190 件 ・ 関連度順
概要と使いどころ
Use when the user asks to verify a story or ticket implementation against its spec - per-AC verdicts, code reuse and design conformance, dead code, then adversarial maintainer verification. Requires the qa/review agent roles registered by scripts/install-codex.sh. Keywords: story QA, acceptance criteria, spec conformance, AC coverage, QA this branch, verify story.
日本語の概要は準備中です。原文の説明を表示しています。
Maintains repo-local action contracts and harness repositories where product CLI and MCP adapters stay thin over core libraries. Use when adopting or improving steward.yaml actions, capability-level adoption evidence, cold-start proof loops, probes, benchmarks, CLI/MCP/core parity, adapter refactors, packages/core boundaries, or sibling harness layout; use repo-quality-system-lifecycle first for general app/library/tool stewardship baselines.
日本語の概要は準備中です。原文の説明を表示しています。
Design, implement, and integrate generalized validation harnesses across a producer-consumer boundary after a local harness contract exists. Use when refactoring custom validation CLIs/MCPs for large polyrepos, extending Steward across sibling repos, or deploying a local tool to a consumer project for dogfooding and testing; use mcp-harness-repo-maintainer first for initial steward.yaml adoption and cold-start proof.
日本語の概要は準備中です。原文の説明を表示しています。
The LAW a council SEAT is bound by — deliberation protocol, pact obligations, governance, and decision-ledger recording — the discipline half of a seat. Trigger when: - Holding a seat on a bound council (architect, lead-maintainer, process-auditor, or a summoned guest). - Depositing an independent assessment, routing a decision, or recording assent or a finding. - Auditing whether the council honored the pact, the delegation table, or the barring lifecycle. - Prompt contains: /council, council seat, deliberation protocol, pact, delegation table, decision ledger, barring, merge-consent.
日本語の概要は準備中です。原文の説明を表示しています。
Typosquat and malicious-package detection across installed dependencies (or a single prospective addition) — cross-checks AI-malware family intelligence, package-name similarity to known popular packages, low maintainer-health signals. Use when auditing a freshly-onboarded repo, vetting a single suspicious package, gating CI on supply-chain risk, or investigating an incident.
日本語の概要は準備中です。原文の説明を表示しています。
Pick one open GitHub issue off this repository's queue, implement the fix, and open a pull request for it. One issue and one PR per run. Use when the user asks to burn down the issue backlog, or when the issue-burndown workflow invokes it. It never merges, never closes an issue, never edits .github/workflows/, and never acts on an issue from outside the organisation unless a maintainer has opted it in.
日本語の概要は準備中です。原文の説明を表示しています。
Apply public, contributor-safe commit hygiene without maintainer-private automation, timestamps, ledger rules, or push policy.
日本語の概要は準備中です。原文の説明を表示しています。
Create, revise, or audit AGENTS.md files from repository evidence, verified commands, and correctly scoped instructions without overwriting maintainer intent.
日本語の概要は準備中です。原文の説明を表示しています。
Review code for readability, then simplify it to be easy to follow and understand. Use this skill when the user wants to simplify code, improve readability, clean up for handoff, make code skimmable, reduce complexity, refactor for clarity, strip boilerplate, prepare code for future maintainers, or make a codebase easier to pick up. Trigger liberally — any request touching readability, simplification, cleanup, or "make this easier to understand" should use this skill. Also trigger when the user says things like "review this", "clean this up", "tidy this", "make this simpler", "reduce complexity", "flatten this", "strip the noise", or "I want to understand this code quickly next time I open it".
日本語の概要は準備中です。原文の説明を表示しています。
One-time recovery when a shared checkout has drifted far from GitHub main: hundreds ahead/behind, stacked worktrees and PRs, a dirty tree nobody owns. Use when tempted to reset or force-push. NOT for the ordinary 30-minute release loop (operations/INTEGRATION_MAINTAINER.md).
日本語の概要は準備中です。原文の説明を表示しています。
Finds open GitHub PRs with security and priority-high labels, links each to its issue, detects duplicates (multiple PRs fixing the same issue), and presents a table of review candidates. Use when looking for the next PR to review. Trigger keywords - find pr, find review, next pr, pr to review, duplicate pr, security pr.
日本語の概要は準備中です。原文の説明を表示しています。
Normalizes GitHub issue and PR titles by removing any bracketed [NemoClaw] tag case-insensitively, even when the tag appears later in the title. Use when cleaning issue tags, bulk-renaming titles, or normalizing repo title hygiene.
日本語の概要は準備中です。原文の説明を表示しています。
Performs a comprehensive security review of code changes in a GitHub PR or issue. Checks out the branch, analyzes changed files against a 9-category security checklist, and produces PASS/WARNING/FAIL verdicts. Use when reviewing pull requests for security vulnerabilities, hardcoded secrets, injection flaws, auth bypasses, or insecure configurations. Trigger keywords - security review, code review, appsec, vulnerability assessment, security audit, review PR security.
日本語の概要は準備中です。原文の説明を表示しています。
AI-assisted label triage for NVIDIA/NemoClaw issues and PRs. Reads triage-instructions.md at runtime for consistent label guidance. Supports single-item mode (give it a number) and batch mode (fetches up to 50 unlabeled open items). On approval, applies labels and an optional triage comment via gh CLI, then logs the session to the daily-rhythm activity folder. Trigger keywords - triage, label issues, suggest labels, batch triage, triage issue, triage PR, label this, what labels.
日本語の概要は準備中です。原文の説明を表示しています。
Cut a new semver release — bump all version strings via bump-version.ts, open a release PR, and after merge tag main and push. Use when cutting a release, tagging a version, shipping a build, or preparing a deployment. Trigger keywords - cut tag, release tag, new tag, cut release, tag version, ship it.
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill when implementing or refactoring code inside the nuxt-ui-tools repository itself. It routes the agent to the canonical AGENTS.md guide and the deeper maintainer skill so the agent can understand where code belongs, how domains relate, how to extend features, and what maintenance surfaces must be kept in sync.
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill for internal maintenance and feature work in the nuxt-ui-tools repository. It explains the repository operating model, exact placement rules, how runtime domains relate, how features should be structured and extended, how consumer skills must be maintained, and what to keep in sync when changing the library.
日本語の概要は準備中です。原文の説明を表示しています。
Use when: User wants to extend Docker with custom tools, personalize the Docker environment, or set up user-specific Docker customization. Triggers: 'extend docker', 'docker-extend', 'add tools to docker', 'customize docker', 'add my tools to the container', 'personalize docker setup', 'docker user setup', 'install tools in docker'. Does: Interactively sets up Dockerfile.user and docker-compose.override.yml so users can add personal tools to their Docker environment without affecting maintainer files or committing user-specific config to git.
日本語の概要は準備中です。原文の説明を表示しています。
Architecture Decision Records (ADR) — a lightweight method for capturing important architectural decisions with context, trade-offs, and rationale. Based on Michael Nygard's ADR pattern and Google/Meta/ByteDance's design documentation culture. USE WHEN: deciding between technology choices, designing new architecture, changing existing architecture, documenting why a decision was made, onboarding new team members, or preserving design context for future maintainers. Triggered by terms like "tech choice", "architecture decision", "why did we choose", "design rationale", "ADR", or "architectural decision record".
日本語の概要は準備中です。原文の説明を表示しています。
Comprehensive offensive methodology for software supply chain attacks covering the full kill chain from reconnaissance through exploitation. Addresses dependency confusion across npm, PyPI, and NuGet ecosystems where internal registry override allows an attacker to inject malicious packages that shadow private dependencies. Covers typosquatting techniques for popular packages, compromised package injection via maintainer account takeover or social engineering, and build system attacks through Makefile injection, setup.py install hooks, and npm postinstall scripts. Extends into CI/CD artifact tampering where build outputs are replaced or modified in transit, code signing abuse through stolen or self-signed certificates, upstream repository compromise via commit injection or force-push to trusted repos, and container image supply chain attacks including base image trojaning and registry confusion. Maps to MITRE ATT&CK T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools...
日本語の概要は準備中です。原文の説明を表示しています。
Cross-cutting methodology for the CVE-hunting pipeline (ported from find-cve-agent): when a bug is design-vs-real, false-positive avoidance, version checking before reporting, responsible disclosure norms, acceptance-rate expectations per vuln class, vulnerability chaining playbook, known false-positive patterns, maintainer-response patterns, secure-pattern reference (what NOT to flag), and a self-criticism checklist to run before claiming a finding. Use this alongside the cve-hunter/cve-exploiter/cve-validator agents and the /cve-hunt pipeline — load it whenever judging if a finding is real, worth reporting, or already fixed.
日本語の概要は準備中です。原文の説明を表示しています。
Design a normalized, machine-readable "work receipt" that answers what changed, why, by whom, and with what validation, for any AI-coding-agent task regardless of backend (Claude Code, Codex, Cursor, Aider, CI, or homegrown). Use when defining a receipt schema, normalizing heterogeneous agent logs into one evidence shape, gating PR merges on artifact-backed proof, or designing an OSS maintainer's fast-reject/fast-merge workflow. NOT for validating a DAG node's output against its own schema (use output-contract-enforcer), continuous runtime monitoring of a live coordination daemon (use runtime-verification-for-agents), or general Port Daddy claims/notes/salvage mechanics (use port-daddy-agent-skill).
日本語の概要は準備中です。原文の説明を表示しています。