007
無料Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
日本語の概要は準備中です。原文の説明を表示しています。
This skill should be used when conducting a scored agent-native architecture review. It launches 8 parallel sub-agents to audit action parity, context injection, CRUD completeness, capability discovery, and prompt-native features.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
Conduct a comprehensive review of the codebase against agent-native architecture principles, launching parallel sub-agents for each principle and producing a scored report.
First, invoke the agent-native-architecture skill to understand all principles:
/soleur:agent-native-architecture
Select option 7 (action parity) to load the full reference material.
Launch 8 parallel sub-agents using the Task tool with subagent_type: Explore, one for each principle. Each agent should:
Agent 1: Action Parity
Audit for ACTION PARITY - "Whatever the user can do, the agent can do."
Tasks:
1. Enumerate ALL user actions in frontend (API calls, button clicks, form submissions)
- Search for API service files, fetch calls, form handlers
- Check routes and components for user interactions
2. Check which have corresponding agent tools
- Search for agent tool definitions
- Map user actions to agent capabilities
3. Score: "Agent can do X out of Y user actions"
Format:
## Action Parity Audit
### User Actions Found
| Action | Location | Agent Tool | Status |
### Score: X/Y (percentage%)
### Missing Agent Tools
### Recommendations
Agent 2: Tools as Primitives
Audit for TOOLS AS PRIMITIVES - "Tools provide capability, not behavior."
Tasks:
1. Find and read ALL agent tool files
2. Classify each as:
- PRIMITIVE (good): read, write, store, list - enables capability without business logic
- WORKFLOW (bad): encodes business logic, makes decisions, orchestrates steps
3. Score: "X out of Y tools are proper primitives"
Format:
## Tools as Primitives Audit
### Tool Analysis
| Tool | File | Type | Reasoning |
### Score: X/Y (percentage%)
### Problematic Tools (workflows that should be primitives)
### Recommendations
Agent 3: Context Injection
Audit for CONTEXT INJECTION - "System prompt includes dynamic context about app state"
Tasks:
1. Find context injection code (search for "context", "system prompt", "inject")
2. Read agent prompts and system messages
3. Enumerate what IS injected vs what SHOULD be:
- Available resources (files, drafts, documents)
- User preferences/settings
- Recent activity
- Available capabilities listed
- Session history
- Workspace state
Format:
## Context Injection Audit
### Context Types Analysis
| Context Type | Injected? | Location | Notes |
### Score: X/Y (percentage%)
### Missing Context
### Recommendations
Agent 4: Shared Workspace
Audit for SHARED WORKSPACE - "Agent and user work in the same data space"
Tasks:
1. Identify all data stores/tables/models
2. Check if agents read/write to SAME tables or separate ones
3. Look for sandbox isolation anti-pattern (agent has separate data space)
Format:
## Shared Workspace Audit
### Data Store Analysis
| Data Store | User Access | Agent Access | Shared? |
### Score: X/Y (percentage%)
### Isolated Data (anti-pattern)
### Recommendations
Agent 5: CRUD Completeness
Audit for CRUD COMPLETENESS - "Every entity has full CRUD"
Tasks:
1. Identify all entities/models in the codebase
2. For each entity, check if agent tools exist for:
- Create
- Read
- Update
- Delete
3. Score per entity and overall
Format:
## CRUD Completeness Audit
### Entity CRUD Analysis
| Entity | Create | Read | Update | Delete | Score |
### Overall Score: X/Y entities with full CRUD (percentage%)
### Incomplete Entities (list missing operations)
### Recommendations
Agent 6: UI Integration
Audit for UI INTEGRATION - "Agent actions immediately reflected in UI"
Tasks:
1. Check how agent writes/changes propagate to frontend
2. Look for:
- Streaming updates (SSE, WebSocket)
- Polling mechanisms
- Shared state/services
- Event buses
- File watching
3. Identify "silent actions" anti-pattern (agent changes state but UI doesn't update)
Format:
## UI Integration Audit
### Agent Action → UI Update Analysis
| Agent Action | UI Mechanism | Immediate? | Notes |
### Score: X/Y (percentage%)
### Silent Actions (anti-pattern)
### Recommendations
Agent 7: Capability Discovery
Audit for CAPABILITY DISCOVERY - "Users can discover what the agent can do"
Tasks:
1. Check for these 7 discovery mechanisms:
- Onboarding flow showing agent capabilities
- Help documentation
- Capability hints in UI
- Agent self-describes in responses
- Suggested prompts/actions
- Empty state guidance
- Slash commands (/help, /tools)
2. Score against 7 mechanisms
Format:
## Capability Discovery Audit
### Discovery Mechanism Analysis
| Mechanism | Exists? | Location | Quality |
### Score: X/7 (percentage%)
### Missing Discovery
### Recommendations
Agent 8: Prompt-Native Features
Audit for PROMPT-NATIVE FEATURES - "Features are prompts defining outcomes, not code"
Tasks:
1. Read all agent prompts
2. Classify each feature/behavior as defined in:
- PROMPT (good): outcomes defined in natural language
- CODE (bad): business logic hardcoded
3. Check if behavior changes require prompt edit vs code change
Format:
## Prompt-Native Features Audit
### Feature Definition Analysis
| Feature | Defined In | Type | Notes |
### Score: X/Y (percentage%)
### Code-Defined Features (anti-pattern)
### Recommendations
</sub-agents>
After all agents complete, compile a summary with:
## Agent-Native Architecture Review: [Project Name]
### Overall Score Summary
| Core Principle | Score | Percentage | Status |
|----------------|-------|------------|--------|
| Action Parity | X/Y | Z% | ✅/⚠️/❌ |
| Tools as Primitives | X/Y | Z% | ✅/⚠️/❌ |
| Context Injection | X/Y | Z% | ✅/⚠️/❌ |
| Shared Workspace | X/Y | Z% | ✅/⚠️/❌ |
| CRUD Completeness | X/Y | Z% | ✅/⚠️/❌ |
| UI Integration | X/Y | Z% | ✅/⚠️/❌ |
| Capability Discovery | X/Y | Z% | ✅/⚠️/❌ |
| Prompt-Native Features | X/Y | Z% | ✅/⚠️/❌ |
**Overall Agent-Native Score: X%**
### Status Legend
- ✅ Excellent (80%+)
- ⚠️ Partial (50-79%)
- ❌ Needs Work (<50%)
### Top 10 Recommendations by Impact
| Priority | Action | Principle | Effort |
|----------|--------|-----------|--------|
### What's Working Excellently
[List top 5 strengths]
If $ARGUMENTS specifies a single principle (e.g., "action parity"), only run that sub-agent and provide detailed findings for that principle alone.
Valid arguments:
action parity or 1tools or primitives or 2context or injection or 3shared or workspace or 4crud or 5ui or integration or 6discovery or 7prompt or features or 8まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
日本語の概要は準備中です。原文の説明を表示しています。
Guides the creation of agile user stories and Gherkin feature files. Use when the user wants to create a user story, write acceptance criteria, define Gherkin scenarios, or author BDD feature files. This should trigger for requests such as Create a user story; Write a user story; I need to write a user story. Part of cursor-rules-java project
日本語の概要は準備中です。原文の説明を表示しています。
Facilitates conversational discovery to create Architectural Decision Records (ADRs) for non-functional requirements using the ISO/IEC 25010:2023 quality model. Use when the user wants to document quality attributes, NFR decisions, security/performance/scalability architecture, or design systems with measurable quality criteria. This should trigger for requests such as Create ADR for Non-functional requirements; Document Non-functional requirements; Capture Non-functional requirements; Generate Non-functional requirements in an ADR. Part of cursor-rules-java project
日本語の概要は準備中です。原文の説明を表示しています。
Run a health check on an existing project: dependency audit, security scan, test runner detection, CI/CD evaluation, and missing configuration analysis. Maps the three execution gates (pre/in/post) from /10x-bootstrapper to an assessment framework for existing codebases. Reads optional context/foundation/stack-assessment.md from /10x-stack-assess to focus checks on identified gaps. Writes context/foundation/health-check.md with findings, prioritized fixes, and an agent-readiness verdict. Use when the user has an existing project and wants to verify its health before working with an agent. Trigger phrases: "health check", "check my project", "audit my project", "is my project healthy", "sprawdź projekt", "audyt projektu", "health-check", "project health". Use AFTER /10x-stack-assess (brownfield chain), BEFORE agent onboarding (m1-l4).
日本語の概要は準備中です。原文の説明を表示しています。
You MUST use this when building projects end-to-end. Orchestrates all 12 team roles — automatically switches between CTO, architect, PM, engineers, SRE, security, DBA, QA, and EM based on the current phase of work. Starts with brainstorming before any implementation.
日本語の概要は準備中です。原文の説明を表示しています。
Use when you need to add or configure Maven plugins in your pom.xml — including quality tools (enforcer, surefire, failsafe, jacoco, pitest, spotbugs, pmd), security scanning (OWASP), code formatting (Spotless), version management, container image build (Jib), build information tracking, and benchmarking (JMH) — through a consultative, modular step-by-step approach that only adds what you actually need. This should trigger for requests such as Add Maven plugins in pom.xml; Improve Maven plugins in pom.xml. Part of cursor-rules-java project
日本語の概要は準備中です。原文の説明を表示しています。