「secure」の検索結果

Secure skill template with prompt injection defenses. Copy this template when creating new skills.

日本語の概要は準備中です。原文の説明を表示しています。

Secure skill template with prompt injection defenses. Copy this template when creating new skills.

日本語の概要は準備中です。原文の説明を表示しています。

Practical security review and hardening guidance for application code in Python, JavaScript/TypeScript, and Go. Use this skill whenever the user asks for a security review or audit, wants to harden authentication (password hashing, sessions, JWT, OAuth2/OIDC, MFA), fix OWASP Top 10 issues (injection, XSS, IDOR, CSRF, SSRF, deserialization), threat-model with STRIDE, clean up secrets and .env handling, or set up dependency scanning (pip-audit, npm audit, osv-scanner, gitleaks, SBOM). Also trigger for "make this secure", "is this safe to deploy", bcrypt/argon2id, rate limiting logins, RBAC/ABAC, CSP and security headers, cookie flags, and secure-by-default coding help.

日本語の概要は準備中です。原文の説明を表示しています。

アプリの本番品質を保証する統合スキル。セキュリティ監査・例外/エラー処理設計・攻撃別対処・ サーバーコスト最適化・パフォーマンス最適化を1つのゲートで検査する。 「セキュリティチェックして」「リリースしていい？」「本番公開前の確認」「脆弱性診断」「監査して」 「エラー処理を設計して」「例外処理を入れて」「攻撃対策」「レート制限」「コストを抑えたい」 「無料枠に収めたい」「パフォーマンス改善」「重い」などの文脈で必ず使用する。 また、認証・ユーザー入力・API・決済・機密データを扱うコードを書いた直後、およびデプロイ前には ユーザーが明示しなくても本スキルの該当セクションを適用する。 デプロイ手順自体は Skill cloudflare-secure-deploy、認証実装は Skill better-auth-google-gate、 LLMコストは Skill llm-api-integration / llm-cost-simulator を併用する。

Cloudflare WorkersのCI(自動検査)とCD(自動デプロイ)を、Workers Buildsまたは外部CI/CDから案件に合う1経路だけ選び、無料枠に収まる最小構成で構築・運用するためのスキル。 「CIを入れて」「CDを組んで」「自動デプロイしたい」「GitHub Actions」「ワークフロー」「テストを自動で回したい」 「マージしたら勝手に公開されるようにして」「デプロイを自動化して」「CIが落ちた」「Actionsが失敗する」 「デプロイの手作業をなくしたい」「Cloudflareの設定が分からない」「非エンジニア向け手順を作って」などの文脈で必ず使用する。 デプロイ先が Cloudflare Workers の場合は Skill cloudflare-secure-deploy を併用する(D1マイグレーションの扱いが最重要)。ブランチ・PR・タグの規約は Skill solo-git-flow に従う。手動デプロイを繰り返している状況を見つけたら、依頼されていなくても このスキルの §0 を読んで導入可否を判断すること。

Use Intel CHIPSEC to assess platform firmware configuration, SPI flash write protection, BIOS lock, SMM/SMRR, and Secure Boot variable state, dump SPI flash, and triage UEFI variables for firmware-level threats.

日本語の概要は準備中です。原文の説明を表示しています。

Proactive secure-coding coach scoped to the file or topic you are working on — surfaces relevant SAST rule IDs, CWE patterns, language-specific PASS/FAIL code snippets. Use when about to write auth, crypto, SQL, deserialization, file-handling, or template code; coaching juniors; pair-programming a security-sensitive change.

日本語の概要は準備中です。原文の説明を表示しています。

Knowledge base from NIST SP 800-160 Vol 1 (Engineering Trustworthy Secure Systems) and Vol 2 (Developing Cyber-Resilient Systems). Use for systems security engineering (SSE): the three SSE framework contexts (problem/solution/trustworthiness), the 30+ design principles for trustworthy secure design, trustworthiness and assurance/assurance cases, security across the ISO/IEC/IEEE 15288 life-cycle process groups, and the Vol 2 cyber-resiliency engineering framework — 4 goals (anticipate/withstand/recover/adapt), objectives, 14 techniques, implementation approaches, and design principles for the APT/adverse-conditions threat model. Bridges systems engineering and the NIST security cluster (CSF/SSDF/RMF). Does not reproduce ISO/IEC/IEEE 15288 process text, nor cover SP 800-53 control catalogs in depth.

日本語の概要は準備中です。原文の説明を表示しています。

Audits WordPress plugin/theme code for secret-handling and credential issues — hardcoded API keys, DB credentials, or signing secrets in source; weak randomness (rand, mt_rand, uniqid) used for security tokens, password reset links, nonces, or session IDs; password storage with md5/sha1/crypt instead of password_hash; insecure cookie flags (missing Secure, HttpOnly, SameSite) on sensitive cookies; secrets logged via error_log / var_dump in production code paths. Use before plugin release, when reviewing auth/registration/login features, when integrating third-party APIs, or when the user mentions "API key", "token", "session", "password reset".

日本語の概要は準備中です。原文の説明を表示しています。

Configure secure, high-performance connectivity between on-premises infrastructure and cloud platforms using VPN and dedicated connections. Use when building hybrid cloud architectures, connecting data centers to cloud, or implementing secure cross-premises networking.

日本語の概要は準備中です。原文の説明を表示しています。

Use when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face ID, Touch ID), CryptoKit (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, secure credential storage (OAuth tokens, API keys), certificate pinning (SecTrust, SPKI), keychain sharing across apps/extensions, migrating secrets from UserDefaults or plists, or OWASP MASVS/MASTG mobile compliance on Apple platforms.

日本語の概要は準備中です。原文の説明を表示しています。

This skill should be used when the user asks how to "use VibeTags", "add VibeTags annotations", "set up AI guardrails", "protect code from AI", "configure AI platforms", asks about @AILocked, @AIContext, @AIDraft, @AIAudit, @AIIgnore, @AIPrivacy, @AICore, @AIPerformance, @AIContract, @AITestDriven, @AIThreadSafe, @AIImmutable, @AIDeprecated, @AIObservability, @AIRegulation, @AIArchitecture, @AILegacyBridge, @AIStrictClasspath, @AIInternationalized, @AIPublicAPI, @AISchemaSafe, @AIStrictExceptions, @AIStrictTypes, @AIParallelTests, @AIIdempotent, @AIFeatureFlag, @AISecure, @AICallersOnly, @AISandboxOnly, @AIMemoryBudget, @AIPure, @AIDomainModel, @AIExtensible, @AIInputSanitized, @AISecureLogging, @AIExplain, @AIPrototype, @AISunset, @AITemporary annotations, or wants to control how AI tools interact with Java code.

日本語の概要は準備中です。原文の説明を表示しています。

bu skill covers implementing automated security scanning for Infrastructure as Code (IaC) templates using tools like Checkov, tfsec, and KICS. It addresses Tespit etme misconfigurations in Terraform, CloudFormation, Kubernetes manifests, and Helm charts before Dağıt:ment, establishing policy-based governance, and integrating IaC scanning into CI/CD pipelines to prevent insecure cloud resource provisioning.

日本語の概要は準備中です。原文の説明を表示しています。

bu skill covers hardening container images by minimizing attack surface, removing unnecessary packages, implementing multi-stage builds, configuring non-root users, and applying CIS Docker Benchmark recommendations to produce secure production-ready images.

日本語の概要は準備中です。原文の説明を表示しています。

bu skill instructs security practitioners on Dağıt:ing Microsoft Defender for Cloud as a cloud-native application protection platform for Azure, multi-cloud, and hybrid environments. It covers enabling Defender plans for servers, containers, storage, and databases, configuring security recommendations, managing Secure Score, and integrating with the unified Defender portal for centralized threat management.

日本語の概要は準備中です。原文の説明を表示しています。

Implements secure API key generation, storage, rotation, and revocation controls to protect API authentication credentials from leakage, brute force, and abuse. The engineer designs API key formats with sufficient entropy, implements secure hashing for storage, enforces per-key scoping and rate limiting, monitors for leaked keys in public repositories, and builds key rotation workflows. Activates for requests involving API key management, API key security, key rotation policy, or API credenti...

日本語の概要は準備中です。原文の説明を表示しています。

Use when setting up a secure email inbox for any AI agent — configuring inbound email via Resend, webhooks, tunneling for local development, and implementing security measures to prevent prompt injection attacks. Also use when someone mentions 'agent email', 'bot inbox', 'receive emails for agent', 'agent webhook', 'email security for AI', 'prompt injection via email', 'inbound email for bot', or wants their AI agent to receive and respond to emails securely.

日本語の概要は準備中です。原文の説明を表示しています。

Secure secret management using 1Password CLI. Detect plaintext secrets in files and codebases, convert environment files to 1Password templates, inject secrets securely using op inject, and audit codebases for security compliance.

日本語の概要は準備中です。原文の説明を表示しています。

Content sanitization and hidden-content detection for agent skill security. Scans markdown, HTML, and text for visually hidden but agent-readable attacks: CSS-hidden text (display:none, color:white, font-size:0, opacity:0), HTML comments with instructions, collapsible details sections, zero-width unicode, homoglyphs, misleading links, and inline HTML in markdown. Enforces mandatory sanitization before external content enters agent context. Load as part of the secure-* sequence during any repo scan or skill audit. Also load for sanitize content, check hidden text, scan markdown attacks, strip HTML, detect invisible instructions, check zero-width chars. Core principle: visibility does not equal influence — hidden content is more dangerous than visible content because agents process it but humans cannot see it.

日本語の概要は準備中です。原文の説明を表示しています。

Runtime security for agent skills — prevents state corruption, skill overwrite attacks, denial of service, and enforces provenance tracking and no-go repo management. Load as part of the secure-* skill sequence whenever an agent processes external content or writes to the skill store. Also load when the user asks to check for state corruption, prevent skill overwrite, manage no-go repos, check provenance, audit runtime security, detect DoS patterns, or protect the skill store. Covers Issues 6, 9, 10 from the agent security threat model: instruction hierarchy enforcement, state corruption and skill overwrite, and denial of service prevention.

日本語の概要は準備中です。原文の説明を表示しています。

Security checks for repository ingestion — scans repos for poisoned examples, dependency and supply-chain attacks, file/path traversal, format-based attacks, and enforces quarantine-before-commit. Load as part of the secure-* skill sequence whenever an agent reads, ingests, or learns from a GitHub repository. Also load when the user asks to check a repo for poisoned code, scan dependencies, verify supply chain safety, check for path traversal, scan repo files for attacks, or audit a repo before ingestion. Covers Issues 3, 4, 7, 8 from the agent security threat model: poisoned training data, dependency attacks, file/path attacks, and format-based attacks.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when the user asks about logging / log hauling operations — short-haul exemption specifics for logging, log truck securement, axle weights, state-by-state logging permits (especially OR, WA, ID, BC), bunk + stake configurations, and how logging fits into FMCSA + state rules. Reference 49 CFR 393 for cargo securement of logs.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill to understand the FMCSA cargo securement standards. Covers § 393.100-§ 393.136 general rules, tiedown requirements, working load limits.

日本語の概要は準備中です。原文の説明を表示しています。

Security hardening and best practices for .NET applications. Navigation skill covering OWASP Top 10, authentication, authorization, cryptography, secrets management, and secure coding. For building secure applications. Keywords: security, owasp, authentication, authorization, cryptography, jwt, oauth, secrets, hardening

日本語の概要は準備中です。原文の説明を表示しています。