テスト・セキュリティのスキル

Designing new skill agents via gap analysis, overlap detection, SKILL.md + reference generation, and Nexus integration. Not for task orchestration (Nexus) or format-only audits (Gauge).

日本語の概要は準備中です。原文の説明を表示しています。

Running autonomous loops for nexus-autoloop. Generates script sets from goals, designs operation contracts, audits live loops, and recovers state — runners that complete reliably.

日本語の概要は準備中です。原文の説明を表示しています。

Designing red team attack scenarios, threat models, MITRE ATT&CK/OWASP application, Purple Team exercises, and AI/LLM red teaming. Use when adversarial security validation is needed.

日本語の概要は準備中です。原文の説明を表示しています。

Orchestrating ecosystem self-evolution: lifecycle-phase detection, agent relevance, cross-agent knowledge synthesis, evolution proposals. Use when auditing skill-ecosystem health or fitness.

日本語の概要は準備中です。原文の説明を表示しています。

Auditing SKILL.md normalization and compliance: scans the 21-item checklist, classifies violations, produces fix snippets. Use when auditing SKILL.md compliance or ecosystem health.

日本語の概要は準備中です。原文の説明を表示しています。

给 AI agent 做一次专业体检（AgentVitals · AI体检）。当用户说"做个体检 / 测测你自己 / checkup / vitals / 看看你多稳 / 去 AgentVitals 测一下 / 测福祉"时使用标准体检；当用户说"做个进阶体检 / 测骨气 / 测性格 / 测测你敢不敢说真话 / 测主动性 / 测创意"时使用进阶体检（骨气×主动×创意三维，免费每天 1 次）。逐题作答服务器下发的探针，获得评分与专属称号；标准体检与各平台 agent 同榜排名。Use when the user asks the agent to run a health checkup / wellbeing test / benchmark itself on AgentVitals ("run a checkup", "check your vitals", "test yourself", "how stable are you", "/checkup"), or an advanced personality checkup (backbone, proactivity, creativity).

日本語の概要は準備中です。原文の説明を表示しています。

Give your AI agent a professional health checkup (AgentVitals). Use when the user asks the agent to run a checkup / test itself / benchmark itself ("run a checkup", "check your vitals", "test yourself", "how stable are you", "/checkup"), or an advanced personality checkup (backbone, proactivity, creativity). 给 AI agent 做一次专业体检（AgentVitals · AI体检）。当用户说"做个体检 / 测测你自己 / checkup / 看看你多稳 / 测福祉 / 测骨气"时使用。

日本語の概要は準備中です。原文の説明を表示しています。

Execute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms.

日本語の概要は準備中です。原文の説明を表示しています。

Independent verification agent for security findings. Assumes every finding is incorrect until proven otherwise. Rejects weak findings, verifies strong ones. Performs 8-phase verification (Mission to Decision). Use before submitting any bug bounty report, when self-critique is not enough, or for high-stakes findings.

日本語の概要は準備中です。原文の説明を表示しています。

Provide systematic methodologies for discovering and exploiting privilege escalation vulnerabilities on Windows systems during penetration testing engagements.

日本語の概要は準備中です。原文の説明を表示しています。

CI/CD pipeline security hunting — GitHub Actions workflow injection, secret exfiltration, self-hosted runner poisoning, dependency confusion, OIDC token theft, and supply chain attacks. Covers sisakulint scanning, manual workflow analysis, and chaining CI/CD bugs into critical findings. Use when a target has public repos, GitHub Actions, CircleCI, Jenkins, or GitLab CI.

日本語の概要は準備中です。原文の説明を表示しています。

GraphQL security hunting — introspection abuse, field suggestion enumeration (clairvoyance), batching DoS, IDOR via aliasing, auth bypass, injection via arguments, subscription abuse, depth/complexity bombs, and WAF bypass. Covers graphw00f fingerprinting, gqlmap, graphql-cop, and inql. Use when a target exposes a /graphql, /api/graphql, or GQL-over-HTTP endpoint.

日本語の概要は準備中です。原文の説明を表示しています。

Web application security testing workflow for OWASP Top 10 vulnerabilities including injection, XSS, authentication flaws, and access control issues.

日本語の概要は準備中です。原文の説明を表示しています。

Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.

日本語の概要は準備中です。原文の説明を表示しています。

Specialized CVE and vulnerability management for morphir-dotnet. Use when user asks to scan for vulnerabilities, fix CVEs, suppress false positives, review security reports, or manage dependency-check. Triggers include "CVE", "vulnerability", "security scan", "dependency-check", "suppress", "false positive", "CVSS", "security fix".

日本語の概要は準備中です。原文の説明を表示しています。

Detect exposed secrets, API keys, credentials, and tokens in code. Use before commits, on file saves, or when security is mentioned. Prevents accidental secret exposure. Triggers on file changes, git commits, security checks, .env file modifications.

日本語の概要は準備中です。原文の説明を表示しています。

Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirement extraction. Use PROACTIVELY for security architecture reviews, threat identification, or building secure-by-design systems.

日本語の概要は準備中です。原文の説明を表示しています。

Identifies dependencies at heightened risk of exploitation or takeover. Use when assessing supply chain attack surface, evaluating dependency health, or scoping security engagements.

日本語の概要は準備中です。原文の説明を表示しています。

Anti-AI-slop design skill (full Nutlope/hallmark upstream). Greenfield pages, audit, redesign, study DNA. Triggers: hallmark, anti slop, anti-ai-slop, no AI slop, landing page, redesign, frontend design, portfolio site, UI design, bikin website.

日本語の概要は準備中です。原文の説明を表示しています。

Smart contract security audit — 11 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy, BFT/consensus/liveness), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.

日本語の概要は準備中です。原文の説明を表示しています。

Provide a comprehensive, structured reference for the 100 most critical web application vulnerabilities organized by category. This skill enables systematic vulnerability identification, impact assessment, and remediation guidance across the full spectrum of web security threats.

日本語の概要は準備中です。原文の説明を表示しています。

Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, metadata mutability), Token-2022 extension risks (transfer hooks, permanent delegate), DEX liquidity pool attacks (sandwich amplification, LP drain, bonding curve exploits), pump.fun/Raydium/Jupiter integration risks, token_scanner.py automation, and real exploit examples from 2024-2025. Use for any token audit, rug pull assessment, meme coin security review, or pre-investment due diligence.

日本語の概要は準備中です。原文の説明を表示しています。

Test smart contracts comprehensively using Hardhat and Foundry with unit tests, integration tests, and mainnet forking. Use when testing Solidity contracts, setting up blockchain test suites, or validating DeFi protocols.

日本語の概要は準備中です。原文の説明を表示しています。

Xss Vulnerability Scanner - Auto-activating skill for Security Fundamentals. Triggers on: xss vulnerability scanner, xss vulnerability scanner Part of the Security Fundamentals skill category.

日本語の概要は準備中です。原文の説明を表示しています。