「supply」の検索結果

サプライチェーン最適化コンサルティングスキル。需要予測、在庫最適化、調達戦略、 物流ネットワーク設計、S&OP(Sales and Operations Planning)を支援。 Use when optimizing supply chain operations, improving inventory management, designing logistics networks, or conducting supply chain risk assessments. Triggers: "supply chain", "在庫最適化", "inventory optimization", "demand forecasting", "S&OP", "procurement strategy", "logistics network".

Comprehensive offensive methodology for software supply chain attacks covering the full kill chain from reconnaissance through exploitation. Addresses dependency confusion across npm, PyPI, and NuGet ecosystems where internal registry override allows an attacker to inject malicious packages that shadow private dependencies. Covers typosquatting techniques for popular packages, compromised package injection via maintainer account takeover or social engineering, and build system attacks through Makefile injection, setup.py install hooks, and npm postinstall scripts. Extends into CI/CD artifact tampering where build outputs are replaced or modified in transit, code signing abuse through stolen or self-signed certificates, upstream repository compromise via commit injection or force-push to trusted repos, and container image supply chain attacks including base image trojaning and registry confusion. Maps to MITRE ATT&CK T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools) and T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Integrates tooling such as confused for dependency confusion scanning and dependency-check for known vulnerable component detection. Each technique section provides reproducible proof-of-concept patterns, detection guidance for defenders, and engagement-safe execution notes for authorized red team operations.

日本語の概要は準備中です。原文の説明を表示しています。

"Analyze supply chain operations using the SCOR model across Plan, Source, Make, Deliver, and Return processes. Use this skill when the user needs to optimize supply chain efficiency, evaluate supplier performance, improve logistics, or design an end-to-end supply chain strategy — even if they say 'our deliveries are slow', 'supply chain costs are too high', or 'we keep running out of stock'.".

日本語の概要は準備中です。原文の説明を表示しています。

Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API. Builds dependency graphs, calculates risk scores, identifies transitive vulnerability paths, and generates compliance reports. Activates for requests involving SBOM analysis, software composition analysis, supply chain security assessment, dependency vulnerability scanning, CycloneDX/SPDX parsing, or CVE correlation.

日本語の概要は準備中です。原文の説明を表示しています。

供应链与生产运营 (供应链与生产运营 (Supply Chain & Production Operations) — 面向制造业与消费品实体供应链的『计划-制造-交付』运营判断,不是采购谈价技巧,也不是跨境电商发货物流。覆盖: (a) 第一性张力 — 这行的核心世界观分歧: **流动 > 局部效率(用有效产出/流动时间看系统,而不是用设备利用率/人均产出看工位;非瓶颈上的效率是幻觉) ⇄ 精益拉动 vs 推式预测(TPS/JIT 按下游消耗拉动、小批量平准化 vs MRP 按预测展开净需求推动;DDMRP 解耦缓冲是第三条路) ⇄ 精益/丰田 TPS 派 vs 约束理论 TOC 派(消除七大浪费、全局改善 vs 五步聚焦瓶颈、鼓-缓冲-绳 DBR 排产;两派互相指责对方浪费时间/只治标) ⇄ 变异是敌人(Deming/六西格玛/Factory Physics 的 VUT 排队论: 利用率越靠近满载排队时间越爆炸,交期长不是产能不够而是变异+高负荷) ⇄ 库存是负债 vs 库存是缓冲(会计把库存记成资产、精益视其为掩盖问题的水位、TOC 与韧性派视其为吸收变异的必要缓冲;真问题是缓冲放在哪一层而不是有没有) ⇄ 精益 JIT vs 韧性冗余(2020-2023 断链后 just-in-case、多源、近岸/友岸的回摆;精益派反驳崩的是『假精益』——单一来源+砍库存不砍变异) ⇄ 服务水平 vs 库存成本(安全库存/报童模型/ABC-XYZ 的经典取舍,牛鞭效应放大上游波动) ⇄ 成本导向压价 vs 供应商共生开发(Kraljic 分级、丰田供应商协会式长期共生 vs 年降指标与竞价) ⇄ 一个数 vs 各部门各算各的(S&OP/IBP 的本质是跨职能对齐到一套数字与一份产销计划))**; (b) 工具栈(此行的工具是『系统+方法』的混合) — ERP/MRP(SAP S/4HANA PP·MM、Oracle、用友·金蝶、Odoo、NetSuite)、APS 高级计划排程(Kinaxis RapidResponse、o9、Blue Yonder、SAP IBP、OMP、Siemens Opcenter APS)、MES/车间执行(Siemens Opcenter、Rockwell FactoryTalk、黑湖智造)、WMS/TMS、需求预测(统计模型 + Nixtla StatsForecast/Prophet、FVA 预测增值分析)、运筹优化与仿真(OR-Tools、Gurobi、Pyomo、AnyLogic、FlexSim、SimPy)、供应链风险与多级可视(Resilinc、Everstream、Interos)、分析层(SQL/Python pandas/Power BI)、以及纸笔工具(价值流图 VSM、A3、看板、标准作业票)—— 选型决策树的关键分岔是 MTS/MTO/ATO/ETO 履行模式与需求变异度,而非厂商功能清单; (c) 心智模型层 — 利特尔法则(在制品 = 产出率 × 流动时间)、瓶颈与非瓶颈、缓冲三态(库存/时间/产能缓冲)、解耦点(客户订单渗透点 CODP)、牛鞭效应、takt time 节拍与产线平衡、OEE 与六大损失、muda·mura·muri 三种浪费、自働化 jidoka 与安灯、防错 poka-yoke、SMED 快速换模换出小批量、平准化 heijunka、PDCA 与丰田改善型 Toyota Kata、DMAIC 与 Cpk 过程能力、报童模型与安全库存公式、ABC-XYZ 分级; (d) 工作流/SOP — 跑一轮月度 S&OP(需求评审→供应评审→预 S&OP→执行 S&OP)、做需求预测与预测误差复盘(MAPE/WMAPE/bias/FVA)、设定库存分级与安全库存、MRP 跑批与例外消息处理(缺料齐套与 MRP 神经质)、瓶颈识别与 DBR 排产、价值流图现状图→未来图→改善计划、新品导入 NPI 与多级 BOM/ECN 工程变更、供应商选择与开发(RFQ→审厂→APQP/PPAP→量产→年度绩效)、断料应急与交期承诺(ATP/CTP)、循环盘点与库存准确率; (e) 知识正典(en/ja 一手极厚,中译齐全) — 《目标 The Goal》Goldratt(TOC 小说体奠基)、《丰田生产方式》大野耐一、《改变世界的机器》Womack·Jones·Roos(MIT IMVP 研究)、《精益思想 Lean Thinking》Womack & Jones、《丰田模式 The Toyota Way》Liker、《工厂物理学 Factory Physics》Hopp & Spearman(排队论视角的运营科学)、《学习观察 Learning to See》Rother & Shook(VSM)、《丰田套路 Toyota Kata》Rother、Spear & Bowen 的 HBR 1999《Decoding the DNA of the Toyota Production System》、Lee/Padmanabhan/Whang 1997《The Bullwhip Effect in Supply Chains》、Ptak & Smith 的 DDMRP、Orlicky 的 MRP、Chopra & Meindl 的供应链管理教材、Deming《转危为安 Out of the Crisis》、Sheffi《The Resilient Enterprise》、ASCM/APICS 的 SCOR 参考模型与 CPIM/CSCP 知识体系; (f) 行业大佬/figures — 大野耐一(TPS 立法者)、新乡重夫(SMED/防错)、Eliyahu Goldratt(TOC 创立者)、W. Edwards Deming(变异与系统观)、James Womack & Daniel Jones(把 TPS 译成西方可学的『精益』)、Jeffrey Liker(丰田模式学术化)、Mike Rother(VSM 与改善型)、Wallace Hopp & Mark Spearman(工厂物理学)、Hau Lee(斯坦福,牛鞭效应与 Triple-A 供应链)、Yossi Sheffi(MIT,韧性)、Carol Ptak & Chad Smith(DDMRP)、David Simchi-Levi(MIT,风险敞口指数)、Steven Spear(TPS 的 DNA)、以及中文圈的供应链实务作者(刘宝红等); (g) 争议/批判(必须保留不洗白) — JIT 是不是 2021 全球断链的元凶(精益派反驳:崩的是单一来源+砍库存不砍变异的『假精益』);西方学精益的高失败率(只搬工具不搬思维,精益在很多工厂沦为裁员的代号);六西格玛黑带官僚化与扼杀创新之争;TOC 派与精益派互相攻击(Goldratt 讽刺精益是等浪费自己浮现);预测无用论(需求驱动派说预测必然错、要靠缓冲吸收)vs 统计预测派;控制塔/数字孪生/AI 预测的过度承诺与高项目失败率;中国制造的年降与内卷式压价 vs 供应商共生;近岸·友岸外包是真实产能转移还是政治叙事; (h) 流派/思想谱系 — **精益/TPS 派(丰田血统:大野-新乡→Womack/Jones/Liker/Rother,信全局消除浪费与人的改善能力)** vs **约束理论 TOC 派(Goldratt:系统产出只由瓶颈决定,聚焦五步、DBR、缓冲管理)** vs **统计质量/六西格玛派(Deming-Juran-Shewhart→GE/Motorola,信减少变异与过程能力)** vs **运营科学/工厂物理学派(Hopp & Spearman:用排队论与数学定律解释,认为精益与 TOC 都是特例)** vs **需求驱动/DDMRP 派(Ptak & Smith:预测不可靠,靠战略解耦缓冲)** vs **韧性/风险派(Sheffi、Simchi-Levi:效率之外必须为断链设计)**。不含: 跨境电商卖家的发货与头程物流(已由 cross-border-ecommerce 覆盖)、纯采购的商务谈判技巧、企业级 ERP 的代码实施与二次开发、通用项目管理。) Master OS — automated mastery of 供应链与生产运营 (Supply Chain & Production Operations) — 面向制造业与消费品实体供应链的『计划-制造-交付』运营判断,不是采购谈价技巧,也不是跨境电商发货物流。覆盖: (a) 第一性张力 — 这行的核心世界观分歧: **流动 > 局部效率(用有效产出/流动时间看系统,而不是用设备利用率/人均产出看工位;非瓶颈上的效率是幻觉) ⇄ 精益拉动 vs 推式预测(TPS/JIT 按下游消耗拉动、小批量平准化 vs MRP 按预测展开净需求推动;DDMRP 解耦缓冲是第三条路) ⇄ 精益/丰田 TPS 派 vs 约束理论 TOC 派(消除七大浪费、全局改善 vs 五步聚焦瓶颈、鼓-缓冲-绳 DBR 排产;两派互相指责对方浪费时间/只治标) ⇄ 变异是敌人(Deming/六西格玛/Factory Physics 的 VUT 排队论: 利用率越靠近满载排队时间越爆炸,交期长不是产能不够而是变异+高负荷) ⇄ 库存是负债 vs 库存是缓冲(会计把库存记成资产、精益视其为掩盖问题的水位、TOC 与韧性派视其为吸收变异的必要缓冲;真问题是缓冲放在哪一层而不是有没有) ⇄ 精益 JIT vs 韧性冗余(2020-2023 断链后

日本語の概要は準備中です。原文の説明を表示しています。

Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API. Builds dependency graphs, calculates risk scores, identifies transitive vulnerability paths, and generates compliance reports. Activates for requests involving SBOM analysis, software composition analysis, supply chain security assessment, dependency vulnerability scanning, CycloneDX/SPDX parsing, or CVE correlation.

日本語の概要は準備中です。原文の説明を表示しています。

Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API. Builds dependency graphs, calculates risk scores, identifies transitive vulnerability paths, and generates compliance reports. Activates for requests involving SBOM analysis, software composition analysis, supply chain security assessment, dependency vulnerability scanning, CycloneDX/SPDX parsing, or CVE correlation.

日本語の概要は準備中です。原文の説明を表示しています。

When the user wants to optimize aerospace and defense supply chains, manage long lead-time components, handle MRO operations, or ensure AS9100 compliance. Also use when the user mentions "aerospace supply chain," "aviation manufacturing," "MRO supply chain," "AS9100," "aircraft parts," "defense procurement," "AOG support," "airworthiness," "ITAR compliance," "aerospace certification," or "aviation aftermarket." For general manufacturing, see production-scheduling. For quality, see quality-management.

日本語の概要は準備中です。原文の説明を表示しています。

Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API. Builds dependency graphs, calculates risk scores, identifies transitive vulnerability paths, and generates compliance reports. Activates for requests involving SBOM analysis, software composition analysis, supply chain security assessment, dependency vulnerability scanning, CycloneDX/SPDX parsing, or CVE correlation.

日本語の概要は準備中です。原文の説明を表示しています。

Comprehensive offensive methodology for software supply chain attacks covering the full kill chain from reconnaissance through exploitation. Addresses dependency confusion across npm, PyPI, and NuGet ecosystems where internal registry override allows an attacker to inject malicious packages that shadow private dependencies. Covers typosquatting techniques for popular packages, compromised package injection via maintainer account takeover or social engineering, and build system attacks through Makefile injection, setup.py install hooks, and npm postinstall scripts. Extends into CI/CD artifact tampering where build outputs are replaced or modified in transit, code signing abuse through stolen or self-signed certificates, upstream repository compromise via commit injection or force-push to trusted repos, and container image supply chain attacks including base image trojaning and registry confusion. Maps to MITRE ATT&CK T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools...

日本語の概要は準備中です。原文の説明を表示しています。

Verify supply chain integrity for AI agent plugins, tools, and dependencies. Use this skill when: - Generating SHA-256 integrity manifests for agent plugins or tool packages - Verifying that installed plugins match their published manifests - Detecting tampered, modified, or untracked files in agent tool directories - Auditing dependency pinning and version policies for agent components - Building provenance chains for agent plugin promotion (dev → staging → production) - Any request like "verify plugin integrity", "generate manifest", "check supply chain", or "sign this plugin"

日本語の概要は準備中です。原文の説明を表示しています。

Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated audit. Use when hardening CI/CD pipelines or investigating compromised build systems.

日本語の概要は準備中です。原文の説明を表示しています。

Identify poisoned training data and backdoored ML models across the pipeline using IBM's Adversarial Robustness Toolbox (activation clustering, spectral signatures, trigger reconstruction), Cleanlab for label-quality issues, and supply-chain checks like weight-hash verification and safetensors enforcement. Use before training or deploying on third-party/user-contributed data or downloaded checkpoints, during ML supply-chain reviews, or when investigating model misbehavior tied to specific inputs (suspected backdoor trigger).

日本語の概要は準備中です。原文の説明を表示しています。

Investigate supply chain attack artifacts including trojanized software updates, compromised build pipelines, and sideloaded dependencies to identify intrusion vectors and scope of compromise.

日本語の概要は準備中です。原文の説明を表示しています。

Audits a project's dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned or archived upstreams, npm publisher concentration, and install-time script execution. Use when asked to audit dependencies, assess supply-chain or third-party package risk, or review a dependency tree before an engagement.

日本語の概要は準備中です。原文の説明を表示しています。

Comprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script console remote code execution, Java remoting deserialization, credential store dumping, shared library injection), GitLab CI exploitation (YAML anchor injection, runner registration token abuse, CI variable extraction, protected branch bypass via merge request pipelines), and Azure DevOps pipeline agent compromise with service connection theft. Includes artifact poisoning techniques across all platforms, tooling guidance for gato and jenkins-attack-framework, and maps to MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Covers enumeration of pipeline configurations, privilege escalation from contributor to code execution, lateral movement through pipeline trust boundaries, and persistence via modified workflow definitions. Each technique section provides working exploitation code, detection indicators, and defensive countermeasures.

日本語の概要は準備中です。原文の説明を表示しています。

Manages the flow of goods and inputs — sourcing, inventory, lead times, fulfillment, and supply risk. Use this to reduce stockouts or excess inventory, plan for a supplier failure, decide reorder points and safety stock, improve fulfillment reliability, or assess concentration risk in a supply base.

日本語の概要は準備中です。原文の説明を表示しています。

Software supply chain security — SBOM generation and analysis, dependency confusion and typosquatting detection, malicious package indicators, CI/CD pipeline hardening, and artifact provenance/signing (SLSA, Sigstore)

日本語の概要は準備中です。原文の説明を表示しています。

Audits dependency supply chains for bad versions, lockfile drift, and artifact integrity. Use when adding deps, handling incidents, or releasing a plugin.

日本語の概要は準備中です。原文の説明を表示しています。

Detect known malicious npm package versions and install-time supply-chain indicators in repositories, lockfiles, and node_modules. Use when a user mentions an npm compromise, Shai-Hulud, the Keyv/cacheable incident, suspicious preinstall scripts, credential-stealing packages, or asks whether a JavaScript project was exposed to a package supply-chain attack. Do not use as a general CVE or license audit.

日本語の概要は準備中です。原文の説明を表示しています。

Supply chain mapping, supplier dependency analysis, customer concentration, geographic concentration, bottleneck identification, supply chain risk, logistics network, sourcing strategy, inventory management, vertical integration analysis

日本語の概要は準備中です。原文の説明を表示しています。

Nexscope overview analysis of Amazon keyword market competition. Trigger when the user mentions keyword competition, supply-demand ratio, competitor count, keyword search volume estimation, market competitiveness assessment, keyword popularity ranking, ad competition analysis, number of products under a keyword, keyword competition, supply-demand ratio, competitor count, search popularity, market competition analysis, Nexscope, keyword overview. Even if the user does not explicitly say "Nexscope", if their need involves assessing keyword-level competition intensity, supply-demand balance, or search result product count on Amazon, this skill should also be triggered.

日本語の概要は準備中です。原文の説明を表示しています。

Assesses critical mineral investments with supply chain mapping, geopolitical risk, and processing infrastructure analysis. Use when evaluating critical minerals, analyzing lithium/cobalt supply, or assessing rare earth investments.

日本語の概要は準備中です。原文の説明を表示しています。

"Apply supply and demand analysis to explain price determination, market equilibrium, and the effects of policy interventions. Use this skill when the user needs to analyze how prices are set in a market, predict the effect of taxes/subsidies/price controls, or understand shifts in supply or demand curves — even if they say 'why did the price go up', 'what happens if the government sets a price cap', or 'how does a tariff affect the market'.".

日本語の概要は準備中です。原文の説明を表示しています。