メニュー
Security deep scan — injection, auth, API, LLM/prompt, sensitive data, crypto, transport, supply-chain. Domain-hydrated at install time.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Cross-project build pipeline. Invoked as $wave-build <feature> or $wave-build with Pipeline/Task manifest/Wave args. Runs the full pipeline end to end including all git work.
Wave task runner. Reads a wave.md file and runs each pipeline sequentially. Invoked as `$wave <path/to/wave.md>`. Argument is the path to the wave manifest file.
Attributes Claude Code runtime token spend per sub-agent and per workflow run, parsed from local JSONL transcripts, and ranks the heaviest burners with estimated USD cost. Answers 'which agent burned the most tokens', 'what did this workflow/wave/pipeline cost', 'token breakdown', 'per-operation tokens', and any retrospective spend analysis. Triggered by 'token ledger', 'token attribution', 'heaviest token burner', 'which agent burned the most tokens', 'what did the run/workflow/wave cost', 'token breakdown', 'per-agent tokens', 'per-operation tokens'. Complements /pcm:context-meter: that audits STATIC context size, this covers RUNTIME spend attribution — route static-budget questions to context-meter, after-the-fact spend questions here.
Code hygiene audit — ghost fields, dead code, deps, arch, types, naming, quality. Domain-hydrated at install time.
Exhaustive multi-angle analysis. Invoked by `360`, `three-sixty`, `do a 360`, "what could go wrong", or explicit blind-spot sweep requests.
RND goal-driven iteration. Invoked by `RND`, `research and develop`, `iterate until`, or "find the best approach for" a testable outcome.
| name | audit:security |
| description | Security deep scan — injection, auth, API, LLM/prompt, sensitive data, crypto, transport, supply-chain. Domain-hydrated at install time. |
Read .claude/commands/audit/security.md in full — it is the source-of-truth protocol. Follow it verbatim.
