测试与安全技能

Architect a feature with the Carmack Council before writing code. Use when explicitly asked to plan a feature, do a "council plan", "carmack plan", or invoke /council-plan. Carmack's philosophy chairs a council of domain experts — Troy Hunt (security), Martin Fowler (refactoring), Kent C. Dodds (frontend), Matteo Collina (Node.js), Brandur Leach (Postgres), Vercel Performance, Simon Willison (LLM pipeline), Karri Saarinen (UI quality), Vitaly Friedman (UX quality). Interactive feature discovery followed by parallel subagent dispatch. Produces a sequenced, attributed implementation plan with no code. Stack: Next.js App Router / React / TypeScript / tRPC / Prisma / Neon / Clerk.

中文简介正在准备中。当前显示原文说明。

Perform a rigorous Carmack Council code review. Use when explicitly asked to review code, do a "council review", "carmack review", or invoke /council-review. Carmack's philosophy chairs a council of domain experts — Troy Hunt (security), Martin Fowler (refactoring), Kent C. Dodds (frontend), Matteo Collina (Node.js), Brandur Leach (Postgres), Vercel Performance, Simon Willison (LLM pipelines), Karri Saarinen (UI quality), Vitaly Friedman (UX quality), Kent Beck (test quality). Uses parallel subagents for deep, independent review. Produces prioritised P1/P2/P3 findings. Stack: Next.js App Router / React / TypeScript / tRPC / Prisma / Neon / Clerk.

中文简介正在准备中。当前显示原文说明。

Use this skill when the implementation status column of a statement of applicability may not match reality, and the team asks "is our SoA accurate", "check the implemented column", "do we have evidence for every implemented control", "reconcile the SoA with our evidence", "pre-audit evidence check" or "the auditor found a control marked implemented with no records". Samples the records behind every control marked implemented, grades the evidence, proposes a corrected status for each row and writes a reconciliation table plus an evidence gap list with owners.

中文简介正在准备中。当前显示原文说明。

Use this skill when a statement of applicability already exists and the team wants its exclusions to survive the audit, and asks "review our SoA exclusions", "is this a valid justification", "can we exclude physical security if we are fully remote", "the auditor challenged our not applicable controls", "rewrite our exclusion justifications" or "we outsource it, so it does not apply, right". Tests every excluded control against scope, assets, activities, suppliers, risks and commitments, gives each a keep, rewrite, reverse or ask verdict, and writes a review table plus rewritten justifications for the owner to approve.

中文简介正在准备中。当前显示原文说明。

Use this skill when a certification audit is booked and the team wants to know whether the first stage will go through, and asks "are we ready for stage 1", "pre-audit readiness check", "what will the auditor read first", "documentation review before the certification audit", "mock stage 1" or "what would stop the audit". Walks the documentation set the way a certification auditor reads it, checks that documents agree with each other and with the records, and writes a list of stoppers, likely findings and polish items with an owner and a fix for each.

中文简介正在准备中。当前显示原文说明。

Use this skill when a team must define what its management system covers before a certification project, or its current scope is one vague sentence, and asks "write our ISMS scope", "what should be in scope", "can we exclude the sales office", "scope for the certificate", "draw the boundary of our management system" or "the auditor says our scope is unclear". Drafts the scope statement with boundaries, interfaces, dependencies and justified exclusions, for a security, privacy or AI management system, and writes a statement file plus a boundary table of open questions.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs its information security policy set written or rebuilt, or asks "write our security policies", "draft the information security policy", "we need policies for the audit", "policy pack for a startup", "our template policies are 40 documents nobody reads" or "which policies do we actually need". Maps the policy set to the company's size and owners, drafts the top-level policy and the topic policies in testable language that reflects what the company does, flags commitments that need a decision, and prepares the approval and communication record for leadership.

中文简介正在准备中。当前显示原文说明。

Use this skill when a supplier has returned a security questionnaire, assurance report, certificate or trust pack and someone asks "review this vendor's answers", "is this supplier safe to use", "read their SOC report for us", "what should we ask the vendor next", "triage the vendor security assessment" or "does their certificate cover the service we buy". Checks report and certificate scope against the service in use, sorts answers into evidenced, asserted, contradicted and evasive, lists the obligations the report puts back on the customer, and writes a triage note with follow-up questions and a proposed decision for the owner.

中文简介正在准备中。当前显示原文说明。

Use this skill when an engineering team needs a secure development policy, or has one that does not match how code really ships, and asks "write our secure SDLC policy", "secure development policy from our CI", "document our code review and scanning for the audit", "what does our pipeline already enforce", "change management for engineers" or "secure coding policy for SOC 2 or CRA". Reads the repositories and pipeline definitions, inventories what is actually enforced (reviews, checks, scanners, deploy gates, dependency and secret controls), and writes a policy whose every "must" points to the place it is enforced, with gaps listed as decisions.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs to decide how much assessment each supplier deserves, or asks "tier our vendors", "which suppliers are critical", "we have 200 vendors and cannot assess them all", "build a third-party risk tiering", "rank suppliers by risk" or "which vendors need a security review this year". Builds the complete supplier population from finance, single sign-on and contracts, scores each supplier on data, access and dependency, assigns a tier by the highest axis, sets the assessment depth and cycle per tier, and writes a tiered list with the reason for every score.

中文简介正在准备中。当前显示原文说明。

Use this skill when an external audit, attestation examination or assessment is coming and the team wants populations and evidence ready for the samples the auditor will pull, or asks "prepare for audit sampling", "what samples will the auditor ask for", "get our populations ready", "the auditor wants a list of all changes in the period", "evidence for the leavers sample", "Type II sample prep" or "how do we prove completeness of the population". Lists the populations an auditor is likely to sample, builds each from the system of record with the query that produced it, checks completeness and the evidence behind a dry-run sample, and writes a readiness file per population plus a list of gaps to fix before fieldwork.

中文简介正在准备中。当前显示原文说明。

Use this skill when an auditor, assessor or regulator has sent a request list and the team asks "turn the auditor's request list into tasks", "who needs to provide what", "build the evidence tracker", "split the PBC list by owner", "what exactly do they want for this request" or "we have two weeks to send everything". Normalises each request into owned, dated tasks naming the exact artefact, period and source system, separates population requests from sample requests, batches the clarification questions, and writes a tracker plus one brief per owner.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs a written risk assessment method before it builds or rescores a register, or when the current method produces registers where everything scores 3. Triggers: "write our risk methodology", "define likelihood and impact scales", "what is our risk appetite", "risk acceptance criteria", "who can accept a risk", "our auditor says the method is not repeatable", "risk matrix for our ISMS". Drafts a short method with likelihood and impact anchors in the company's own money, hours and records, a scoring rule, an acceptance threshold with an authority ladder, reassessment triggers, and a calibration test on five sample risks.

中文简介正在准备中。当前显示原文说明。

Use this skill when a restore test is due, an auditor or customer asks for proof that backups can be recovered, or someone says "plan a restore test", "prove we can recover in time", "our backups succeed but we never restored", "test our RTO and RPO", "write up the disaster recovery test" or "document the backup restore for the audit". Picks what to restore, writes a test plan with success criteria set before the test, records timings against the recovery objectives, and produces a signed-off test record with the issues found and their owners.

中文简介正在准备中。当前显示原文说明。

Use this skill when a bank, payment or e-money institution, investment firm, insurer, crypto-asset service provider or other financial entity in scope of DORA needs to know whether its ICT risk management setup holds up, or when someone asks "DORA gap analysis", "are we DORA compliant on ICT risk", "check our ICT risk management framework", "prepare for the supervisor's DORA review", "does our ISO 27001 ISMS cover DORA" or "audit our Article 6 framework". Confirms the entity type and whether the simplified regime applies, maps the entity's own documents and records against the ICT risk management articles, and writes a gap list with owners, evidence and priorities.

中文简介正在准备中。当前显示原文说明。

Use this skill when an auditor will test change management, or the team wants to know before they do, and asks "sample our production changes", "check our PR approvals", "do we have segregation of duties on deploys", "test change management before the audit", "were emergency changes approved" or "can a developer push to production alone". Builds the change population from what actually reached production, reconciles it with tickets and pull requests, draws a recorded sample, tests approval, testing, segregation and emergency attributes, and writes the results and the exceptions as facts.

中文简介正在准备中。当前显示原文说明。

Use this skill when a customer or prospect has sent a security questionnaire, due diligence form or vendor assessment and someone asks "answer this security questionnaire", "fill in the customer's vendor assessment", "draft answers from our policies", "we have 300 questions due Friday", "reuse our previous questionnaire answers" or "which answers can we not back up". Drafts every answer from the company's own documents with a source and a confidence level, flags answers without evidence and answers that create commitments, checks consistency with past answers, and writes an answer sheet plus a list of items for owners to confirm.

中文简介正在准备中。当前显示原文说明。

Use this skill when controls have no clear owner, or "security" owns everything, and the team asks "who owns each control", "build a RACI for our controls", "assign control owners", "nobody knows who runs the access review", "set a review cadence per control" or "the auditor asked who is accountable". Assigns one accountable role and the operators to every applicable control, checks workload and segregation of duties, sets a review cadence from how each control runs, and writes a RACI table plus a one-page brief per owner role.

中文简介正在准备中。当前显示原文说明。

Use this skill when a set of policies, procedures, plans and registers has grown in pieces and someone asks "check our documents for contradictions", "are our policies consistent", "the retention periods don't match", "which severity scale is right", "harmonise our ISMS documents", "cross-check the incident plan against the policy" or "clean up our documentation before the audit". Extracts the checkable facts from every document (periods, deadlines, scales, roles, labels, references), finds contradictions, naming drift and broken references, proposes which document owns each fact, and drafts a glossary and a fix list for the owners.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs rules for how staff use company systems, data, devices and AI tools, or asks "write our acceptable use policy", "AUP for employees", "can staff use ChatGPT at work", "AI usage policy", "BYOD rules", "remote work security rules" or "a policy people will actually read". Finds how people really work (devices, apps, AI tools, travel), puts the choices to the reader as decisions, drafts a short plain-language policy with concrete do and do not examples, and adds a comprehension check and an acknowledgement text for onboarding.

中文简介正在准备中。当前显示原文说明。

Use this skill when a periodic user access review is due, an auditor asked for access review evidence, or someone says "prepare the access review", "run the quarterly user recertification", "who still has admin", "check leavers still have access", "build the access review sheets for managers" or "our last review was a rubber stamp". Picks the systems in scope, builds account populations reconciled against HR, pre-flags leavers, orphans, shared and dormant accounts, assigns independent reviewers, defines the decisions to record, and plans the removal follow-up.

中文简介正在准备中。当前显示原文说明。

Use this skill when someone wants to know where to start with the grcskills library, or asks "review my GRC setup", "what should I fix before the audit", "which compliance skills do I need", "audit my ISMS folder", "give me a 30-day compliance plan" or "rank the skills for my company". Reads the frontmatter of every skill in the library, inspects the compliance material the agent can reach (repo, policy folder, registers, platform exports), ranks the 10 skills that would help most with impact, effort and evidence for each, audits what is broken, duplicated or missing, and writes a 30-day plan to files in a grc-setup-review folder. Read-only on everything else.

中文简介正在准备中。当前显示原文说明。

Use this skill when one AI system needs its impact on people and on the company assessed before launch, after a significant change, or because a customer, auditor or regulator asks for it, and the team says "AI impact assessment", "assess the impact of this model", "fundamental rights impact assessment", "who could this AI harm", "bias assessment before launch" or "sign-off for the AI feature". Describes the system in its context, works through impacts on the people it affects with evidence, sizes them, proposes mitigations with measurable triggers, and writes one assessment ready for the system owner and an accountable executive to sign.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company that already runs a security management system wants to add an AI management system, or is preparing for an AI governance certification, and asks "scope our AI management system", "what should the AIMS cover", "AI governance roles", "who owns AI governance", "extend our ISMS to AI" or "write the AI management system scope statement". Decides which AI systems, roles, teams and lifecycle stages are in, maps interfaces and dependencies, reuses the processes the security system already runs, assigns roles with a RACI, and writes the scope statement, the roles file and the open questions for leadership.

中文简介正在准备中。当前显示原文说明。