83 个 · 按相关度排序
Use this when summarizing analysis results, writing reports, documenting experiment outcomes, or presenting model evaluation — including structuring findings in Japanese with conclusions, facts, assumptions, interpretations, and caveats.
中文简介正在准备中。当前显示原文说明。
Use this when creating, modifying, reviewing, or saving charts, figures, plots, or visual summaries — including matplotlib/seaborn code, EDA figures, report figures, dashboards, or any task involving Japanese chart labels, color palettes, or figure styling.
中文简介正在准备中。当前显示原文说明。
シミュレーションと数理最適化（モンテカルロ / Monte Carlo / 離散事象シミュレーション / DES / 待ち行列 / リスク分析 / シナリオ分析、線形計画 / LP / 整数計画 / MIP / スケジューリング / 配送計画 / VRP / 割当 / メタヒューリスティクス）を 実行したら必ずセットで出す図と値のルーター。SeedSequence.spawn, scipy.stats の rvs, simpy, SALib, pulp, LpProblem, mip.Model, ortools, pywraplp, cp_model, pyomo, cvxpy, linprog, milp がコードに現れたとき、または ユーザーが「シミュレーションして」「モンテカルロで見積もって」「待ち時間をシミュレートして」「最適化して」 「最適な割当を求めて」「スケジュールを組んで」と言ったときに使う。収束・標準誤差・ソルバー status・制約違反・ 感度分析に言及がなくても適用する。SKILL.md のルーティング表で手法を特定し、対応する references/<手法>.md を 読んでから実行する。MCMC は statistical-inference-diagnostics、ML のハイパラ探索は predictive-modeling-diagnostics を使う。
中文简介正在准备中。当前显示原文说明。
Audit local AI coding-agent sessions with agenttrace for cost, tool failures, latency, anomalies, health, diffs, and CI gates.
中文简介正在准备中。当前显示原文说明。
Reconstruct workflow behind a past coding-agent artifact using local ax sessions/commits/skills/tool traces. Use when asked how X was built.
中文简介正在准备中。当前显示原文说明。
Audit local AI coding-agent sessions with agenttrace for cost, tool failures, latency, anomalies, health, diffs, and CI gates.
中文简介正在准备中。当前显示原文说明。
Generate CycloneDX 1.7 and/or SPDX 2.3 SBOMs for the repo, optionally cosign-signed, optionally cross-validated against syft output. Use when producing an SBOM for compliance, attaching to a release artefact, integrating with an SBOM registry, or satisfying a customer attestation request.
中文简介正在准备中。当前显示原文说明。
Static application security testing (SAST) for changed source files — Vulnetix's built-in rule set plus optional Semgrep augmentation when `.semgrep` config is present. Use when reviewing a PR for code-level vulnerabilities, scanning a feature branch before merge, gating CI on critical findings, or running rule-specific checks for a known weakness class.
中文简介正在准备中。当前显示原文说明。
Concrete remediation proposal with Safe Harbour confidence — version bump, inline as first-party code, patch, workaround, or advisory. Use when applying a fix for a triaged CVE, evaluating fix-type trade-offs across registry / source / distro patches, producing rollback-safe manifest edits with dry-run verification, or generating a CycloneDX SBOM after the fix lands.
中文简介正在准备中。当前显示原文说明。
Package license analysis — detect copyleft conflicts against a permissive policy, surface AGPL / SSPL / GPL contaminants, output SPDX SBOM with per-package license findings. Use when auditing a release for license compliance, vetting a new dependency's license, building an OSS-attribution document, or producing a customer-facing license disclosure.
中文简介正在准备中。当前显示原文说明。
Dockerfile / Containerfile / compose analysis plus optional Trivy / Grype / Syft composition when those binaries are present. Use when reviewing a Dockerfile PR, gating `docker build`, building an image SBOM, evaluating base-image risk, or auditing a registry image for CVEs.
中文简介正在准备中。当前显示原文说明。
Show what this repository has already decided about its vulnerabilities, read from the durable record rather than by scanning again — open versus resolved, the decision taken on each, and what is still waiting. Use when picking up triage after a break, auditing past decisions, onboarding to a repository with security history, or checking nothing high-severity is open before a release.
中文简介正在准备中。当前显示原文说明。
Hardcoded-secret detection — AWS keys, GitHub PATs, Slack tokens, Stripe keys, generic high-entropy strings. Pre-commit (`--staged-only`), explicit paths, or full repo. Use when guarding `git commit`, auditing a repo for leaked credentials, validating no secrets entered the diff before push, or producing a rotation list for an exposed-secret incident.
中文简介正在准备中。当前显示原文说明。
Terraform / OpenTofu / Nix / k8s manifest misconfiguration detection — open security groups, missing encryption, public S3/GCS, IAM wildcards, plaintext secrets, missing tags. Use when reviewing an IaC PR, gating `terraform apply` / `tofu apply`, auditing existing state for drift, or building a compliance report for cloud configuration.
中文简介正在准备中。当前显示原文说明。
Dependency-conflict resolution when a `fix` version bump fails — diagnose the peer-dep tree, find a compatible safe version set, propose package-manager overrides (`overrides`/`resolutions`/`replace`/`[patch]`), fall back to safe-harbour inline patching. Use when an upgrade is blocked by transitive constraints, a peer-dep conflict surfaces, or you need to override a vulnerable transitive without bumping the parent.
中文简介正在准备中。当前显示原文说明。
Work through which package to add for a capability, and what each option costs — maintenance, licence, bundle weight, transitive risk, and whether the platform already does it. Use when someone needs a library for a job and has not picked one yet, when weighing two candidates, or when a package looks convenient but unmaintained.
中文简介正在准备中。当前显示原文说明。
Typosquat and malicious-package detection across installed dependencies (or a single prospective addition) — cross-checks AI-malware family intelligence, package-name similarity to known popular packages, low maintainer-health signals. Use when auditing a freshly-onboarded repo, vetting a single suspicious package, gating CI on supply-chain risk, or investigating an incident.
中文简介正在准备中。当前显示原文说明。
IDS/IPS detection content for a CVE — Snort/Suricata-compatible rules, YARA signatures, ProjectDiscovery Nuclei templates, traffic-filter rules. Capability-aware: skips families when the binary is not installed (no Snort = no Snort output). Use when deploying defences for a CVE without a patch, augmenting SAST with active detection, or feeding the SOC engineering pipeline.
中文简介正在准备中。当前显示原文说明。
End-of-life detection for runtimes (Node, Python, Java, Go, .NET) and key packages — surfaces past-EOL items, items reaching EOL within 90 days, and EOL base images for containers. Use when planning a runtime upgrade, auditing for unsupported versions, gating a deploy against EOL deps, or producing a remediation roadmap.
中文简介正在准备中。当前显示原文说明。
Generate a runnable exploit-validation command (Nuclei template, Metasploit module hint, AI-assisted Python script, or curl-based PoC) against a user-specified authorised target. Use when validating that a fix actually closed the vulnerability path, confirming a patch deployed correctly, or producing a copy-pasteable test command for QA. The skill never executes — the user runs.
中文简介正在准备中。当前显示原文说明。
Answer whether a specific advisory reaches anything in THIS repository — which manifest declares the package, at what version, whether the version is in range, and whether the vulnerable code is reachable. Use when someone asks "does CVE-… affect us", when triaging an advisory against a real codebase, or before spending effort on a fix.
中文简介正在准备中。当前显示原文说明。
Proactive secure-coding coach scoped to the file or topic you are working on — surfaces relevant SAST rule IDs, CWE patterns, language-specific PASS/FAIL code snippets. Use when about to write auth, crypto, SQL, deserialization, file-handling, or template code; coaching juniors; pair-programming a security-sensitive change.
中文简介正在准备中。当前显示原文说明。
Post-fix verification — re-scan the repo, gate on `--exploits weaponized --severity high`, recheck the specific CVE against the new installed version, write the verdict to `.vulnetix/memory.yaml`. Use when confirming a fix landed, validating a version bump did not introduce regressions, or producing a clean-scan attestation for compliance.
中文简介正在准备中。当前显示原文说明。
Generate OpenVEX / CycloneDX VEX attestations from `.vulnetix/memory.yaml` triage decisions, optionally sign with cosign, optionally upload to Vulnetix and post to a GitHub PR. Use when documenting triage decisions for supply-chain consumers, attaching VEX to a CycloneDX SBOM, or satisfying customer attestation requests.
中文简介正在准备中。当前显示原文说明。