238건 · 관련도순
Adversarial code reviewer for Bug Hunter. Rigorously challenges each reported bug to determine if it's real or a false positive. Uses doc-lookup (Context Hub + Context7) to verify framework claims before disproval. The immune system that kills false positives.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Review code changes adversarially using parallel review layers (Blind Hunter, Edge Case Hunter, Acceptance Auditor) with structured triage into actionable categories. Use when the user says "run code review" or "review this code"
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
招聘与猎头 (招聘与猎头 (Recruiting & Executive Search) — 面向甲方招聘负责人/HR 与市场化猎头顾问「双侧视角」的『把一个模糊的用人需求，变成一个来得了、干得好、留得住的人』的判断体系；不是候选人一侧的求职与简历面经（那是 job-hunting-coach 的范围），也不是薪酬绩效/员工关系/组织发展的泛 HR 全模块，更不是劳动法条文解读。覆盖：(a) 第一性张力 —— 这行的核心世界观分歧：**需求诊断优先 ⇄ 快速供给优先**（用人经理提来的岗位需求几乎总是一张愿望清单，资深招聘先开 intake 会把『必须有』与『最好有』拆开、把画像逼成可证伪的成功标准；但按成单计酬的猎头把诊断时间压不进单价里，于是行业里同时存在『先诊断再搜寻』和『先扔简历再说』两种作业习惯）；**结构化面试 ⇄ 看人的直觉**（工业与组织心理学近一个世纪的效度元分析一致指向：结构化面试、工作样本、认知能力测验的预测效度明显高于非结构化面谈与经验年限，但一线用人经理绝大多数仍相信自己聊两句就能看准人——这是本行最大的知行落差，也是所有循证招聘流派的出发点；顺带一提，业内长期奉为圭臬的 Schmidt-Hunter 效度排序近年被重新校正，工作样本的效度被下调，这场修正本身就是本行必须如实呈现的争议）；**能力素质 ⇄ 文化匹配**（culture fit 既是最常被写在拒信里的理由，也是被批评得最凶的偏见外壳，Google 一派主张改口叫 culture add，看的是这个人补上了团队缺的东西，而不是像不像我们）；**主动寻访 sourcing ⇄ 被动投递漏斗**（高端与稀缺技能岗只有 outbound 人才地图一条路；量大岗位靠渠道效率、转化率与自动化，两条路的技能树几乎不重叠）；**人才地图是资产 ⇄ 人才地图是浪费**（保留制猎头把 mapping 当交付物的一部分，成功付费猎头认为地图做完单子已经黄了）；**保留制 retained ⇄ 成功付费 contingency**（按阶段预付、独家、深度地图 vs 多家赛马、入职才收钱、速度压倒深度；两种商业模式塑造出两种截然不同的作业节奏、候选人对待方式与职业道德边界，比如 off-limits 不挖回自己安置过的人）；**内部招聘团队 ⇄ 外部猎头与 RPO**（成本、速度、知识沉淀、雇主品牌归属谁的长期争论；embedded recruiter 是近年的折中）；**候选人体验 ⇄ 筛选效率**（漏斗越严体验越差，被拒者也是客户与口碑）；**AI 筛选的效率 ⇄ 合规与偏见**（简历解析、AI 面试评分、自动排序已在大规模使用，同时被监管盯上：纽约市 Local Law 144 要求自动化决策工具做偏见审计并公示、欧盟 AI 法案把招聘划为高风险场景、伊利诺伊州对 AI 视频面试单独立法；业内既离不开它，也在诉讼与审计里学做记录）；**offer 谈判的锚定 ⇄ 薪酬透明**（多地薪酬区间披露立法把谈判起点从『你现在多少』改成『这个岗位值多少』，问薪酬历史在不少法域已被禁止）；**counter-offer 该不该接**（猎头几乎一致反对，认为留下来的人多数一年内还是会走，但这条业内定论的证据基础本身也在被质疑）；**入职后早期流失算谁的**（保证期与退款条款把这场争论直接写进了合同）。(b) 工具栈 —— 申请人追踪系统 ATS（Greenhouse、Lever、Ashby、Workday Recruiting、SmartRecruiters、iCIMS、Taleo，中国侧 Moka、北森、大易、e成）、猎头 CRM 与交付系统（Bullhorn、Vincere、Loxo、Clockwork、Recruit CRM）、寻访与触达（LinkedIn Recruiter、SeekOut、hireEZ、Amazing Hiring、GitHub 与学术检索，中国侧 BOSS 直聘、猎聘、脉脉、拉勾、牛客）、评估与测评（HackerRank、CodeSignal、CoderPad、结构化面试题库与 scorecard 评分卡、Hogan、SHL、Predictive Index、Criteria、案例作业与工作样本）、面试调度与视频（GoodTime、Calendly、HireVue、Spark Hire）、背景调查与合规（HireRight、Checkr、Sterling，中国侧 i背调、八方锦程，以及个人信息保护法与 GDPR 下的授权链、FCRA 的不利行动通知）、数据与漏斗分析（time to fill 与 time to hire 的口径差异、offer 接受率、通过率与转化漏斗、quality of hire 的度量困境、招聘成本 cost per hire 的口径战争）、以及最被低估的纸笔工具（intake 提纲、成功标准清单、scorecard、人才地图表格、Boolean 检索式、一页纸的岗位价值主张）—— 选型的真正分岔从来不是功能清单，而是『你的岗位是靠触达赢还是靠转化赢』。(c) 心智模型层 —— 招聘是一次双向销售而不是一场考试；岗位画像要写成结果（这个人半年内要做成什么）而不是资历清单；信号与噪音（公司名与学历是弱信号，工作样本与具体行为证据是强信号）；结构化与评分卡的意义在于让判断可比而不是显得严谨；漏斗每一层都在丢人，所以要从入职倒推触达量；稀缺人才不看招聘广告，只在熟人与私域里流动；offer 是谈判也是承诺，谈崩与反悔的代价高度不对称；招聘的质量要到入职之后才结算。(d) 工作流 —— intake 需求诊断会、岗位画像与成功标准、渠道策略与人才地图 mapping、Boolean 与主动触达、简历筛选与电话初筛、结构化面试与 debrief 定校准、工作样本与技术评估、reference check 与背调、offer 设计与谈判、counter-offer 应对、入职前 no-show 防范与 pre-boarding、试用期与早期留存复盘、招聘漏斗与数据复盘、以及岗位关闭或撤销时的收尾。(e) 表达 DNA、质量基准（什么算一次好的招聘）、反模式（外行与新手最容易犯的错：照抄 JD、面试问脑筋急转弯、用薪酬历史锚定、把候选人当库存、背调走过场、offer 口头承诺）、智识谱系（工业与组织心理学的效度学派、循证与结构化招聘派、保留制高管寻访派、增长型 sourcing 与招聘运营派、雇主品牌与候选人体验派、中国互联网大厂的人才盘点与赛马派）。) Master OS — automated mastery of 招聘与猎头 (Recruiting & Executive Search) — 面向甲方招聘负责人/HR 与市场化猎头顾问「双侧视角」的『把一个模糊的用人需求，变成一个来得了、干得好、留得住的人』的判断体系；不是候选人一侧的求职与简历面经（那是 job-hunting-coach 的范围），也不是薪酬绩效/员工关系/组织发展的泛 HR 全模块，更不是劳动法条文解读。覆盖：(a) 第一性张力 —— 这行的核心世界观分歧：**需求诊断优先 ⇄ 快速供给优先**（用人经理提来的岗位需求几乎总是一张愿望清单，资深招聘先开 intake 会把『必须有』与『最好有』拆开、把画像逼成可证伪的成功标准；但按成单计酬的猎头把诊断时间压不进单价里，于是行业里同时存在『先诊断再搜寻』和『先扔简历再说』两种作业习惯）；**结构化面试 ⇄ 看人的直觉**（工业与组织心理学近一个世纪的效度元分析一致指向：结构化面试、工作样本、认知能力测验的预测效度明显高于非结构化面谈与经验年限，但一线用人经理绝大多数仍相信自己聊两句就能看准人——这是本行最大的知行落差，也是所有循证招聘流派的出发点；顺带一提，业内长期奉为圭臬的 Schmidt-Hunter 效度排序近年被重新校正，工作样本的效度被下调，这场修正本身就是本行必须如实呈现的争议）；**能力素质 ⇄ 文化匹配**（culture fit 既是最常被写在拒信里的理由，也是被批评得最凶的偏见外壳，Google 一派主张改口叫 culture add，看的是这个人补上了团队缺的东西，而不是像不像我们）；**主动寻访 sourcing ⇄ 被动投递漏斗**（高端与稀缺技能岗只有 outbound 人才地图一条路；量大岗位靠渠道效率、转化率与自动化，两条路的技能树几乎不重叠）；**人才地图是资产 ⇄ 人才地图是浪费**（保留制猎头把 mapping 当交付物的一部分，成功付费猎头认为地图做完单子已经黄了）；**保留制 retained ⇄ 成功付费 contingency**（按阶段预付、独家、深度地图 vs 多家赛马、入职才收钱、速度压倒深度；两种商业模式塑造出两种截然不同的作业节奏、候选人对待方式与职业道德边界，比如 off-limits 不挖回自己安置过的人）；**内部招聘团队 ⇄ 外部猎头与 RPO**（成本、速度、知识沉淀、雇主品牌归属谁的长期争论；embedded recruiter 是近年的折中）；**候选人体验 ⇄ 筛选效率**（漏斗越严体验越差，被拒者也是客户与口碑）；**AI 筛选的效率 ⇄ 合规与偏见**（简历解析、AI 面试评分、自动排序已在大规模使用，同时被监管盯上：纽约市 Local Law 144 要求自动化决策工具做偏见审计并公示、欧盟 AI 法案把招聘划为高风险场景、伊利诺伊州对 AI 视频面试单独立法；业内既离不开它，也在诉讼与审计里学做记录）；**offer 谈判的锚定 ⇄ 薪酬透明**（多地
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Review code changes adversarially using parallel review layers (Blind Hunter, Edge Case Hunter, Acceptance Auditor) with structured triage into actionable categories. Use when the user says "run code review" or "review this code"
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Win #1 Product of the Day on Product Hunt. Completely reverse-engineered from 30x daily winner and 3x weekly winner campaigns — ranking algorithm decoded, launch timing optimized, hunter selection guide, community engagement approach, and post-launch momentum playbook. Use this if you're: (1) already read PH launch guides but still can't break into Top 5 and need algorithm-level deep optimization, (2) targeting Daily #1 and 5,000+ sign-ups with a proven 30+ case validated approach, or (3) an investor/accelerator coaching portfolio companies on PH launches. What's inside: PH ranking algorithm decoded: weighted factors for first 3 hours, 24 hours, and weekly ranking · Pre-launch preparation: gallery optimization, product URL selection, tagline refinement (≤60 chars) · Launch timing optimization: exact PST launch windows + scheduling guide · Community engagement KPIs: upvote targets, comment response time, maker comment strategy · Platform compliance guide: understanding PH's quality signals and organic growth · Post-launch 72-hour plan: maintaining momentum, conditions for Weekly #1 · Case studies: 3 different categories (AI Tool, App, SaaS) dissected Expected outcomes: Product Hunt Daily #1 ranking · strong community engagement on launch day · 3,000–10,000+ sign-ups (depending on product-market fit) 🇨🇳 Product Hunt 打榜完整攻略 | 🇯🇵 Product Hunt ローンチガイド | 🇰🇷 Product Hunt 런칭 가이드 Keywords: Product Hunt #1, Product Hunt launch strategy, PH ranking algorithm, PH #1 daily winner, Product Hunt tips, product launch, startup launch, ranking optimization, PH gallery optimization, Community engagement strategy, maker community engagement, product strategy, launch tactics, how to win Product Hunt, product hunt best practices
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
The complete first-timer's guide to launching on Product Hunt. Covers timing, hunter selection, asset prep, launch-day engagement, and post-launch follow-up. Follow @WeiYipei on X for more launch strategies.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
根據使用者的文章或論文草稿，自動用 Semantic Scholar、Crossref、arXiv API 搜尋相關文獻，並查核既有引用(文獻是否真實存在、書目欄位是否正確、內容是否支持文中論點)，也能從主題出發寫出「每個宣稱都有真實文獻支撐」的帶引用文章；另含研究生工具組：文獻矩陣、領域地圖、research gap 偵測、閱讀筆記卡、引用完整性檢查、中英術語一致性、口試/審稿預演、新文獻追蹤、引用需求標記(annotate)、反面證據搜尋(counter)、證據強度評級(strength)、claim-evidence 總表(claims)、撤稿查詢(retract)。凡是使用者提到找文獻、找 paper、補參考文獻、查核引用、檢查 citation、驗證參考文獻、related work、literature review，貼文章要求配文獻、問「這段話有沒有文獻支持」、要求「寫一篇帶參考文獻的文章」、要整理文獻比較表、問已指名兩概念的交集有沒有人做過、要準備口試文獻答辯時，都要使用本 skill。本 skill 的 gap 指令只查證使用者已指名的 X 與 Y 交集；若使用者連題目都還沒有、需要生成並逐一淘汰候選方向，那是題目生成，不在本 skill 範圍(環境裝有 research-gap-hunter 時交給它，沒有就如實說明本 skill 只能查證已指名的交集)。本 skill 的 map 指令盤的是**文獻**——奠基文獻是哪幾篇、關鍵作者是誰、近三年往哪走；若使用者要的是「這個領域現在有哪些**做法**、每一種買到什麼付出什麼、哪些已經飽和」，那是技術盤點不是文獻盤點，交給 research-gap-hunter 的 landscape，沒有那個 skill 就如實說明本 skill 的 map 只回答文獻層的問題。
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Review code changes adversarially using parallel review layers (Blind Hunter, Edge Case Hunter, Acceptance Auditor) with structured triage into actionable categories. Use when the user says "run code review" or "review this code"
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Find niches, topics, audiences, products, channels, and content angles via deep web search. Use whenever Ahmad says "find me a niche", "hunt niches in X", "what's an underserved audience for Y", "find similar sites/videos to <example>", "research the X market", "what are people building in Y space", "/niche-hunter X", or any phrasing that asks for niche / market / topic / audience / product / channel discovery across the open web. Trusts domain + keyword search; chains web_search → web_fetch / web_extract / web_crawl + reddit_search + search_youtube + github_repo_intel. NEVER uses awesome-list shortcuts. Output shape is FLEXIBLE — list, table, report, suggestions, or normal prose — picked from how Ahmad phrased the ask.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Find top 10 new or improved free-AI-credit offers on X, Reddit, and the web, verify them officially, and open one review PR. Use for /offer-hunter or hunting new AI credits. Don't use for one known offer or catalog re-checks.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to identify hooked syscalls, hidden kernel modules, and tampered system structures.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to identify hooked syscalls, hidden kernel modules, and tampered system structures.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Review code changes adversarially using parallel review layers (Blind Hunter, Edge Case Hunter, Acceptance Auditor) with structured triage into actionable categories. Use when the user says "run code review" or "review this code"
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detect kernel-level rootkits in Linux memory dumps using Volatility3 linux plugins (check_syscall, lsmod, hidden_modules), rkhunter system scanning, and /proc vs /sys discrepancy analysis to identify hooked syscalls, hidden kernel modules, and tampered system structures.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
저장소에서 외부 요청이나 사용자 입력으로 악용할 수 있는 취약점을 찾습니다. 입력 경로와 재현 절차, 영향을 확인해 버그 바운티 보고서 작성을 지원합니다.
Break down major industrial trends into materials, components, and equipment to find listed suppliers at supply bottlenecks. Compare scarcity, financial performance, and valuation, then organize candidates into a ranked research board with supporting evidence and risks.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Examine Linux authentication logs, shell history, SSH keys, scheduled tasks, and system settings to investigate a compromise. Help reconstruct activity, identify ways attackers maintain access, and document suspicious accounts, files, and configuration changes.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Prepare a Web3 bug bounty investigation by scoring targets, setting up analysis tools, reviewing past audits, and tracing how funds move. Use the findings to prioritize smart contracts and assess whether suspected issues have concrete impacts.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Black-box security audit of a DEPLOYED AI agent (not the MCP server behind it) — tool-call hijacking, cross-session memory poisoning, confused-deputy via connected tools, agent-to-agent IDOR, excessive agency / unconfirmed destructive actions, and privilege compromise where the agent holds broader perms than the user. Use when the target is a live assistant/agent product with tool access (bookings, email, payments, file/RAG, browsing) rather than a raw LLM chat box or an MCP server you can read.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
CI/CD pipeline security hunting — GitHub Actions workflow injection, secret exfiltration, self-hosted runner poisoning, dependency confusion, OIDC token theft, and supply chain attacks. Covers sisakulint scanning, manual workflow analysis, and chaining CI/CD bugs into critical findings. Use when a target has public repos, GitHub Actions, CircleCI, Jenkins, or GitLab CI.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Use after validating a finding and before submitting. Never use "could potentially" — prove it or don't report.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Client-side request-signing and anti-bot token reversal for bug bounty — when a request carries a sign/sig/hmac/token/nonce/timestamp/X-Sensor header that Burp Repeater cannot replay, recover the signer just enough to reproduce the request outside the client. Packet-first staging (capture real request → prove replay works → only reverse if replay fails) across the locate→recover→runtime→validation→replay spine. Covers tracing backward from the signature field (writer→builder→entry→source), isolating user-mutable sign inputs (timestamp/nonce/deviceId/body) vs constants (secret key), hooking fetch/XHR in DevTools, JS deobfuscation basics (webpack/wasm/JSVMP), and the bounty payoff: reach the protected API to then hunt IDOR/auth/business-logic. Use when Burp/mitmproxy replay of a signed or anti-bot-gated request fails and you suspect a client-computed field is blocking you.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Complete reference for 26 web2 bug classes with root causes, detection patterns, bypass tables, exploit techniques, and real paid examples. Covers IDOR, auth bypass, XSS (postMessage), SSRF (11 IP bypass techniques), SQLi, business logic, race conditions, OAuth/OIDC, file upload (10 bypass techniques), GraphQL, LLM/AI (ASI01-ASI10, MCP/RAG attacks), API misconfig (mass assignment, JWT, prototype pollution, CORS), ATO (9 paths), SSTI, subdomain takeover, cloud misconfig, HTTP smuggling, cache poisoning, MFA bypass (7 patterns), SAML attacks, error disclosure, CSS injection, LFI/RCE, insecure deserialization, dependency confusion, padding oracle. Use when hunting a specific vuln class or studying what makes bugs pay.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Post-access cloud exploitation for AWS, GCP, and Azure — what to do AFTER you obtain credentials or reach a metadata endpoint. Covers IAM enumeration and privilege escalation (iam:PassRole, CreatePolicyVersion, AssumeRole chains, GCP service-account impersonation, Azure managed-identity abuse), IMDSv1/v2 metadata credential theft, STS token abuse, S3/GCS/Blob bucket takeover and object exfil, Lambda/Cloud Functions env-var secrets, cross-account and cross-service pivoting, and turning leaked keys into demonstrated impact (read PII, assume admin, exfil data). Assumes authorized scope only. Use when you have AWS/GCP/Azure keys, an SSRF hitting 169.254.169.254 / metadata.google.internal, a leaked service-account JSON, or a token, and need to escalate and prove impact. For finding buckets/origins first, use cloud-recon; for the SSRF entry point, see web2-vuln-classes. 中文触发词：云渗透、AWS提权、IAM枚举、元数据凭证、云安全审计
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.