007
無料Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
日本語の概要は準備中です。原文の説明を表示しています。
Convert the canonical markdown+JSON deliverable of any SfSkills runtime agent into Excel, PDF, CSV, Notion card, ServiceNow ticket, or similar downstream format WITHOUT polluting the consumer's project with new dependencies or regenerating from the agent's source logic. NOT for authoring new agent output formats (use DELIVERABLE_CONTRACT.md). NOT for data-export SOQL (use bulk-api-2-patterns).
インストールする前に、エージェントに与えられる指示の中身を確認できます。
Activate when:
Do NOT use this skill for:
agents/_shared/DELIVERABLE_CONTRACT.md).agents/_shared/schemas/output-envelope.schema.json).skills/data/bulk-api-2-patterns).Every runtime agent produces a canonical pair: markdown + JSON envelope. That pair IS the source of truth. When a consumer asks for Excel/PDF/etc., the correct answer is to convert from that pair, not to re-run the agent with different instructions.
Reasons:
docs/reports/. Six months later, anyone can regenerate the Excel from it. If the consuming AI regenerates by re-asking the agent, the output may differ due to LLM stochasticity.run_id in the envelope is the tracking key. The Excel/PDF should reference it in its header, so "which run produced this?" is always answerable.exceljs, xlsxwriter, weasyprint, etc. into a consumer's project every time someone wants a different format bloats their project's dependency tree.START: Consumer wants deliverable in format X.
Q1. Is X markdown or JSON?
→ Already the canonical form. No conversion needed; hand them the file path.
Q2. Is X a format the consumer's existing tooling handles natively?
├── Slack message / email body → paste the TL;DR + envelope-link from the markdown
├── Confluence / Notion / Obsidian → import the markdown directly (all support markdown import)
├── Jira / ServiceNow ticket → paste TL;DR in description + link the report file
└── GitHub issue → embed markdown inline; link the report path
→ Prefer this path. Zero new dependencies.
Q3. Does the consumer want a "table" from the markdown?
├── CSV: extract markdown tables using `pandoc` (most dev machines have it)
├── Excel from the JSON envelope: use `jq` + `csv2xlsx` CLI tools (lighter than a full SDK)
└── If neither pandoc nor jq: recommend installing pandoc (1 tool, system-level, widely used)
Q4. Does the consumer want PDF?
→ `pandoc <report>.md -o <report>.pdf` — single command, no new project deps
→ If pandoc isn't available: recommend a system-wide install, NOT a project-level dep
Q5. Does the consumer want something format-specific (e.g. ServiceNow change ticket)?
→ Extract the fields from the JSON envelope (it's keyed for exactly this)
→ Template into the target system via its normal integration path
→ Do NOT ask the agent to regenerate in the target format
docs/reports/<agent-id>/<run_id>.{md,json}. If not, run the agent first.pandoc, jq, csv2xlsx? The answer is almost always yes for #2 and often for #1.run_id in the converted artifact's header — so auditors can trace it back.pandoc docs/reports/user-access-diff/2026-04-17T21-14-05Z.md \
-o ~/Desktop/user-access-diff.pdf \
--metadata title="User Access Diff — Christina vs Carrie" \
--metadata date="2026-04-17"
Zero project dependencies added. Works because pandoc is a widely-available system tool.
# Extract the findings array from the envelope as CSV.
jq -r '.findings | (map(keys) | add | unique) as $keys |
($keys | @csv), (.[] | [.[$keys[]]] | @csv)' \
docs/reports/user-access-diff/2026-04-17T21-14-05Z.json \
> /tmp/findings.csv
# Convert to xlsx.
csv2xlsx /tmp/findings.csv /tmp/findings.xlsx
Or, if the user has Excel open:
open /tmp/findings.csv # macOS; Excel imports CSV natively
Extract the fields ServiceNow needs from the envelope:
jq '{
short_description: .summary,
description: .summary + "\n\nRun ID: " + .run_id +
"\nConfidence: " + .confidence +
"\nFull report: " + .report_path,
priority: (if .findings | map(.severity) | any(. == "P0") then "1"
elif .findings | map(.severity) | any(. == "P1") then "2"
else "3" end)
}' docs/reports/<agent-id>/<run_id>.json
Paste the JSON into the ServiceNow integration payload. No project deps.
All three accept markdown imports directly. The user uploads the .md file via the platform's UI.
Preservation tip: include the run_id as a frontmatter field at the top of the markdown report, so when the page is imported, the run_id survives as a property.
Scenario: user wants interactive Excel with embedded formulas referencing cells.
exceljs / openpyxl into their project.~/bin/ or a dedicated report-tool project — NOT the project where the agent was invoked.When converting reports for multiple runs in a batch:
find docs/reports/<agent-id>/ -name '*.md' -exec pandoc ... to iterate, not one-by-one invocations.run_id as the auditable thread.Re-asking the agent to regenerate in the new format. The agent is an expensive LLM call. Conversion is a cheap shell command. Always convert from the canonical.
Installing format-specific libraries into the user's project. exceljs, xlsxwriter, weasyprint — these are conversion tools, not project dependencies. Install system-wide or run from a dedicated CLI project.
Stripping the run_id. The converted artifact must reference it somewhere (header, filename, metadata). Without it, nobody can trace which run the Excel came from.
Opening up new output-format surfaces on the agent itself. If someone asks for "JIRA native format" as an agent output, refuse. The agent outputs canonical markdown+JSON. JIRA conversion is downstream.
まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
日本語の概要は準備中です。原文の説明を表示しています。
Guides the creation of agile user stories and Gherkin feature files. Use when the user wants to create a user story, write acceptance criteria, define Gherkin scenarios, or author BDD feature files. This should trigger for requests such as Create a user story; Write a user story; I need to write a user story. Part of cursor-rules-java project
日本語の概要は準備中です。原文の説明を表示しています。
Facilitates conversational discovery to create Architectural Decision Records (ADRs) for non-functional requirements using the ISO/IEC 25010:2023 quality model. Use when the user wants to document quality attributes, NFR decisions, security/performance/scalability architecture, or design systems with measurable quality criteria. This should trigger for requests such as Create ADR for Non-functional requirements; Document Non-functional requirements; Capture Non-functional requirements; Generate Non-functional requirements in an ADR. Part of cursor-rules-java project
日本語の概要は準備中です。原文の説明を表示しています。
Run a health check on an existing project: dependency audit, security scan, test runner detection, CI/CD evaluation, and missing configuration analysis. Maps the three execution gates (pre/in/post) from /10x-bootstrapper to an assessment framework for existing codebases. Reads optional context/foundation/stack-assessment.md from /10x-stack-assess to focus checks on identified gaps. Writes context/foundation/health-check.md with findings, prioritized fixes, and an agent-readiness verdict. Use when the user has an existing project and wants to verify its health before working with an agent. Trigger phrases: "health check", "check my project", "audit my project", "is my project healthy", "sprawdź projekt", "audyt projektu", "health-check", "project health". Use AFTER /10x-stack-assess (brownfield chain), BEFORE agent onboarding (m1-l4).
日本語の概要は準備中です。原文の説明を表示しています。
You MUST use this when building projects end-to-end. Orchestrates all 12 team roles — automatically switches between CTO, architect, PM, engineers, SRE, security, DBA, QA, and EM based on the current phase of work. Starts with brainstorming before any implementation.
日本語の概要は準備中です。原文の説明を表示しています。
Use when you need to add or configure Maven plugins in your pom.xml — including quality tools (enforcer, surefire, failsafe, jacoco, pitest, spotbugs, pmd), security scanning (OWASP), code formatting (Spotless), version management, container image build (Jib), build information tracking, and benchmarking (JMH) — through a consultative, modular step-by-step approach that only adds what you actually need. This should trigger for requests such as Add Maven plugins in pom.xml; Improve Maven plugins in pom.xml. Part of cursor-rules-java project
日本語の概要は準備中です。原文の説明を表示しています。