「only」の検索結果

Unified pull request workflow: prepare a safe branch, run read-only review, fix Required findings, create/update a GitHub draft PR, and verify CI plus automated review comments. Subcommands: `create` (simplify + PR, skip code review), `review` (read-only findings only), `fix` (Required fixes + commit, no push), `simplify` (simplification only), `verify` (existing PR checks/reviews only). Use when creating or reviewing PRs, self-reviewing changes, simplifying PR changes, or requesting "PR作成", "レビュー", "簡素化". Do NOT use for responding to review comments or a lightweight review of the current working diff without the PR workflow (use the built-in /code-review instead).

You are a member of a Commonly workspace — a shared space where humans and AI agents from any origin collaborate in pods (chat rooms with memory). Use this whenever you are connected to Commonly via the commonly_* MCP tools: to read what's happening, post, remember things across sessions, react, DM other agents, and work the task board. Load it the moment you see any commonly_* tool available.

日本語の概要は準備中です。原文の説明を表示しています。

Translate and dub a video into another language with voice cloning and lip-sync, powered by HeyGen Video Translation. The presenter keeps their face, their voice is cloned into the target language, and lips re-sync to the new audio — viewers see the same person speaking natively. Use when: (1) localizing an existing video into one or more languages ("translate this video to Spanish", "make this in French and German", "dub this into Japanese", "I need this in 10 languages for a launch"), (2) the user has a finished video and wants the SAME presenter speaking another language (not a new presenter — that's heygen-video), (3) podcast / audio-only translation ("translate this podcast", "dub the audio but keep my video"), (4) high-stakes translations where the user wants to review/edit subtitles before final render (the proofreads workflow), (5) "translate my video", "dub this", "localize this clip", "make a multilingual version", "subtitle and dub". Returns the translated video URL (or audio file for audio-only mode), one per target language. Chain signal: if the user wants to CREATE a new video in another language (no source video exists yet), route to heygen-video and write the script in the target language — do not use heygen-translate. Use heygen-translate only when there is an existing source video to localize. NOT for: creating new videos from scratch (use heygen-video), avatar creation (use heygen-avatar), TTS-only synthesis (use heygen-video with audio-only output), or text-only translation.

日本語の概要は準備中です。原文の説明を表示しています。

Deliver a runnable local browser app so the user can operate it on the first handoff. This delivery skill does not choose whether a requested local system should be a browser app. On a current turn that explicitly says to implement a brand-new browser project now, load bundled:greenfield-project-scaffolding before project work only after no-peek or permitted top-level placement facts prove that no named or suitable current-folder target resolves the root; never hand off from planning or answer-only turns, existing work, a named or suitable target, or standalone or single-file delivery. Resolve user-blocking product or interface choices with an available interaction surface; resolving those choices alone never authorizes implementation. Always call read_skill for bundled:browser-app-delivery before creating or materially changing a local browser app that owns its start path or a playable browser game. Also load it when the user requests a paste-ready, single-file, offline, or immediately playable browser artifact, even if no local start path should remain, unless the user says they will open or check it themselves or explicitly declines verification. On completed local-server delivery, include exact start commands, a concrete local URL, and explicit browser-open wording. On completed standalone delivery, hand off the exact artifact path or paste URL and smoke result without inventing a server. Do not load it for a self-contained static file that has no owned start path if the user either says they will open or check it themselves or explicitly declines verification. Do not load it for component/style-only edits, deployed sites, backend/API-only work, browser QA, review, explanation, plan-only, or explicit stop/no-tool turns.

日本語の概要は準備中です。原文の説明を表示しています。

Org-grade attack-surface mapping: given a company's legal identity, discover its ENTIRE owned internet footprint — corporate family -> owned domains -> owned netblocks/ASN -> live assets — with attribution discipline, not just DNS breadth. The org-first attribution pyramid (legal entity -> LEI/registration -> corporate family -> owned domains -> owned netblocks/ASN -> live assets). Corporate-identity resolution via the GLEIF LEI API (legal name -> LEI, exact-LEI direct-children expansion, downward-only depth-capped BFS, NEVER a name re-resolution), SEC-EDGAR full-text search + Exhibit-21 subsidiary entity names, OpenCorporates entity corroboration, Wikidata SPARQL corporate graph (P856/P355/P749/P1830). Domain attribution via reverse-WHOIS (WhoisXML preview-then-purchase quota guard, SecurityTrails associated-domains — both paid), crt.sh O= certificate-transparency organization pivot (keyless), infrastructure correlation (shared NS/MX/SaaS-TXT, netblock membership, reverse-DNS PTR), and the independent-evidence combiner (1-prod(1-w_i), rule of three, OwnerTier NONE/WEAK/MODERATE/STRONG/CONFIRMED) — discover-only `related:` candidates are NEVER auto-scanned. Netblock/ASN attribution via org-first RIR queries (ARIN Whois-RWS org-handle search, RIPE DB organisation + inverse-org search) that recover 'dark netblocks' with no DNS link to the seed, ASN discovery (RIPEstat + BGPView union), the HYPERSCALER-SCOPE GUARD (never attribute a whole AWS/GCP/Azure/Cloudflare announced range to a tenant — keep only the seed-containing block, tag shared_hosting_cdn), and org-identity-seeded internet-scan-index queries (Shodan/Censys/ZoomEye/FOFA/BinaryEdge org: filters + an always-on keyless crt.sh fallback). Promote-to-scan triage ranks forgotten discover-only netblocks by remote-access exposure (gateway-vendor/KEV/control-plane/datastore port scoring) into an operator queue. Attribution confidence rubric + anti-patterns (namesake grafting via GLEIF name re-resolution, single-signal ownership, hyperscaler over-attribution, privacy-WHOIS pivot poisoning, RIR org-name collisions). Passive/keyless-first OSINT only — every paid-key dependency is enrichment on top of a keyless core, never a hard requirement. Use when mapping an organization's full corporate-family internet footprint, resolving a legal entity to its LEI/subsidiaries, discovering domains/netblocks/ASNs an org owns beyond its one seed domain, auditing M&A/shadow-IT sprawl, or scoping an engagement that starts from a company NAME rather than a domain.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when producing a polished, Commonly-branded deliverable (.docx brief / memo, .xlsx data matrix, .pptx deck) and you do not have specific brand guidance from the user. Trigger on: 'write me a brief', 'one-pager', 'memo', 'data sheet', 'status matrix', 'short deck', 'summary deck', 'closing slide', 'final deliverable'. Routes to `officecli merge` with one of three pre-built starter templates that already carry the Commonly palette, fonts, and structure — so you populate content with one merge call instead of 30 individual `officecli set` commands. DO NOT use for fundraising decks (use `officecli-pitch-deck`), academic papers (use `officecli-academic-paper`), or financial models (use `officecli-financial-model`).

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when handling secrets, API keys, environment variables, or ensuring server-only code never reaches the client bundle. Trigger words: シークレット, 秘密鍵, API キー, 環境変数, env, server-only, クライアント漏洩, NEXT_PUBLIC, バンドル.

Repository または subsystem を対象に、source-only で明示的なセキュリティ監査を行う entry skill。 通常の PR セキュリティレビューとは分離し、reconnaissance、scope 固定、既存 security skill への委譲、 evidence と unresolved hypothesis、observe-only SecurityAuditCoverage、coverage critic、 structured audit artifact と repeat-run coverage を扱う。target-controlled code は実行しない。

顧客や取引先が参加するチャットで、エージェントの応答条件と送信内容を定めるスキル。呼びかけへの応答、内部情報の保護、承認用の下書きへの切り分けを扱います。

• 顧客グループでの応答ルール設定
• 取引先への返信から内部情報を守りたいとき
• 価格や契約の回答を承認用下書きに分ける

Port an existing Remotion (React) composition to HyperFrames HTML. Use ONLY when the user explicitly asks to port/convert/migrate/translate a Remotion source. Do NOT use: (a) authoring a new HyperFrames composition; (b) Remotion mentioned in passing; (c) Remotion code shared as reference only; (d) "same video as my Remotion one" without explicit migrate request — treat as fresh build. Doubt → `/general-video`. One-way, Remotion-only: no reverse export (HyperFrames→Remotion or any framework), no non-Remotion source (After Effects, Framer Motion, plain React/CSS) → out of scope, re-create via `/general-video`. Flags unsupported patterns (useState, useEffect, async calculateMetadata, third-party React libs, `@remotion/lambda`) and recommends runtime interop over lossy translation. Unsure whether to port vs. build fresh, or only a passing Remotion mention? → /hyperframes.

日本語の概要は準備中です。原文の説明を表示しています。

Set up read-only PostgreSQL access for agents. Use only when the user explicitly invokes /create-readonly-db-role.

日本語の概要は準備中です。原文の説明を表示しています。

Recommend the right trading workflow, skillset, API profile, and setup path from a natural-language goal. Use this as the on-ramp when a user expresses a trading or investing goal and needs to know which skill/workflow to use, where to start, or whether something works without paid API keys — e.g. "where do I start", "which skill should I use", "I want to swing trade only when the market is favorable", "what works without API keys", "どれを使えばいい", "API キー無しで 使えるものは". Routes and explains only; it never executes trades or auto-runs other skills, and it is honest when no workflow has shipped yet.

Use when the user is launching or running a DROPSHIPPING business end to end — the full 12-phase pipeline: product research with winning criteria, Minea and PiPiAds, supplier sourcing on AliExpress, CJ, Spocket, and Zendrop, Shopify store and app setup, the 10-ads-per-week creative pipeline, interest and lookalike targeting, 3-5x markup and BE-ROAS math, customer service, and scaling. Trigger on 'start dropshipping', 'winning product research', 'Shopify store setup', 'AliExpress supplier', 'scale my dropshipping store', 'my store gets traffic and no sales'. Not for — only the ad copy, see `05-ad-copy-global`; only the product page, see `12-landing-page-brief-global`; only the account audit, see `21-ads-audit-global`; only pricing, see `17-pricing-strategy-global`.

日本語の概要は準備中です。原文の説明を表示しています。

Weekdays, heavy browser lane. Captures the dated raw material tomorrow's drafts are built from, out of the member's own shipped work, their own site and changelog, their own signed in saved searches, and the places their audience already is. Every line carries a source URL read this run, a date, a verbatim quote, and an expiry. It invents nothing, it is read only everywhere and totally read only on LinkedIn, and it sends only where you released the channel, spends only where you released it, and never touches a credential.

日本語の概要は準備中です。原文の説明を表示しています。

Weekly on a Wednesday, light browser lane. Turns the questions that keep coming back into the answer that only has to be written once. It reads the ticket ledger over the recurrence window, finds every theme that crossed its threshold, checks the member's own help center and the existing macros for an answer that already covers it, and writes a reusable macro and a help article draft for every theme that has neither. It publishes only where you released the channel an article, never edits a live help center page, sends only where you released the channel, spends only where you released it, and never touches a credential.

日本語の概要は準備中です。原文の説明を表示しています。

Weekdays, heavy browser lane. Opens the member's own signed in profile, post, and notification surfaces for every platform in the channel plan, confirms that everything published since the last run is genuinely live, reads the counts attached to each post, captures every comment, mention, quote, reply, and inbound message into a queue the member answers by hand, and drafts a suggested reply for each one. Read only everywhere and totally read only on LinkedIn. It sends only where you released the channel, never replies, spends only where you released it, and never touches a credential.

日本語の概要は準備中です。原文の説明を表示しています。

Weekdays, browser only when the card needs one. Takes the next ready cards off the launch board and does the work each one names: stages copy into the dashboard, fills a directory or press form and leaves it open in its tab, verifies a setup, packages a handoff, or researches its own next targets. It ticks its own card the moment it has verified the file that closes it. It submits only where you released the channel, sends only where you released the channel, spends only where you released it, and never touches a credential.

日本語の概要は準備中です。原文の説明を表示しています。

Weekdays, file work only, no browser at all. Walks every AI Employee installed on this machine, reads each one's own run log strictly read only, classifies every routine as running, stopped loudly, stopped silently, or paused, ages the faults, folds the decision register, and writes the one short brief the member opens first. It never writes into another Employee's folder, sends only where you released the channel, spends only where you released it, and never touches a credential.

日本語の概要は準備中です。原文の説明を表示しています。

Weekdays, file work only, no browser at all. Takes the single highest ranked open fault on the fleet and turns it into something the member can act on in a minute: the fault in one sentence, the first record that shows it, what changed around that date, three ranked causes each with its evidence line, what the failure has cost, and one paste ready correction line with the exact path it belongs in. It reads other Employees strictly read only, writes nothing outside its own folder, sends only where you released the channel, spends only where you released it, and never touches a credential.

日本語の概要は準備中です。原文の説明を表示しています。

Weekly, conditional browser lane, read only everywhere. Scores the fleet and the business for the week with a source beside every single number and no number anywhere without one, cites the Employee that owns a metric rather than recomputing it, refuses a rate below the floor, and writes one capped weekly page. It opens a browser only where the metric map names a live screen, never writes into another Employee's folder, sends only where you released the channel, spends only where you released it, and never touches a credential.

日本語の概要は準備中です。原文の説明を表示しています。

Family-G proof & derivation integrity forensics: does a THIRD PARTY's written proof/derivation actually establish its theorem, or does it skip an obligation, assume its own conclusion, take an invalid step, drift a symbol's meaning, or smuggle an unstated assumption? Decides from the WRITTEN proof/derivation — verdict-bearing at L1 (the LaTeX source; PDF-extracted math is unreliable, so an L0 PDF-only run surfaces info only) — never asserts 'fabricated', only that the step shown does not hold. A fresh cross-model reviewer reads the theorem/proof + an extraction-only obligation scaffold and proposes per-obligation findings, each span-anchored to the evidence ledger (claims.json); reviewer≠adjudicator. Emits proof-derivation-forensics.findings.json; NEVER computes the verdict. dimension=proof, can be critical. Triggers: "proof forensics", "check this proof", "derivation integrity", "audit the math", "证明审计", "推导有没有漏洞".

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need to classify an IP as internet scanner noise vs. targeted activity. Returns noise/riot flags, classification (benign/malicious/unknown), actor name if known. IP-only. Commonly invoked by /ip-investigation to filter out mass-scanning noise. Retrieval only.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need abuse-report history for an IPv4/IPv6 address — confidence score, total reports, distinct reporters, usage type. IP-only. Commonly invoked by /ip-investigation. Retrieval only.

日本語の概要は準備中です。原文の説明を表示しています。

Use when setting up or auditing a dedicated Salesforce integration user — Salesforce Integration user license, API-only profile, permission set layering, MFA waiver, and login monitoring. NOT for creating human users, roles, or login hours — use admin/user-management. NOT for login IP ranges, session lifetime, or OAuth client-credential hardening — use security/api-only-user-hardening. Trigger keywords: service account, API-only user, run-as user, client credentials execution user, LoginHistory, REQUEST_LIMIT_EXCEEDED, integration login failure.

日本語の概要は準備中です。原文の説明を表示しています。