397건 · 관련도순
Maintain user-owned GPG and SSH public-key parsing, profile API registration, identity database persistence, format compatibility, and maintained OpenPGP dependencies. Excludes portal signing-key publication and admin private-key export.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use for .NET application development involving services, managers, dependency injection, Microsoft.Extensions.Hosting, dependency direction, MiniDb persistence, DTOs, Mapster mapping, shared entities/helpers, MCP tools, module workflows, solution analysis, cancellation, logging, and logic shared by CLI and Blazor.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for enterprise mail abuse, OAuth consent, inbox or forwarding rules, transport rules, shared mailbox access, phishing chains, and token-to-mailbox side effects. Use when the user asks to trace mailbox rules, OAuth consent grants, forwarding or delegate abuse, shared mailbox access, message-trace evidence, or explain how mail artifacts turn into persistence, exfiltration, or privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for DFIR chronology, cross-artifact correlation, persistence chains, and incident timeline reconstruction. Use when the user asks to build a forensic timeline, correlate EVTX, PCAP, registry, disk, memory, mailbox, or browser artifacts, explain the order of attacker actions, or pinpoint the stage where the decisive artifact appears. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Network reachability and pivoting after an operator already has a foothold. Use to make previously unreachable hosts, subnets, services or listener directions reachable via Ligolo-ng, Chisel, GOST v3, SSH/native forwarding, socat/netsh, Microsoft Dev Tunnels, DNS/HTTP/QUIC fallback transports, and multi-hop routing. This module does not exploit services, obtain credentials, or own C2/persistence. Its success condition is changed reachability: the operator can route/connect to the intended internal network/service through the selected foothold.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Active Directory exploitation after domain credentials exist: Kerberos (AS-REP/Kerberoast including cracking the ticket then using the account), delegation, NTLM coercion/relay, lateral movement, ACL abuse, ADCS ESC1-ESC17 and CVE paths, dMSA/BadSuccessor, Kerberos reflection, identity confusion, management-plane, domain trust, and domain persistence. Own the current AD chain through crack-and-use to DA, equivalent domain control, or the targeted host SYSTEM. Do not stop after requesting TGS. Host C2 belongs to /post. Operator chooses next modules.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Kubernetes and container exploitation: identity/RBAC, secrets, kubelet/etcd, managed-cloud workload identities, container-to-node escape including CVE-2026-31431 Copy Fail, and Kubernetes-native persistence. Use when already in a Pod/container or holding kubeconfig. Own the chain to cluster-admin, node root, or a usable cloud identity. Operator chooses next modules. Endpoint blocks after OS execution hand off to /edr-bypass then return.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Evaluates signal half-life, turnover implications, and capacity constraints for systematic alpha factors. Use when analyzing signal persistence, evaluating factor decay, or estimating strategy capacity.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Spring Boot coding conventions: REST controller design, service layer, dependency injection, configuration, DTO patterns, exception handling, and Bean Validation. Apply on any Spring Boot project. Works alongside spring-boot-plugin:spring-data-jpa for persistence and java-foundation:java-conventions for domain objects. Use this skill to: - Structure REST endpoints with @RestController, proper HTTP semantics, and DTO mapping. - Enforce constructor injection and @ConfigurationProperties over @Value on fields. - Write @Service classes with transactional boundaries at the right layer. - Handle errors consistently with @RestControllerAdvice and ProblemDetail (RFC 9457). Do NOT use this skill for: - JPA entity and repository patterns — see spring-boot-plugin:spring-data-jpa. - Spring Security configuration — see the security phase injection in stack.md. - Build tool configuration — see java-foundation:build-tooling.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Class interfaces present one cohesive abstraction - don't mix domain logic with serialization, persistence, or unrelated concerns
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Deploy a self-hosted SearXNG meta search engine via Docker Compose. Covers settings.yml configuration, engine selection, result proxying, Nginx frontend, persistence, and updates. Use when setting up a private search engine without tracking, aggregating results from multiple providers, running a shared search instance for a team or organisation, or replacing reliance on a single search provider.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Produce a visible, evidence-backed privacy and security report for a local iOS app by scanning permission declarations, network code, dependencies, persistence, and risky APIs, while complementing the official Claude Code security-guidance plugin. Use after implementation, in a live security lane, or before claiming that an app is offline and account-free.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when the user and agent may hold different pictures of current state after a gap, sync request, or exposed stale claim. Not for persistence: use memory-update.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Work with the @upstash/redis TypeScript/JavaScript SDK, a serverless HTTP-based Redis client for Next.js, Vercel, Cloudflare Workers, edge runtimes, and Node.js. Use when adding a cache (cache-aside, write-through, TTL and expiration strategies), session storage and user sessions, a key-value store, leaderboards and rankings with sorted sets, counters, distributed locks, queues with lists, streams and consumer groups, sparse index-addressed arrays and ring buffers (ARSET, ARINSERT, ARRING, ARGREP, AROP), embeddings and nearest-neighbour vector search stored inside Redis (VECTOR commands via redis.vector, separate from @upstash/vector), JSON documents, pipelines and MULTI/EXEC transactions, Lua scripting, read replicas, or full-text search, typo-tolerant search, facets, aggregations, and search over Redis stream entries with Upstash Redis Search (different from regular FT.SEARCH; also available for TCP clients via @upstash/search-redis and @upstash/search-ioredis). Also use when migrating from ioredis or node-redis, when a Redis connection is needed from a serverless function without connection pooling, when integrating @upstash/ratelimit, or when the user says Redis cache, KV store, session store, serverless Redis, or Upstash Redis. Also use when building AI agents on Redis with Upstash AgentKit (agent memory, chat history, RAG tools, tool caching, chat persistence, resumable streams, distributed locks) for the Vercel AI SDK, TanStack AI, or Vercel Eve. Supports automatic serialization/deserialization of JavaScript types.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Build or review distributed .NET applications with Orleans grains, silos, persistence, streaming, reminders, placement, transactions, serialization, event sourcing, testing, and cloud-native hosting.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Authorized exploit development and vulnerability research skill for lab environments, CTFs, owned software, crash analysis, memory corruption, exploitability assessment, fuzzing results, proof-of-concept design, and remediation. Use for defensive validation and education; avoid real-world weaponization, stealth, persistence, evasion, or unauthorized targets.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Forensic scan for npm/PyPI supply-chain compromise (Shai-Hulud/TeamPCP campaigns) — checks persistence, hook injection, compromised packages, IOC strings, C2, dead-man switches. Use when auditing a machine or repo for malicious dependencies. Trigger on "supply chain audit", "check for compromised packages", "Shai-Hulud", "scan for malicious deps".
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Pinia stores, Vue 3 state patterns. Use when managing client state in Vue applications, choosing between Options/Setup stores, composing stores, or implementing persistence.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
MMKV high-performance key-value storage for React Native - synchronous JSI-based reads/writes, encryption, typed hooks, multiple instances, listeners, persistence middleware adapters
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Tauri 2.x multi-window creation, event system, window state persistence, parent/child and modal windows
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Multi-window management, WebContentsView, BaseWindow, window lifecycle, inter-window communication, state persistence
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Frameless windows, custom title bars, tray, menus, dock badges, vibrancy, kiosk mode, window state persistence
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Post-exploitation workflow. Covers privilege escalation (Linux SUID/sudo/kernel, Windows UAC/service/token), persistence assessment, local enumeration, credential harvesting, and pivot preparation. Structured workflows for Linux and Windows targets using impacket, netexec, john, linpeas/winpeas, and standard Kali tools. Includes kernel exploit reference tables, GTFOBins exploitation chains, Potato attack selection, Docker/container escapes, DLL hijacking, SSH key harvesting, credential recovery from memory, and Windows token manipulation. Chains from /pentester or /credential-audit when access is obtained.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Deep OAuth 2.0 / OpenID Connect security assessment. Covers the full attack surface: redirect_uri validation bypass (path traversal, open redirect chains, subdomain confusion, URL parsing tricks, parameter pollution, response mode switching), missing/broken state parameter CSRF, PKCE downgrade and absent-challenge attacks, implicit grant token leakage (Referer, browser history, XSS fragment theft), authorization code injection, scope escalation, client confusion attacks, mutable-claims account takeover (iss+sub confusion, email-keyed identity merging), pre-account takeover via unverified registration, OpenID Connect dynamic client registration SSRF (logo_uri, jwks_uri, sector_identifier_uri, request_uri), nonce replay, ID token validation failures, Device Code phishing flow, mobile custom URI scheme hijacking, refresh token persistence, token introspection enumeration, consent screen clickjacking, host header injection, and cross-IdP mix-up attacks. Uses KOAuth, jwt_tool, nuclei oauth templates, and manual http(action="request", ...) payloads. Every technique includes actual request payloads and verification logic. Chains from /pentester or /api-security when OAuth endpoints are discovered. Chains into /web-exploit for open redirect, XSS, and SSRF chaining. Chains into /post-exploit when full account takeover is achieved. Chains into /credential-audit when access tokens or refresh tokens are recovered.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.