608건 · 관련도순
Identify and exploit Server-Side Template Injection (SSTI) vulnerabilities within web applications. Use this skill when testing web applications that render dynamic content using template engines like Jinja2 (Python), Twig (PHP), Freemarker (Java), or Pug (Node.js). Covers identification via mathematical evaluation, context mapping, escaping sandboxes, and achieving Remote Code Execution (RCE).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Detects weak or misconfigured cryptography in mobile apps (Android/iOS). Trigger on: hardcoded keys, ECB mode, DES, 3DES, RC4, MD5, SHA-1, SecureRandom misuse, static IV, reused IV, Math.random, arc4random, CommonCrypto, CryptoKit, Android Keystore, SecKey, AES-ECB, RSA without OAEP, insufficient key size, predictable seed, insecure key storage, broken hash, PBKDF2 iteration count. Covers MASVS-CRYPTO-1 (algorithm choice) and MASVS-CRYPTO-2 (key management).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every technique includes actual payloads, commands, and verification logic. Chains from /pentester or /codebase when API endpoints are discovered, chains into /web-exploit when classic injection points are found in API parameters, chains into /post-exploit when RCE is achieved, and chains into /ai-redteam when an LLM/AI endpoint is discovered (chat APIs, completion endpoints, RAG search, agentic tool-use, MCP servers).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Scaffold a PhysicsIntern research workspace in the current folder. Run only when the user explicitly invokes it to set up a new physics/maths research workspace.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when a task needs the judgment of a Computer and Information Research Scientist — designing an ablation to attribute an empirical gain, budgeting an NSF CISE proposal against page and content limits, deciding what reproducibility artifacts to release with a paper, screening a draft for mathiness or terminology misuse, or scoping the consent/ethics review needed before running an experiment on real users.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when a task needs the judgment of a Compensation, Benefits, and Job Analysis Specialist — market-pricing a job against salary survey data, scoring a job through a point-factor or IPE job evaluation, running a pay-equity regression or cohort analysis, building or refreshing a salary structure and compa-ratio bands, classifying a job family's FLSA exemption status through the duties test, or modeling benefits plan cost (loss ratio, PEPM, self-funded vs. fully insured). Distinct from hr-people-manager (owns the comp/leveling judgment calls — whether to approve an exception, promote someone into a level), hr-specialist (owns individual-case leave/I-9/ADA/FLSA reclassification for one employee's drifted duties), and compensation-benefits-manager (owns pay philosophy, negotiation-range policy, and the department that runs this work). This role owns the mechanics: the survey match, the point score, the regression, the band math — the analysis those upstream policy and downstream judgment calls are made against.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use when a task needs the judgment of an astronomer — calculating exposure time or signal-to-noise for a target, writing the feasibility math for a telescope-time proposal, reducing photometric or spectroscopic data, distinguishing a systematic error floor from statistical noise, or reviewing an observational result for calibration or upper-limit red flags.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Audit an existing Lamport-style hierarchical mathematical proof forward for validity and whether its hierarchy, scope, dependencies, side conditions, and proof constructs discharge the stated theorem. Use when the central question concerns a top-down proof with numbered levels, subproofs, ASSUME/PROVE, SUFFICES, PICK, CASE, DEFINE, Q.E.D., or prose equivalents. For an ordinary proof that first needs source-preserving hierarchy, use convert-lamport; for conclusion-first AND/OR obligation reconstruction, use reverse-lamport. Do not use to generate or replace a proof, or to audit Lean, Coq, Isabelle, or other proof-assistant source.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Audit an existing mathematical, logical, algorithmic, or technical proof from its stated conclusion backward as a bounded AND/OR graph of exact obligations. Use to reconstruct conclusion dependencies, determine whether a proof-supplied route establishes the conclusion, or expose hidden assumptions, unmet side conditions, cycles, overly strong steps, or silent route switches. For a source-mapped Lamport rendering use convert-lamport, and for forward hierarchy, construct, and scope conformance use forward-lamport before this skill. This does not decide full theorem-level entailment by searching for a different proof; do not turn the audit into a linear reversed proof, exhaustive proof search, or replacement proof.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Guideline for designing, implementing, and verifying secure APIs following OWASP API Security Top 10 (2023) best practices. Use when the user wants to: (1) review API code or design for security vulnerabilities, (2) design a secure REST, GraphQL, or gRPC API architecture, (3) implement API authentication and authorization (OAuth2, JWT, API keys, mTLS), (4) configure rate limiting, input validation, or CORS, (5) audit API endpoints for BOLA, BFLA, or mass assignment vulnerabilities, (6) create API security checklists or verification plans, (7) fix API security bugs or harden existing APIs, (8) set up API security testing (OWASP ZAP, Schemathesis, Burp Suite), or (9) handle any API security concern including SSRF prevention, resource consumption limits, business flow protection, API inventory management, and secure third-party API consumption.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Quantum physics expert making counterintuitive concepts accessible while maintaining mathematical rigor
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Computational mathematics expert for numerical solutions, approximations, error analysis, and scientific computing
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Expert in combinatorics, graph theory, discrete probability, and algorithms with applications to computer science
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Deep game design health assessment across five dimensions: review core loop and progression systems, analyze in-game economy for inflation and sink/source balance, mathematically simulate combat balance and drop rates, audit analytics event coverage, and evaluate monetization ethics..
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Explain, draft, or validate Obsidian Flavored Markdown syntax: properties, wikilinks, embeds, callouts, tags, comments, highlights, block references, math, and Mermaid. Use when the user explicitly requests Obsidian note formatting or syntax help, not for general Markdown or broad vault operations.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Plan and review paid-media budgets, bidding, pacing, marginal return, targets, constraints, and allocation across supported platforms. Use for ad budget allocation, media budget, bidding strategy, scaling, spend pacing, ROAS target, or investment tradeoffs. Use ads-math for calculations and forecasts.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Reconstruct editable LaTeX from PDF content using page-aware extraction and visual comparison. Preserve source evidence, flag uncertain math/tables/citations, and distinguish text extraction, OCR, reconstruction, and verified compilation.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Use this skill when creating, deploying, or troubleshooting Salesforce Business Hours and Holidays: the calendars that pause Case escalation rules, entitlement milestones, and Apex BusinessHours math outside working hours. Covers the BusinessHoursSettings metadata, the default calendar, per-region calendars, holiday attachment, the Case Business Hours field, and the BusinessHours Apex class. Trigger keywords: business hours, holidays, SLA clock, escalation not pausing, working hours, support hours, milestone timer weekend. NOT for the escalation rule entries themselves — use admin/escalation-rules. NOT for entitlement process design — use admin/entitlements-and-milestones. NOT for Field Service operating hours or shift scheduling — use admin/fsl-scheduling-setup.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Qualitative quality review of game design documents — answers "is this design good, and does it follow best practices?" — across all three GDD axes: systems, flows, and content types. Fans out adversarial lenses (completeness, clarity, pillar alignment, systems-math, fantasy-delivery, feasibility, scope) plus domain lenses that check it against the game-design rules, each prompted to find problems rather than validate; produces a severity-graded verdict and a two-bucket report (apply-ready fixes vs research), handed to /unikit-gd-apply or /unikit-gd-explore in one move. Scope is inferred: a named system, flow, or content type reviews that document; "all" runs a cross-document review. Use when the user wants a critique, quality judgment, or rules check of the design, e.g. "review the combat GDD", "review the onboarding flow". This is the subjective quality pass — for a mechanical consistency check (numbers, terms, IDs, references matching the registry) use /unikit-gd-verify.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Drafts IRC 664–compliant Charitable Remainder Trust agreements (CRAT/CRUT), covering payout math, remainder qualification, trustee powers, and tax compliance. Use when drafting a CRT, CRAT, CRUT, unitrust, annuity trust, or charitable remainder planning document, or when ensuring IRC 664 compliance.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Drafts a mathematically balanced ALTA Settlement Statement for U.S. real estate closings, allocating debits and credits between buyer and seller with prorations, payoffs, lender fees, title charges, and transfer taxes. Enforces balance verification (seller credits minus debits equals cash to seller; buyer debits minus credits equals cash from buyer) and cross-references title commitment, loan documents, and purchase agreement. Use when preparing closing financials, settlement statements, HUD-equivalent documents, or real estate closing allocations.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Security checklist for Solidity AMM contracts, liquidity pools, and swap flows. Covers reentrancy, CEI ordering, donation or inflation attacks, oracle manipulation, slippage, admin controls, and integer math.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
I am a vector of math problems. A tool. Nothing more.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Design, analyze, and optimize cold outbound email campaigns on Instantly. Handles end-to-end ICP definition, expert panel scoring (recursive to 90+), sequence copywriting, infrastructure audit, capacity planning, and an implementation/strategy doc for human review. Use when asked to build cold outbound sequences, optimize cold email, audit an outbound motion, write sales sequences, or design cold email campaigns. Supports "start from scratch" and "optimize existing" modes. Execution skill — it produces copy, math, and a doc; it does not auto-send. Requires Instantly for audit/send features.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.