2.6万 件 ・ 関連度順
Audits and implements web accessibility (a11y) following WCAG 2.1 guidelines with ARIA patterns, keyboard navigation, screen reader support, and contrast checking. Use when users request "accessibility audit", "a11y review", "WCAG compliance", "screen reader support", or "keyboard navigation".
日本語の概要は準備中です。原文の説明を表示しています。
Use when a Spark implementation needs an evidence-based review for correctness, ownership, compatibility, failure handling, maintainability, and unnecessary complexity.
日本語の概要は準備中です。原文の説明を表示しています。
Use when adding or updating Spark AI provider models or their compact and preflight metrics, especially baidu-oneapi, Grok, Claude, GPT, DeepSeek, OneAPI, context windows, output budgets, prices, thinking maps, or transports.
日本語の概要は準備中です。原文の説明を表示しています。
Use when authorship order, CRediT contribution roles, or AI-assistance attribution must be recorded transparently for a manuscript, when an author dispute needs an evidence trail, or before a contributorship statement is required at submission; this skill maintains the human-attribution ledger of who contributed what and in which role (authorship order, CRediT taxonomy, revision responsibilities), which is distinct from the disclosure-metadata audit owned by ai-disclosure-auditor.
日本語の概要は準備中です。原文の説明を表示しています。
Use when adapting academic findings for a public audience (op-ed, social post, podcast) and the simplification must stay evidence-faithful, avoid overclaiming, respect embargoes, and disclose AI assistance.
日本語の概要は準備中です。原文の説明を表示しています。
Use before a tag, GitHub release, or Zenodo archive, when README, CATALOG, CHANGELOG, CITATION.cff, the disclosure aggregate, and skill discovery must agree, or when a go or no-go release verdict needs recorded evidence behind it.
日本語の概要は準備中です。原文の説明を表示しています。
Use when reviewer comments arrive and each one needs a tracked decision, when a revise and resubmit letter must map every comment to a manuscript change, or when contradictory reviewer demands need evidence-based, editor-facing framing.
日本語の概要は準備中です。原文の説明を表示しています。
Use when a systematic, scoping, or rapid review needs a reproducible pipeline: protocol framing (PICO/SPIDER/PCC), a logged search string, title/abstract and full-text screening with recorded exclusion reasons, and PRISMA flow counts, with the human as the deciding screener.
日本語の概要は準備中です。原文の説明を表示しています。
Use when a high-stakes analysis, citation set, or decision should be checked by a second independent AI agent that verifies rather than decides, or when disagreement between agents must be surfaced for the human to adjudicate.
日本語の概要は準備中です。原文の説明を表示しています。
Transform brain dumps into polished blog posts in Nick Nisi's voice. Use when the user wants to write a blog post with scattered ideas, talking points, and conclusions that need organization into a cohesive narrative with Nick's conversational, authentic, and thoughtful tone.
日本語の概要は準備中です。原文の説明を表示しています。
This skill should be used when the user asks to "plan a feature", "create PRD", "interview me about requirements", "define stories", "write a spec", "break down feature into tasks", "create implementation plan", "help me scope this feature", "what questions should I answer", or discusses feature planning. Covers the PRD interview process, spec structure, story atomization, and 4-phase workflow from idea to Dex tasks.
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester exploit server-side request forgery. The
日本語の概要は準備中です。原文の説明を表示しています。
WPA/WPA2/WPA3-Enterprise (802.1X / EAP) attack methodology — EAP method identification (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD, EAP-FAST), evil-twin RADIUS attacks with eaphammer for credential capture, MSCHAPv2 challenge-response cracking, EAP-TLS client certificate theft paths (DPAPI, NDES, AD CS auto-enrollment), supplicant validation bypass (missing server cert validation, missing CN pinning, BYOD misconfigurations), and post-capture pivots into AD via cracked domain credentials. Use for corporate Wi-Fi engagements where the network is 802.1X authenticated.
日本語の概要は準備中です。原文の説明を表示しています。
IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoT API abuse, and side-channel/glitching basics. Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research.
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester exploit server-side template injection in a
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester exploit server-side template injection in a
日本語の概要は準備中です。原文の説明を表示しています。
You are helping a penetration tester exploit server-side template injection in a
日本語の概要は準備中です。原文の説明を表示しています。
WPA3 / SAE (Simultaneous Authentication of Equals) attack methodology — transition-mode (mixed WPA2/WPA3) downgrade, Dragonblood side-channel attacks (CVE-2019-9494, 9495, 13377, 13456), SAE auth flooding for AP CPU exhaustion, Hash-to-Element (H2E) timing analysis, group downgrade, and 6 GHz / Wi-Fi 6E spec implications (PMF mandatory, no transition mode allowed). Use when target advertises WPA3-SAE or WPA3-Personal/Enterprise, or operates in 6 GHz where WPA3 + PMF are required by spec.
日本語の概要は準備中です。原文の説明を表示しています。
Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Includes REST-specific attacks such as HTTP verb tampering, content-type switching, and parameter pollution. Covers gRPC exploitation through protobuf interception, reflection API enumeration, and metadata injection. Addresses WebSocket vulnerabilities including origin bypass, message injection, and cross-site WebSocket hijacking. Provides tooling guidance for Burp Suite, Postman, grpcurl, websocat, and mitmproxy. Each technique includes detection signatures and defensive indicators so you understand what artifacts your testing leaves behind. Designed for authorized penetration testing engagements against API-driven architectures.
日本語の概要は準備中です。原文の説明を表示しています。
Race condition (TOCTOU) testing checklist: identifying timing windows, Burp Suite Turbo Intruder, Last-Byte sync technique, rate limit bypass, double-spend attacks, and concurrent request exploitation. Use for web app race condition testing or bug bounty time-of-check-to-time-of-use bugs.
日本語の概要は準備中です。原文の説明を表示しています。
Server-Side Request Forgery testing checklist: SSRF discovery, blind SSRF with out-of-band, cloud metadata endpoints (AWS/GCP/Azure), SSRF filter bypass techniques (IP encoding, DNS rebinding, redirect chains), and SSRF to RCE escalation. Use for web app SSRF testing and bug bounty.
日本語の概要は準備中です。原文の説明を表示しています。
File upload vulnerability checklist: MIME type bypass, extension bypass, magic byte manipulation, path traversal in filenames, stored XSS via SVG/HTML upload, server-side processing attacks, and race conditions. Use for assessing file upload endpoints in web app pentests or bug bounty.
日本語の概要は準備中です。原文の説明を表示しています。
SSTI exists wherever user-controlled input is concatenated into a server-side
日本語の概要は準備中です。原文の説明を表示しています。
Hunt JWT cryptographic failures — alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge a token for any identity (e.g. an admin) without knowing a secret. Use when the app authenticates with a JSON Web Token (an `eyJ...` Bearer token in the Authorization header, a cookie, or a login response). This skill OWNS JWT signature/crypto forgery (alg:none, key confusion, kid/jku header injection); hunt-ato covers JWT as one ATO path, hunt-auth-bypass covers SSO/SAML token trust, hunt-api-misconfig covers non-crypto JWT handling. Critical when a forged token grants access to another user's data or an admin-only endpoint.
日本語の概要は準備中です。原文の説明を表示しています。