メニュー
Phase 3 of security audit pipeline. Writes a failing test that reproduces the top vulnerability from the ranked backlog. Invoke with '/3-security-spec' after Phase 2 is complete. Do NOT fix code — just write the test.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/opsMachine/OM-Agency --skill 3-security-specコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SOC 職業分類に基づく
SKILL.md を表示中
| name | 3-security-spec |
| description | Phase 3 of security audit pipeline. Writes a failing test that reproduces the top vulnerability from the ranked backlog. Invoke with '/3-security-spec' after Phase 2 is complete. Do NOT fix code — just write the test. |
| contract | {"tags":["security","audit","security-phase-3","tdd"],"state_source":"security_plan","inputs":{"params":[],"gates":[{"field":"backlog","value":"Ranked"}]},"outputs":{"mutates":[{"field":"current_item.test","sets_to":"Written"}],"side_effects":["Creates test file"]},"next":["4-security-fix"],"human_gate":false} |
Write a failing test that proves the top vulnerability exists. This is the red phase — do not touch the application code.
Read SECURITY_PLAN.md. Pick the top Pending (not DONE) item from the ranked backlog.
Write a test that reproduces the vulnerability.
tests/security/exploit_repro.test.ts)Run the test. Confirm it fails for the right reason (the vulnerability, not a syntax error).
Stop. Report the test file path and what it proves.
The next step is Phase 4: /4-security-fix
Performs comprehensive, brutally honest full-codebase review as a grumpy but fair senior developer with 20+ years of experience. Use when the user asks for a grumpy dev code review, brutal code review, senior dev review, comprehensive codebase audit, hall-of-shame code smells, or a gut-check on the entire project (not just a PR diff).
Diagnose and fix OneCLI gateway issues — Docker not running, 407 proxy auth, 401 from API (MITM not active), stale aoc_ token, CA cert refresh, secret setup, version pinning. Use when onecliStart fails, update-fathom-db fails, proxy returns 407 or 401, mode=tunnel in logs, or after OneCLI container recreation.
ANY CRM or progress.md write, log call, add contact, pipeline lookup, paste transcript/email. Runs lifecycle routing in Step 0 — delivery work goes to progress.md not Won CRM Next Action. Query before create. For week view use week-scan not this skill. OM-Repo SKILLS-MAP.md.