2,368 件 ・ 関連度順
概要と使いどころ
Verifies implementation plan quality across 8 dimensions (requirement-coverage, task-completeness, dependency-validity, scope-sanity, artifact-wiring, risk-assessment, testability, estimation-quality) and returns pass/fail with per-dimension scores.
日本語の概要は準備中です。原文の説明を表示しています。
Ask the minimum clarifying questions before implementation when requirements are ambiguous or missing crucial details
日本語の概要は準備中です。原文の説明を表示しています。
Build a mental and visual map of the target application before hunting — entry points, trust boundaries, data flows, and high-value functionality. Use when user has scope parsed and wants to plan WHERE to hunt rather than diving into recon.
日本語の概要は準備中です。原文の説明を表示しています。
Enumerate subdomains using passive and active techniques (subfinder, amass, chaos, assetfinder, crtsh, DNS brute force). Use when the user has a root domain in scope and needs the full subdomain list before probing.
日本語の概要は準備中です。原文の説明を表示しています。
Evaluate HackerOne / Bugcrowd / Intigriti programs before committing time. Decide signal-to-noise, payout history, response time, scope size, and competition level. Use when the user is considering a new bug bounty target or asking "should I hunt this".
日本語の概要は準備中です。原文の説明を表示しています。
Hunt full Account Takeover (ATO) by chaining lower-severity findings — IDOR-to-email-disclosure, password-reset-token-theft, OAuth-redirect-uri abuse, response-manipulation, cookie scope, CRLF in Set-Cookie, race-condition on signup. Use when the user wants to escalate small findings to ATO or thinks an ATO path exists.
日本語の概要は準備中です。原文の説明を表示しています。
Mobile (Android) app recon and analysis — decompile APK, extract secrets, find hardcoded endpoints, exposed Firebase / AWS / API keys, deeplink abuse, intent vulnerabilities, exported components, WebView XSS, MobSF static analysis. Use when target's scope includes Android apps (.apk).
日本語の概要は準備中です。原文の説明を表示しています。
Hunt OAuth 2.0 and OIDC flaws — redirect_uri abuse, state CSRF, PKCE bypass, scope manipulation, implicit-flow token theft, postMessage origin tricks, ID token sub claim swap, JWKS confusion, response_type confusion, and OAuth-CSRF. Use when an app has Google/GitHub/Facebook/Apple/custom OAuth or OpenID Connect.
日本語の概要は準備中です。原文の説明を表示しています。
Set up nightly monitoring of subdomain changes, JS file diffs, new endpoints, and CVE matches against in-scope assets, with Discord/Slack/Telegram notifications. Use when the user has an active engagement and wants to be alerted to new attack surface without manual re-recon.
日本語の概要は準備中です。原文の説明を表示しています。
Hunt cloud misconfigurations exposed externally — open S3/GCS buckets, exposed IAM-tied EC2 metadata, Cognito misconfig, GitHub Actions secret leakage, exposed Kubernetes API, public Elastic / Kibana / Mongo, Firebase RTDB rules, weak AWS access keys discovered in JS/mobile. Use when leveraging leaked credentials or hunting cloud surface in scope.
日本語の概要は準備中です。原文の説明を表示しています。
Construction document review with PE judgment — RFI research, submittal analysis, coordination checking, scope gap detection. Use when reviewing drawings, specs, submittals, or RFIs. Triggers: 'review', 'coordination', 'what's missing'.
日本語の概要は準備中です。原文の説明を表示しています。
Evaluate tabulated subcontractor bids against specs and drawings — scope gap analysis, exclusion risk scoring, award recommendation. Triggers: 'evaluate bids', 'bid evaluation', 'lowest responsible bidder'.
日本語の概要は準備中です。原文の説明を表示しています。
Scope-specific code gap analysis — extracts referenced codes from project docs, researches what should apply, surfaces the delta. Triggers: 'code research', 'what codes apply', 'code check', 'ADA requirements', 'egress'.
日本語の概要は準備中です。原文の説明を表示しています。
Declare variables in smallest possible scope, initialize close to first use, minimize span and live time
日本語の概要は準備中です。原文の説明を表示しています。
Plan and freeze workflow execution by creating an Execution Contract, setting PLAN_FROZEN/CURRENT_ROLE, and updating PROJECT_STATE decisions and Top 3. Use when starting workflow delivery, re-planning after unfreeze, or when scope/constraints change before execution.
日本語の概要は準備中です。原文の説明を表示しています。
Execute a frozen workflow contract and collect evidence by implementing only approved scope/files and checks. Use when PLAN_FROZEN=true and Execution Contract is complete, then hand off to review.
日本語の概要は準備中です。原文の説明を表示しています。
Onboarding workflow for cross-library KB query in a consulting practice. Discovers existing user-scope library registrations, prompts for additions, validates each library, helps activate the relevant ones for the current project, runs a smoke test, and reports a clear "ready" or "issues to fix" verdict. Use --verify-only to skip prompting and just validate existing setup (sub-task 23 of
日本語の概要は準備中です。原文の説明を表示しています。
Register an external knowledge base library in the user-scope global registry at ~/.sdlc/global-libraries.json. Validates that the target path exists, contains a _shelf-index.md, and parses its format_version. Optional helper — hand-editing the JSON is also supported.
日本語の概要は準備中です。原文の説明を表示しています。
Render module-scoped human-readable traceability for a single module — REQs, DESs, TESTs, code locations with anchor links, plus the module-dependency graph as a markdown edge-list.
日本語の概要は準備中です。原文の説明を表示しています。
Prevents premature execution on ambiguous requests. Analyzes request clarity using 5W1H decomposition, surfaces hidden assumptions, and generates structured clarifying questions before work begins. Use at the start of any non-trivial task, or when a request could be interpreted multiple ways. Triggers on "뭘 원하는건지", "요구사항 정리", "clarify", "what exactly", "scope", "requirements", "정확히 뭘", "before we start".
日本語の概要は準備中です。原文の説明を表示しています。
Configure and manage MCP (Model Context Protocol) servers in Claude Code CLI. Use this skill when adding, removing, listing, or troubleshooting MCP servers, or when questions arise about MCP configuration, transport types, scopes, or authentication. Essential for connecting Claude Code to external tools, databases, and APIs.
日本語の概要は準備中です。原文の説明を表示しています。
List configured models, guide provider setup, verify local Kimi companion readiness, and manage the PreToolUse hook plus optional review gate. Use when asked about available models, subscription/API-key setup, default selection, or explicitly requested to install, check, enable, disable, or uninstall the integration. Codex and Claude Code share one ~/.kimi-code/config.toml but each own a host-scoped block, so $kimi-setup here does not disturb Claude Code's /kimi:setup (and vice-versa).
日本語の概要は準備中です。原文の説明を表示しています。
Designs Claude Code prompts and CC environments. Produces CLAUDE.md drafts, agent topologies, scope-authorization frameworks, halt triggers, Skills/hooks/MCP plans, chat-to-CC handoff specs, and EXECUTION_PLAN.md remediation plans. Five modes: DESIGN (new CC deployments), EVOLVE (updates from friction), RESEARCH (evaluate a CC tool/pattern), TEMPLATE (reusable artifacts), REMEDIATE (consume hygiene findings → produce + execute plan). Do NOT use REMEDIATE for direct cleanup (Cat 1–10 — use rootnode-repo-hygiene Phase 2). Do NOT use for hygiene scanning (rootnode-repo-hygiene), chat prompts (rootnode-prompt-validation), or chat Projects (rootnode-project-audit).
日本語の概要は準備中です。原文の説明を表示しています。
Independent re-derivation gate for proposed changes during autonomous execution. Evaluates a change (code diff, config edit, engine evolution, schema change) against the work's authority matrix and a 4-check protocol: invariant compliance, scope authorization, detection narrowness, and regression risk. Returns structured JSON with pass/fail per check, an overall verdict (APPROVE / REQUEST_CHANGES / REJECT), and blockers. Profile-driven thresholds (strict for unattended runs, lenient for desk supervision). Use when an autonomous agent proposes an engine change, when reviewing a Claude Code-authored modification before merge, or when an unattended profile requires independent re-derivation. Trigger on: "review/approve this proposed change," "critic-gate this," "is this change safe," "is this safe to merge," "should I let this land," "run the critic." Do NOT use for handoff-readiness checks (use rootnode-handoff-trigger-check), general code review, or design-time correctness. Authority matrix required.
日本語の概要は準備中です。原文の説明を表示しています。