieses System entstehen oder ein bestehender auf ellmos-Konformität nachgerüstet werden soll — auch bei "erstelle einen Skill", "bau mir einen Skill für X", "skill-creator nutzen", "neuen Skill anlegen", "diesen Skill ellmos-konform machen", "Lernvertrag/Verhaltenscodex für einen Skill anlegen", "Usecase-Abdeckung eines Skills prüfen". Für reines Skill-FINDEN/ROUTEN stattdessen skill-finder, für Landschafts-Audit skill-explorer.
日本語の概要は準備中です。原文の説明を表示しています。
Pre-fills a customer's or prospect's security or third-party risk questionnaire from the organisation's own answer sources (prior questionnaires, answer library, policies), returning one row per question with a draft answer marked Reused, Adapted, Missing or Routed, its source, date, scope match and owner, plus the Missing list by owner. Never invents an answer, certification or control and never submits. Use when the user asks to "pre-fill this security questionnaire", "take a first pass at the customer's due diligence form", "answer this vendor assessment from our previous responses", "populate the third-party risk questionnaire" or "which questions can we reuse answers for". Do not use for screening a vendor's own answers, use vendor-risk-screening-brief instead; for RFP or tender answers use rfp-response-drafter. Drafts for human review; never approves, authorises or signs off.
日本語の概要は準備中です。原文の説明を表示しています。
Reviews a proposal, business case, deck or plan in character as a Chief Information Security Officer archetype and returns a DRAFT review with a verdict, findings cited to specific passages, security and compliance risks and the five interrogation questions a real CISO would ask. Use when the user asks to "run a CISO review", "pressure-test the security of this plan", "what would our CISO say about this" or "check the privacy and third-party risk". Do not use for contract, liability or regulatory-interpretation reviews, use general-counsel-reviewer instead. Drafts for human review; never approves, authorises or signs off.
日本語の概要は準備中です。原文の説明を表示しています。
Proposes tag and number structures for the new lines and instruments in a P&ID draft according to the project's numbering procedures, checks every tag extracted from the PFD against the quoted procedure format, and lists cross-section identifier mismatches and the registry checks a human must run. Never invents a numbering convention, never alters a PFD tag and never assigns a sequence number the procedure reserves for the registry. Use when the user asks to "run the tagging and numbering section", "check the tags against the numbering procedure", "propose the tag structure for the new lines and instruments" or "list the registry checks before validation" after the process safety flags. Do not use for validating the four sections, use validation-and-review-package instead; do not use for instrument content, use instrumentation-and-control-enrichment. Drafts for human review; never approves, authorises or signs off.
日本語の概要は準備中です。原文の説明を表示しています。
- Research companies, directors, shareholders and ultimate beneficial ownership in official corporate registries, filings and offshore datasets — OpenCorporates, UK Companies House and the PSC register, SEC EDGAR, US Secretary of State registries, EU business registers, GLEIF LEI… Use when asked who owns or controls a company, to find a person's other directorships, or to unpick a group structure
日本語の概要は準備中です。原文の説明を表示しています。
- Mine GitHub, GitLab and git history for identities, infrastructure and leaked credentials using commit author emails, GitHub code search, the commit… Use when investigating a developer or organisation on GitHub, finding leaked API keys, AWS keys or tokens in code, enumerating org members and their personal repos, or recovering secrets deleted from HEAD but still present in history or forks
日本語の概要は準備中です。原文の説明を表示しています。
Takes existing content markdown files and builds production-final resource center pages on client websites using their existing tech stack and design system. Output is live-ready — no review pass, no placeholder content, no prototype styling. Implements hub pages, section listings, article pages, and cross-linking for Blog, Guides, Learn, and Comparisons sections.
日本語の概要は準備中です。原文の説明を表示しています。
Write a bold, value-adding follow-up when your own outbound message got silence: check the thread, pick a second channel, add new value instead of a bare bump. Use when an email, DM or PR comment went unanswered. Triggers: /bold-followup, /bump, follow up on silence, second channel.
日本語の概要は準備中です。原文の説明を表示しています。
Onboard a NEW human peer ([коллега], [коллега], [коллега], future family/colleagues/clients) into building THEIR OWN Second Brain — the HUMAN layer that runs on… Trigger on “/brain-onboard“, “/brain-onboard <имя>“, “онбординг второго мозга“, “заведи <имени> второй мозг“, “onboard <name> into their second brain“, “личный волт для <имя>“, or when a peer's Claude receives the personal-vault-per-user rule
日本語の概要は準備中です。原文の説明を表示しています。
Audits WordPress plugin or theme PHP code for the most common security mistakes — missing nonce checks, capability checks, input sanitization, output escaping, unslashing, SQL preparation, AJAX nopriv exposure, file/path traversal, and unsafe redirects. Use when reviewing pull requests, before releasing a plugin, when the user asks "is this secure", or when handling code that touches $_GET / $_POST / $_REQUEST / $_COOKIE / $_FILES / $_SERVER, admin-ajax / admin-post, REST endpoints, options, user meta, custom DB queries, or file uploads.
日本語の概要は準備中です。原文の説明を表示しています。
Authorized security assessment of REST, GraphQL, WebSocket, and SOAP APIs: discovery, authentication and authorization flaws (BOLA/IDOR, JWT/OAuth), rate-limit testing, and a structured multi-phase me
日本語の概要は準備中です。原文の説明を表示しています。