メニュー
Audit or implement Tunelito security-sensitive changes. Use for tunnel sharing, review keys, cookies, WebSocket auth, file serving, hooks, secrets, or package publishing.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Run a Tunelito live review room for a local HTML/Markdown file or folder, then process the comments it collects. Use whenever a user wants to share, serve, or preview a local .html page, .md memo, or static site/mini-site from their machine so a designer, client, teammate, or PM can leave feedback on a call; wants a temporary public link to a local page; says "review my HTML", "annotate this page", "review this Markdown draft", "let people comment on my site", "get feedback on index.html", "spin up a review room", or "review this page locally without exposing it"; OR points you at a `*.comments.md` / `site.comments.md` inbox and asks you to apply, process, or act on the comments inside it. Covers starting and sharing a session (Cloudflare Tunnel, keyed bearer URLs), local-only review of sensitive pages, active-agent `tunelito inbox` commands, the opt-in `--agent` worker that edits files from comments, and the comment Markdown schema (scope, page, path, id, status). Do NOT use for reviewing a pull request, IDE
Update or review Tunelito documentation. Use when README, changelog, release docs, examples, security docs, or agent playbooks need to stay in sync with behavior.
Run a live local Tunelito smoke test against an HTML page. Use before declaring browser/client/server/package changes ready.
Prepare Tunelito changes for a PR-ready commit and push, including verification and handoff summary.
Maintain Tunelito npm package quality. Use for package.json, package-lock, npm pack, npm install smoke tests, CI workflows, release docs, or distribution changes.
Prepare a Tunelito package or npm release using the release playbook and package verification.
| name | tunelito-security |
| description | Audit or implement Tunelito security-sensitive changes. Use for tunnel sharing, review keys, cookies, WebSocket auth, file serving, hooks, secrets, or package publishing. |
| allowed-tools | Read, Grep, Glob, Bash |
Read docs/agents/SECURITY_REVIEW.md.
For security work:
For reviews, report findings first with severity and file references. For implementation, run the relevant server/security tests and npm run ci.
