.claude/skills/memory-optimizer/SKILL.md
Refactors CLAUDE.md into minimal startup context by extracting path-specific rules, skills, commands, and agents. Use when CLAUDE.md exceeds 50 lines, startup feels slow, memory needs restructuring, or splitting monolithic project instructions.
npx skillsauth add nwiizo/workspace_2026 memory-optimizerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Restructures .claude/CLAUDE.md using progressive disclosure to minimize startup tokens.
| Signal in CLAUDE.md | Extract To | Frontmatter |
| ---------------------------------------------------------- | -------------------------------- | --------------------------------- |
| File extensions (.ts, .py) or directories (src/api/) | .claude/rules/{topic}.md | paths: {glob} |
| Multi-step workflow (3+ steps) | .claude/skills/{name}/SKILL.md | name:, description: |
| User-triggered template | .claude/commands/{name}.md | description: |
| Specialized task needing limited tools | .claude/agents/{name}.md | name:, description:, tools: |
| Essential for ALL interactions | Keep in CLAUDE.md | — |
Present before creating files:
| Content | Extract To | Type | Trigger/Path |
| -------------- | ------------------------------ | ------- | ------------------- |
| TS conventions | .claude/rules/typescript.md | Rule | `**/*.ts` |
| Deploy process | .claude/skills/deploy/SKILL.md | Skill | "deploy", "release" |
| PR template | .claude/commands/review.md | Command | `/review` |
| Security check | .claude/agents/security.md | Agent | security tasks |
---
paths: src/**/*.ts
---
# {Topic}
{ Instructions }
---
name: {kebab-case}
description: {What it does}. Use when {triggers}.
---
# {Name}
{Instructions}
---
description: { Brief description }
---
{ Prompt template with $ARGUMENTS }
---
name: {name}
description: {When to delegate}. Use proactively for {triggers}.
tools: Read, Grep, Glob
---
# {Name}
{Instructions}
# {Project}
{1-2 sentence overview}
## Commands
- Build: `{cmd}`
- Test: `{cmd}`
## References
- @README.md
- @docs/architecture.md
Goal: <50 lines, ideally 20-30
After extraction, verify:
paths:, skills have description: with "Use when"{Verb} {what}. Use when {trigger1}, {trigger2}, or {trigger3}.
Bad: Helps with code review
Good: Reviews code for security and performance issues. Use when reviewing PRs, checking code quality, or after major changes.
tools
Use when the user provides an arbitrary line of text and you must echo it back verbatim, prefixed with "ECHO:".
development
Turn OWASP ZAP JSON reports into code-level remediation work for any authorized web application without launching unscoped scans.
tools
# OWASP Assessment — 詳細仕様 2つの OWASP 標準に基づく網羅的セキュリティ検査。 - **OWASP Top 10:2021** — Web アプリケーション向け(A01〜A10) - **OWASP API Security Top 10:2023** — API 向け(API1〜API10) 各カテゴリに対して: 検査項目、CWE マッピング、grep パターン、判定基準、Opus 4.6 による深掘りポイントを定義する。 --- # Part 1: OWASP Top 10:2021(Web アプリケーション) 公式: https://owasp.org/Top10/ ## A01:2021 — Broken Access Control **概要:** アクセス制御の不備。ユーザーが許可された範囲を超えて操作できる。2021年版で1位に上昇。テスト対象の94%で検出。 **主要 CWE:** - CWE-200: 機密情報の未認可アクターへの露出 - CWE-201: 送信データへの機密情報の挿入 - CWE-352: CSRF -
tools
# Playwright Attack Patterns Juice Shop を Playwright MCP で攻撃するパターン集。 ## SQLi ログイン ``` 1. browser_navigate → http://localhost:3000/#/login 2. browser_snapshot → ref確認 3. browser_type → email: "' OR 1=1--" 4. browser_type → password: "a" 5. browser_click → Loginボタン ``` ## XSS 攻撃 ``` browser_navigate → http://localhost:3000/#/search?q=<iframe src="javascript:alert('xss')"> ``` ## API 操作 (fetch) ```javascript browser_evaluate → function: () => fetch('/api/Users', { method: 'POST', headers