Use when: User wants to extend Docker with custom tools, personalize the Docker environment, or set up user-specific Docker customization. Triggers: 'extend docker', 'docker-extend', 'add tools to docker', 'customize docker', 'add my tools to the container', 'personalize docker setup', 'docker user setup', 'install tools in docker'. Does: Interactively sets up Dockerfile.user and docker-compose.override.yml so users can add personal tools to their Docker environment without affecting maintainer files or committing user-specific config to git.
日本語の概要は準備中です。原文の説明を表示しています。
coleam00/Archon☆ 2.4万2026年10月13日 更新
Time-of-Check / Time-of-Use (TOCTOU) race condition exploitation methodology across binary, kernel, filesystem, web, and container layers. Covers symbolic-link races (open/access/stat split), file-descriptor races, fopen/realpath traversal races, /proc and procfs races, FUSE-backed slow-fs races to widen the window, ptrace and signal races, kernel double-fetch / userspace pointer races, container/runc/symlink escape primitives, kubernetes admission/authz TOCTOU, web auth-vs-authz TOCTOU, JWT-claim TOCTOU at gateway vs service, payment/idempotency races, and modern race-amplification techniques (single-packet attack, slow loris, FUSE pause, cgroup freeze, scheduler shaping). Use when you've identified a 'check then act' pattern in code, when fuzzing for race conditions, or when exploiting concurrency bugs in privileged binaries / kernel / orchestrators.
日本語の概要は準備中です。原文の説明を表示しています。
SnailSploit/Claude-Red☆ 7,4832026年10月13日 更新
X (Twitter) DM automated chat end-to-end Skill: scan DM inbox to identify pending-reply conversations, read message history, generate persona-based replies and send; also supports searching users and starting new conversations. Built-in E2E passcode unlock, DM permission filtering, and rate control. Use when user mentions X auto-reply DMs, Twitter DM automated chat, auto-handle unread DMs, reply to X private messages with persona, X DM outreach campaign, batch send DMs to Twitter users, auto-process pending DM replies, Twitter DM bot, automated Twitter outreach, X direct message automation.
日本語の概要は準備中です。原文の説明を表示しています。
browser-act/skills☆ 6,1402026年8月24日 更新
Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies. Handles gateway setup, target types, outbound auth (OAuth, API key, IAM), credentials, and Cedar policy authoring. Triggers on: "connect to API", "add gateway", "connect to MCP server", "Lambda tools", "OpenAPI", "gateway target", "Cedar policy", "restrict tools", "policy engine", "gateway auth error", "store API key", "outbound credential", "env var API key", "API key None after deploy", "credential not available after deploy", "should this be a gateway target", "give my agent tools", "add tools to agent". Not for inbound auth (who can call your agent) — use agents-harden. Not for debugging agent behavior — use agents-debug. Not for VPC networking errors (agent can't reach APIs due to VPC) — use agents-build. Not for creating or hosting a new MCP server project — use agents-get-started.
日本語の概要は準備中です。原文の説明を表示しています。
aws/agent-toolkit-for-aws☆ 2,8662026年10月13日 更新
Helps migrate self-managed Apache Kafka workloads to Amazon MSK Express. Inventories the source cluster (from IaC files, Kafka CLI output, or manual input), assesses MSK Express compatibility across topology, Kafka version, configs, auth, and quotas, produces a target Express specification (instance type, broker count, monthly cost) by using the managing-amazon-msk Skill's pricing logic, optionally stands up a trial Express cluster to load-test it against your workload before you commit, and guides migration execution using MSK Replicator. Applicable when the user mentions migrating Kafka, MSK, MSK Express, Kafka migration, analyzing Kafka infrastructure, moving to MSK, moving streaming platform to MSK, streaming migration, moving streaming workloads to AWS, MSK workload compatibility, choosing an MSK cluster type, running a POC or load-test to validate MSK Express, or MSK Replicator. Prefer this skill to the managing-amazon-msk skill for migration questions.
日本語の概要は準備中です。原文の説明を表示しています。
aws/agent-toolkit-for-aws☆ 2,8662026年10月13日 更新
When the user wants to monitor competitor apps on an ongoing basis — tracking metadata changes, keyword shifts, screenshot updates, rating trends, or new features. Use when the user mentions "competitor monitoring", "track competitors", "competitor alert", "competitor changed their title", "watch a competitor app", "competitor weekly report", "competitive intelligence", or "what changed in competitor's listing". For a one-time deep competitive analysis, see competitor-analysis. For market-wide chart movements, see market-movers.
日本語の概要は準備中です。原文の説明を表示しています。
appeeky/aso-skills☆ 2,1742026年10月7日 更新
Convert comic book panels, manga pages, webtoons, and illustrated storyboards into animated video using Seedance 2.0 on Higgsfield. Use whenever the user wants to animate comics, bring illustrations to life, convert manga to video, animate storyboards, or create motion from static sequential art. Triggers on: comic to video, manga animation, panel animation, storyboard to video, webtoon animation, comic book motion, sequential art, graphic novel animation, or any illustrate-to-animate request. Use even when user says "make this drawing move" or "animate this page.
日本語の概要は準備中です。原文の説明を表示しています。
beshuaxian/higgsfield-seedance2-jineng☆ 9652026年4月10日 更新
Analyze how competitors present their brand — identity, messaging, positioning, voice, and visual style — to find gaps and opportunities. Use when the user says "competitor brand analysis", "analyze competitor brands", "how do competitors position themselves", "competitor messaging", "competitor identity", "what are competitors saying", "benchmark competitors", "competitive brand landscape", "how do we compare to competitors", "competitive audit", or wants to understand the brand landscape before defining their own position.
日本語の概要は準備中です。原文の説明を表示しています。
arnabbagxd/Brand-building-skills☆ 7422026年6月13日 更新
Use BentoML to author model-serving Services, build and containerize Bentos, run HTTP/gRPC servers and clients, manage models, operate the CLI and BentoCloud, and configure observability or production runtime behavior. Use when tasks mention BentoML, bentoml service.py, bentofile.yaml, Bento build/serve/deploy, BentoCloud, or BentoML model stores.
日本語の概要は準備中です。原文の説明を表示しています。
VectorSpaceLab/AREX-Skill☆ 3332026年9月3日 更新
Analyzes a repository and its test suite to generate customized mutation operators tailored to the project. Use this skill when setting up mutation testing, improving test quality, or generating project-specific mutants. Considers language constructs, business logic patterns, API calls, data types, and code complexity to produce effective mutation operators that maximize test sensitivity while avoiding trivial or equivalent mutations. Generates prioritized operator sets (high/medium/low value) with impact summaries. Triggers when users ask to generate mutation operators, customize mutation testing, analyze code for mutation opportunities, or create project-specific mutants.
日本語の概要は準備中です。原文の説明を表示しています。
ArabelaTso/Skills-4-SE☆ 2532026年8月21日 更新
Capacitor is a runtime that packages a web app as a native iOS and Android app and exposes native device APIs to JavaScript. Use when someone asks to "convert my website to a mobile app", "Capacitor", "web to native app", "access camera from JavaScript", "deploy web app to App Store", "hybrid mobile app", or "Ionic Capacitor". Covers native API access, plugin system, web-to-native bridge, and app store deployment.
日本語の概要は準備中です。原文の説明を表示しています。
TerminalSkills/skills☆ 1662026年10月14日 更新
管理咨询 (管理咨询 (Management Consulting) — 战略与管理咨询的职业认知操作系统,从业者/咨询顾问/想入行者/采购咨询服务的客户视角。覆盖: (a) 第一性张力 — 假设驱动 (hypothesis-driven / answer-first / Day-1 answer) 的「先有答案再验证」⇄ 数据驱动 (data-led / bottom-up) 的「先穷尽事实再归纳」,这行的核心张力是「先射箭再画靶 vs 先画靶再射箭」,资深人偏 top-down 假设树减少 boil-the-ocean,但要时刻防 confirmation bias; 以及更深层的张力 — 「卖洞见 (insight / so-what) vs 卖工时 (analysis / 体力)」,「客户影响 (client impact / 落地) vs 智识严谨 (intellectual rigor / 漂亮 deck)」; (b) 方法论正典 (最标准化、最易蒸出高质量) — MECE (相互独立完全穷尽)、issue tree / logic tree (问题树/逻辑树)、hypothesis-driven problem solving (假设驱动)、Pyramid Principle (Minto 金字塔原理: SCQA 情境-冲突-疑问-回答 + 结论先行 + 自上而下 + 归纳/演绎)、80/20 (帕累托/抓大放小)、so-what (所以呢/洞见提炼)、storyline (故事线/ghost deck 鬼影稿)、driver tree / profit tree、2x2 矩阵、value chain、frameworks (Porter 五力/3C/4P/7S/BCG 矩阵/价值链) 既是脚手架也是陷阱 (套框架 vs 真洞见); (c) 行业结构 — MBB (McKinsey/BCG/Bain 战略三巨头) vs Big Four 咨询臂 (Deloitte/PwC Strategy&/EY-Parthenon/KPMG) vs 精品战略所 (Oliver Wyman/Kearney/Roland Berger/L.E.K./Arthur D. Little) vs 专业/职能 boutique (运营/数字化/PE 尽调); up-or-out (非升即走)、leverage model (杠杆模型: 1 个合伙人带多个 EM/咨询师/分析师的金字塔)、partner/principal/EM(项目经理)/associate(咨询师)/analyst(分析师) 职级; (d) 项目交付模型 (the case/study/engagement) — 提案/SOW (scope of work)、problem definition (问题定义/真问题 vs 表象问题)、workplan (工作计划)、hypothesis tree (假设树)、analysis (分析/建模)、synthesis (综合)、recommendation (建议)、implementation (落地); 客户管理 (steering committee 指导委员会、stakeholder 利益相关方、对齐); (e) 产出物 — the deck (PPT 幻灯片是咨询的母语)、executive summary、action title (行动标题/每页一句话结论)、ghost deck (先搭骨架后填数据)、Excel 财务模型、framework 图; (f) 职业/招聘 — case interview 生态 (案例面试: Victor Cheng LOMS/Case in Point/market sizing 市场估算/估算题/fit 行为面)、网申-笔试-案例面、up-or-out、exit options (退出路径: PE/VC/corp dev 企业发展/战略岗/创业/industry); (g) 争议/批判 — 咨询的价值之辩 (「借你的表告诉你时间」「frameworks 是剧场表演 vs 真洞见」Matthew Stewart《The Management Myth》)、McKinsey 的丑闻 (Purdue 阿片类/独裁政府/ICE/利益冲突, Bogdanich & Forsythe《When McKinsey Comes to Town》)、咨询 vs 自建战略部、generalist 通才 vs specialist 专才之争、AI/GenAI 对初级分析师工作的冲击; (h) 流派 — 战略经典 (Porter 定位学派/五力 vs 资源基础观 RBV vs 蓝海战略 Kim&Mauborgne vs 颠覆式创新 Christensen vs Mintzberg 应急战略批判 planning school); 三巨头气质分野 (McKinsey 事实驱动/CEO 信任/通才, BCG 概念/思想领导力/经验曲线/增长-份额矩阵, Bain 结果导向/NPS 净推荐值/PE 关系/与客户深度绑定)。不含: 投行 M&A/财务顾问 (估值/承销超出范畴)、纯 IT 实施/系统集成 (SI 人力外包)、纯审计/税务、纯人力 RPO/猎头、内部战略部 only (虽相关但本 skill 聚焦专业服务咨询的外部视角)。) Master OS — automated mastery of 管理咨询 (Management Consulting) — 战略与管理咨询的职业认知操作系统,从业者/咨询顾问/想入行者/采购咨询服务的客户视角。覆盖: (a) 第一性张力 — 假设驱动 (hypothesis-driven / answer-first / Day-1 answer) 的「先有答案再验证」⇄ 数据驱动 (data-led / bottom-up) 的「先穷尽事实再归纳」,这行的核心张力是「先射箭再画靶 vs 先画靶再射箭」,资深人偏 top-down 假设树减少 boil-the-ocean,但要时刻防 confirmation bias; 以及更深层的张力 — 「卖洞见 (insight / so-what) vs 卖工时 (analysis / 体力)」,「客户影响 (client impact / 落地) vs 智识严谨 (intellectual rigor / 漂亮 deck)」; (b) 方法论正典 (最标准化、最易蒸出高质量) — MECE (相互独立完全穷尽)、issue tree / logic tree (问题树/逻辑树)、hypothesis-driven problem solving (假设驱动)、Pyramid Principle (Minto 金字塔原理: SCQA 情境-冲突-疑问-回答 + 结论先行 + 自上而下 + 归纳/演绎)、80/20 (帕累托/抓大放小)、so-what (所以呢/洞见提炼)、storyline (故事线/ghost deck 鬼影稿)、driver tree / profit tree、2x2 矩阵、value chain、frameworks (Porter 五力/3C/4P/7S/BCG 矩阵/价值链) 既是脚手架也是陷阱 (套框架 vs 真洞见); (c) 行业结构 — MBB (McKinsey/BCG/Bain 战略三巨头) vs Big Four 咨询臂 (Deloitte/PwC Strategy&/EY-Parthenon/KPMG) vs 精品战略所 (Oliver Wyman/Kearney/Roland Berger/L.E.K./Arthur D. Little) vs 专业/职能 boutique (运营/数字化/PE 尽调); up-or-out (非升即走)、leverage model (杠杆模型: 1 个合伙人带多个 EM/咨询师/分析师的金字塔)、partner/principal/EM(项目经理)/associate(咨询师)/analyst(分析师) 职级; (d) 项目交付模型 (the case/study/engagement) — 提案/SOW (scope of work)、problem definition (问题定义/真问题 vs 表象问题)、workplan (工作计划)、hypothesis tree (假设树)、analysis (分析/建模)、synthesis (综合)、recommendation (建议)、implementation (落地); 客户管理 (steering committee 指导委员会、stakeholder 利益相关方、对齐); (e) 产出物 — the deck (PPT 幻灯片是咨询的母语)、executive summary、action title (行动标题/每页一句话结论)、ghost deck (先搭骨架后填数据)、Excel 财务模型、framework 图; (f) 职业/招聘 — case interview 生态 (案例面试: Victor Cheng LOMS/Case in Point/market sizing 市场估算/估算题/fit 行为面)、网申-笔试-案例面、up-or-out、exit options (退出路径: PE/VC/corp dev 企业发展/战略岗/创业/industry); (g) 争议/批判 — 咨询的
日本語の概要は準備中です。原文の説明を表示しています。
swaylq/master-skill☆ 1552026年9月6日 更新
Read this skill before the first step of any request to do something in an app on the person's own computer (Notes, Finder, System Settings, any desktop app), to look at their screen, or for "computer use". Computer use (desktop control) lets Claude take screenshots of the person's desktop and control it with clicks, typing and scrolling through the Claude desktop app; its tools are named mcp__computer-use__* when the session runs in the desktop app and mcp__remote-devices__computer_* when a cloud session is linked to the person's computer; before a conversation is linked there may be no such tools, only an enable__mcp__remote-devices__Claude_Browser tool, which links it. It covers getting linked, picking the right tool, the access flow, and what to do when computer use is off or out of reach. It is not for websites, which go through Claude in Chrome or the built-in browser and their own skills.
日本語の概要は準備中です。原文の説明を表示しています。
Razshy/Wiggle☆ 962026年9月5日 更新
Find Amazon same-niche competitors by ASIN, with multi-dimensional filtering by click conversion rate, composite conversion rate, click volume, sales volume, reviews, ratings, price, and gross margin to identify potential competitors. Triggered when users mention same-niche competitors, ASIN competitor mining, niche competitor analysis, similar product benchmarking, ASIN benchmarking, niche market competitor list, high-conversion competitor screening, Nexscope product mining, niche competitor by ASIN, ASIN competitor analysis, same niche products, similar products discovery, conversion rate comparison, potential competitor screening, Nexscope ASIN mining. Even if users do not explicitly mention "niche" or "same niche", this skill should be triggered whenever the task involves discovering competitor lists or screening potential competitors based on a specific ASIN within the same market segment.
日本語の概要は準備中です。原文の説明を表示しています。
nexscope-ai/nexscope-ecommerce-skills☆ 892026年10月9日 更新
Use this skill when building, debugging, or answering questions about Liveblocks. Liveblocks gives you the building blocks and infrastructure to enable people and AI to work together inside your app, powering realtime collaboration. Liveblocks features include collaboration, rooms, organizations, workspaces, comments, composer, threads, notifications, multiplayer, conflict resolution, realtime presence, avatar stacks, AI collaborators, AI agents, text editors, Tiptap, BlockNote, Lexical, React Flow, Chat SDK. Common components include AiChat, Thread, InboxNotification, Composer, Toolbar (for Lexical Tiptap), FloatingToolbar, FloatingComposer, FloatingThreads, AnchoredThreads. Common hooks include useThreads, useStorage, useMutation, useOthers, useInboxNotifications, useAiChats. Common issues are related to authentication (ID tokens vs access tokens), permissions, room limits, connection errors, user info.
日本語の概要は準備中です。原文の説明を表示しています。
code-with-antonio/browser-automation-app☆ 882026年7月18日 更新
🇺🇸 UGC Matrix Growth Playbook — Scale user-generated content with AI + real creators. Complete SOP for UGC flywheel, creator recruitment, incentive design, multi-platform publishing. Proven at CPM $0.5, $10M ARR in 60 days with 70M impressions. Includes a full anonymized client case study. 🇨🇳 UGC矩阵号增长实操手册 — AI+真人创作者规模化用户生成内容。完整的UGC飞轮SOP、创作者招募、激励机制设计、多平台分发策略。已验证CPM $0.5,60天$1000万ARR,7000万曝光。含完整客户案例拆解(已脱敏)。 🇯🇵 UGCマトリックス成長プレイブック — AI+リアルクリエイターでUGCをスケール。フライホイールSOP、クリエイター採用、インセンティブ設計、マルチプラットフォーム配信。CPM $0.5、60日で$10M ARR、7000万インプレッション実証済み。匿名化クライアント事例付き。 🇰🇷 UGC 매트릭스 성장 플레이북 — AI + 실제 크리에이터로 UGC 스케일링. 플라이휠 SOP, 크리에이터 모집, 인센티브 설계, 멀티플랫폼 배포. CPM $0.5, 60일 $10M ARR, 7000만 노출 검증 완료. 익명화된 클라이언트 사례 포함. Triggers: "UGC" | "UGC matrix" | "user generated content" | "creator program" | "creator economy" | "AI UGC" | "matrix accounts" | "矩阵号" | "UGC运营" | "创作者招募" | "UGC Program" | "content matrix" | "TikTok UGC" | "Instagram UGC"
Gingiris-1031/gingiris-skills☆ 842026年10月8日 更新
Image generation, photo editing, background removal — transparent PNG images, cutouts, ecommerce packshots, product catalogs, lifestyle shots via Bria.ai. Build store-ready e-commerce catalogs at scale — shadows, product dimensions images, lifestyle scenes, marketplace listing variants. ALWAYS use this skill when the user wants to generate, edit, or transform any image — hero images, banners, social media visuals, product photos, illustrations, icons, thumbnails, ad creatives, or marketing materials — or to build a product catalog, create a packshot, stage a lifestyle shot, remove a background, make transparent PNGs, or batch-process product photos. Triggers on packshot, product catalog, product shot creator, lifestyle shot, cutout, product dimensions image, inpainting, outpainting, object removal, upscale, photo restoration, style transfer, relight, reseason, sketch-to-photo. Commercially safe, royalty-free.
日本語の概要は準備中です。原文の説明を表示しています。
Bria-AI/bria-skill☆ 692026年10月12日 更新
Scout the TouchDesigner community for what's HYPED right now — community showcases, recent tutorials, generative-AI bridges, hardware interaction trends, visual-aesthetic trends of 2025-2026 — then propose tdmcp tools that ride those trends AND are easy to build. Use whenever the user wants to brainstorm new feature ideas based on what's trending in TouchDesigner, asks for 'hype' or 'trending' features, asks 'what are people doing in TD right now / what's hot / what's hype', wants tools inspired by community trends, asks to scout TD trends/aesthetics/integrations, or says things like 'ideias hype', 'novas ideias', 'o que está em alta', 'criar ferramentas para o que está bombando', 'tendências do TouchDesigner'. Also for follow-ups: refresh, rescout one surface, re-rank under another profile, deepen a trend, or filter for buildable-easy items. This is an EXTERNAL trend ideation harness — complementary to tdmcp-feature-discovery (which is INTERNAL gap analysis). It produces `_workspace/hype-scout/HYPE_TOOL_BACKLOG.md` ranked by Hype × Build-Ease; it does NOT build. Once a feature is chosen from the backlog, hand it to tdmcp-pipeline.
日本語の概要は準備中です。原文の説明を表示しています。
Pantani/tdmcp☆ 502026年8月16日 更新
Build a custom MCP (Model Context Protocol) server that exposes domain-specific tools to AI assistants. Covers server implementation in Node.js or R, tool definitions, the resources and prompts primitives, transport configuration, and testing with Claude Code. Use when you need to expose custom functionality beyond what mcptools provides, when building specialized domain-specific AI integrations, or when wrapping existing APIs or services as MCP tools.
日本語の概要は準備中です。原文の説明を表示しています。
pjt222/agent-almanac☆ 372026年10月13日 更新
Before committing any non-trivial change, dispatch the diff to a reviewer runtime via ATO (`ato dispatch <reviewer> --session <id>`), parse the numbered/severity-tagged findings, apply or defer each one with a recorded justification, then commit. Fights the "build passes therefore ship it" failure mode — what Garry Tan calls the AI agent complexity ratchet. Place in the v2.16 stack: this skill is the LAST gate. `ato-warroom` decides the design; `ato-mission` runs the multi-step work and produces the diff; `ato-review` checks the diff before commit. When the review is part of a Mission, dispatch the review with `--require-tools read_file,grep,git_diff,git_log` so the reviewer can walk the source itself instead of reasoning from a paraphrase (PR-1.5 tool surface). Receipts land in `execution_logs` and the Mission narrative. Fires automatically before commits touching public surface (CLI subcommands, Tauri commands, MCP tools, schema migrations, security boundaries) or whenever a diff exceeds ~50 LOC of behavior change.
日本語の概要は準備中です。原文の説明を表示しています。
WillNigri/Agentic-Tool-Optimization☆ 342026年9月8日 更新
Generate Apple App Store screenshot pages as a Next.js app with html-to-image export at required resolutions. Screenshots are advertisements, not documentation — every screenshot sells one idea. Use when building App Store screenshots, generating exportable marketing screenshots for iOS apps, or creating programmatic screenshot generators. Triggers on 'app store screenshots', 'App Store', 'screenshot generator', 'iOS screenshots', 'marketing screenshots', 'phone mockup', 'ASO screenshots', 'app store assets', 'app listing', 'app store page', or 'app preview images'. Also use when someone is about to submit an app and needs store assets, or when they say 'make my app store page look good'. Includes iPhone and iPad mockup components with pre-measured dimensions.
日本語の概要は準備中です。原文の説明を表示しています。
MoizIbnYousaf/marketing-cli☆ 322026年9月12日 更新
Deep-dive ONE competitor's organic footprint — exact ranking keywords and URLs, content themes, backlink profile, and exploitable gaps — with findings written into brand/competitors.md. Use this skill when the user names a competitor and wants to know what to learn from them, counter, or outrank, including head-to-head comparisons against the user's own domain. For market-level mapping first, use openseo-competitive-landscape. Triggers: "analyze competitor", "competitor keywords", "competitor backlinks", "beat <competitor>", "competitor seo teardown".
日本語の概要は準備中です。原文の説明を表示しています。
MoizIbnYousaf/marketing-cli☆ 322026年9月12日 更新
Produce a complete narrated MYTHIC SHORT FILM end-to-end on Unsora MCP in the layered cut-paper diorama style — stacked matte cardstock worlds, a strict three-colour palette, exposure that swings, paper wipes hiding every seam, landing on a face. Animation-movie storytelling, not an explainer: gods, monsters, heroes, folklore, origin myths and transformations, told in ten-second story beats with a mythic narrator, native paper foley, and one assembled MP4. Use whenever the user wants a myth, legend, fable, folktale or fairy-tale short, a cut-paper or papercraft animated story, "tell the story of X" as a video, a stop-motion-look mythic film, or says "run the cardstock diorama myth animation" or "run the diorama myth pipeline" — even with no story given, since the skill proposes myths itself. NOT for fact-driven explainers with charts and statistics (that is vox-motion-graphics).
日本語の概要は準備中です。原文の説明を表示しています。
sadekxD/cardstock-diorama-myth☆ 312026年8月3日 更新
Deep OAuth 2.0 / OpenID Connect security assessment. Covers the full attack surface: redirect_uri validation bypass (path traversal, open redirect chains, subdomain confusion, URL parsing tricks, parameter pollution, response mode switching), missing/broken state parameter CSRF, PKCE downgrade and absent-challenge attacks, implicit grant token leakage (Referer, browser history, XSS fragment theft), authorization code injection, scope escalation, client confusion attacks, mutable-claims account takeover (iss+sub confusion, email-keyed identity merging), pre-account takeover via unverified registration, OpenID Connect dynamic client registration SSRF (logo_uri, jwks_uri, sector_identifier_uri, request_uri), nonce replay, ID token validation failures, Device Code phishing flow, mobile custom URI scheme hijacking, refresh token persistence, token introspection enumeration, consent screen clickjacking, host header injection, and cross-IdP mix-up attacks. Uses KOAuth, jwt_tool, nuclei oauth templates, and manual http(action="request", ...) payloads. Every technique includes actual request payloads and verification logic. Chains from /pentester or /api-security when OAuth endpoints are discovered. Chains into /web-exploit for open redirect, XSS, and SSRF chaining. Chains into /post-exploit when full account takeover is achieved. Chains into /credential-audit when access tokens or refresh tokens are recovered.
日本語の概要は準備中です。原文の説明を表示しています。
ShulkwiSEC/bb-huge☆ 242026年7月11日 更新