「name」の検索結果

Logs the outcome of a skill execution to observations/<skill-name>/runs.md. Trigger on: "log this run", "skill worked", "skill failed", "this didn't work", "log the outcome", "record this", "note that", or after any skill completes with a clear success, partial, or failure outcome. Creates the observations file if it does not exist, then appends an entry with date, task description, skill used, outcome, what worked, what failed, and any error messages observed.

日本語の概要は準備中です。原文の説明を表示しています。

Use when testing file upload endpoints for unrestricted file upload, MIME type bypass, magic byte spoofing, polyglot files, SVG XSS, XXE via Office documents, ZIP slip, and path traversal in filenames. Trigger on: multipart/form-data endpoints, avatar/document upload flows, import-from-file features, profile image, CSV/Excel import, DOCX/XLSX parsing, image resizing pipelines, archive extraction, and any endpoint that stores or serves user-supplied files. Detects extension bypass (shell.php.jpg), null byte injection, double extension, ImageMagick exploits, and content-type confusion.

日本語の概要は準備中です。原文の説明を表示しています。

JNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code path reaching InitialContext.lookup().

日本語の概要は準備中です。原文の説明を表示しています。

Execute a Kerberoasting attack to extract Service Principal Name (SPN) ticket hashes from Active Directory and crack them offline. This allows an attacker with any valid domain credentials to escalate privileges by obtaining the plaintext password of highly-privileged service accounts.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit Active Directory environments using Kerberoasting. This skill details how to identify Service Principal Names (SPNs) associated with user accounts, request their TGS tickets, and crack the RC4 encrypted component offline to recover service account passwords.

日本語の概要は準備中です。原文の説明を表示しています。

Supply-chain testing via package-manager dependency confusion: when internal package names resolve to attacker-controlled public registries, leading to malicious install and script execution. Use for npm/pip/gem/Maven/Composer/Docker manifest review and authorized red-team supply-chain exercises.

日本語の概要は準備中です。原文の説明を表示しています。

DOM-based XSS occurs when JavaScript reads attacker-controlled sources (`location.hash`, `document.referrer`, `window.name`, `location.search`) and passes them to dangerous sinks (`document.write`, `innerHTML`, `eval`, `location.href`, `setTimeout`, `jQuery.html()`) without sanitization. Unlike reflected/stored XSS, payloads never reach the server. Detect by auditing JavaScript for tainted data flow from DOM sources to sinks. Tools: Burp Suite DOM Invader, Chrome DevTools, DOMPurify (fix).

日本語の概要は準備中です。原文の説明を表示しています。

Container and Kubernetes security assessment. Tests container escape vectors, Docker/containerd socket exposure, K8s RBAC misconfigurations, pod security violations, exposed API servers, etcd access, service account token abuse, image layer secrets, private registry attacks, SSRF to metadata services, cross-namespace network bypass, CIS benchmarks, crypto miner detection, resource exhaustion, and admission controller gaps. Both external and internal (compromised pod) perspectives. Uses trivy, kube-bench, kubectl, nuclei, dive, amicontained, and docker-bench-security. Covers OWASP Kubernetes Top 10 and all 22 Kubernetes Goat attack scenarios.

日本語の概要は準備中です。原文の説明を表示しています。

Container escape playbook. Use when operating inside a Docker container, LXC, or Kubernetes pod and need to escape to the host via privileged mode, capabilities, Docker socket, cgroup abuse, namespace tricks, or runtime vulnerabilities.

日本語の概要は準備中です。原文の説明を表示しています。

Execute a Kerberoasting attack to extract and systematically crack the NTLM hashes of Service Principal Name (SPN) accounts in an Active Directory environment. Uses tools like Rubeus, Impacket (GetUserSPNs), and Hashcat to achieve domain privilege escalation domain: cybersecurity

日本語の概要は準備中です。原文の説明を表示しています。

Exploit Active Directory Certificate Services (AD CS) misconfigurations, specifically ESC1. By requesting a certificate based on a overly permissive template that allows the enrollee to supply a Subject Alternative Name (SAN), an attacker can impersonate highly privileged users (like Domain Admins) and seamlessly escalate privileges across the entire AD environment.

日本語の概要は準備中です。原文の説明を表示しています。

Dry-run Trust Magnitude for proposed named skills or suites before curation. Use when deciding whether a proposed suite deserves A/S treatment, when checking Fusion Score structural inputs, when comparing repo stars vs suite component counts, or when asked to appraise a candidate before adding it to the registry.

日本語の概要は準備中です。原文の説明を表示しています。

Bootstrap a new standalone skill repo under gaia-research/ from the canonical template set at gaia-research/gaia-research/templates/skill-repo/. Handles the full flow: interactive prompts for all placeholders, fetches templates via the GitHub API, substitutes values, creates the new repo (gaia-research/skill-<name>), writes README.md / SKILL.md / install.sh / .gitignore / LICENSE / powered-by-gaia.svg, makes the initial commit and pushes. Also supports update mode: re-applies the template structure to a pre-existing skill repo and opens a draft PR with the drift. Use when the user says "new skill repo", "bootstrap a skill repo", "/skill-template", "create skill-foo", "spin up a gaia-research skill repo", "template a new skill", "align skill-fuse to the template", or "/skill-template update <repo>". Requires: gh CLI (authenticated with gaia-research org access), python3, git.

日本語の概要は準備中です。原文の説明を表示しています。

Inspect or exercise the paused gaia curate orchestration scaffold for one source URL. The command currently persists an INITIALIZED run ledger and reports status; its 25 named workflow states and transition methods are a design skeleton, not an implemented automated curation or merge pipeline. Use only for scaffold development, status inspection, or dry-run contract work. For live curation, use gaia-full-pipeline or gaia-consult. Trigger phrases: "/gaia-quick-curate", "inspect gaia curate", "curate scaffold", "quick curate status". For batch/multi-page runs use gaia-curate-dynamic; for crawler branches use gaia-bot-curate; for pending intake proposals use gaia-draft-curate.

日本語の概要は準備中です。原文の説明を表示しています。

Batch wrapper for /gaia-ingest. Ingests a bounded set of already-verified evidence rows through CLI-only writes, uses --no-build on every row, appraises Trust Magnitude for every affected named skill, then runs exactly one build and validation pass. Use for an L4-approved intake after /ev-pipeline; benchmark-result rows also require a Phase 2B report and explicit human gate approval.

日本語の概要は準備中です。原文の説明を表示しています。

Canonical entry point for the full Gaia evidence verification pipeline. Invoke as /evidence-verification-pipeline or /ev-pipeline — both names trigger this skill. Use whenever you need to run the evidence phases end-to-end: collecting raw evidence from the data lake, verifying live GitHub star counts, running Phase 2B benchmark-source verification, running adversarial auditing for noise and URL errors, and checking link health via Firecrawl. Also use when someone says "run the evidence pipeline", "verify the evidence lake", "audit evidence", "run ev-pipeline", "full evidence check", "pipeline run", "prepare evidence for ingestion", or "refresh the data lake". This is the pre-ingestion step — run it before importing any evidence into the registry.

日本語の概要は準備中です。原文の説明を表示しています。

Generate a prioritized review queue of registry skills and catalog items that need attention. Use this skill whenever someone asks: "what needs review?", "what's overdue for audit?", "where are the weak spots in the registry?", "what should I audit next?", "run a health check on the registry", "show me flagged skills", "find problems in the registry", "what skills need fixing?", or "triage the registry". This is the triage layer — it surfaces candidates ranked P0–P4 so that focused work (via /gaia-audit) targets the right things first. Run this before any audit pass. Also invoke proactively when a PR changes registry/named/ at scale, or before a release, to catch regressions early.

日本語の概要は準備中です。原文の説明を表示しています。

Comprehensive, reusable playbook for multi-component suite intake under Yggdrasil III. Audits component installability, maps origin candidates to generic capabilities, ingests named components with shared-repo baseline caps, manifests suites via gaia dev fuse, calibrates capstone and component ranks, and closes out via Class S regeneration.

日本語の概要は準備中です。原文の説明を表示しています。

Playbook for correcting a named skill's star level to match its computed Trust Magnitude grade, with an independent post-calibration verification pass and a CLI-logged timeline event (never hand-written). Use when: recalibrating a skill's level, fixing a stale or drifted star rating, running a batch of `gaia dev calibrate` corrections, or confirming a past calibration actually landed. Triggers: "calibrate <skill>", "recalibrate the trust magnitude backlog", "promote/demote <skill> to N stars", "why is <skill> still N stars", "verify a calibration actually landed", "Hall of Heroes ranking is wrong".

日本語の概要は準備中です。原文の説明を表示しています。

Close out a review/meta branch that lands an evidence-ingest / curation batch: create the named nodes, ingest verified evidence, appraise Trust Magnitude, calibrate stars, wire suites, correct upstream naming, stage ONLY the intended artifacts (dropping CRLF churn and blocking leaks), validate, and open the PR. Use when a curation/ingest batch is verified and ready to land, or when the user says "close the review/meta branch", "land the ingest batch", "wrap up the intake PR", "/gaia-review-meta-close". Wraps the deterministic hygiene in scripts/review_meta_close.py and gates the judgment calls (calibration, Origin, suite promotion, naming, merge) behind explicit human checkpoints.

日本語の概要は準備中です。原文の説明を表示しています。

Atomically ingest one already-verified evidence row into one named Gaia skill using the CLI, then appraise Trust Magnitude and propose—never silently apply—a calibration. Use after /ev-pipeline has verified an approved intake source, or whenever a curator says "ingest evidence", "add verified evidence", "gaia-ingest", or "turn this source into registry evidence".

日本語の概要は準備中です。原文の説明を表示しています。

Phase 1 of the Gaia evidence verification pipeline. Use this skill whenever you need to gather, consolidate, or refresh raw evidence for named skills in the registry. Trigger phrases: "collect evidence", "populate the data lake", "gather sources", "run ev-collection", "Phase 1", "compile the evidence index", "refresh the unified lake", "aggregate skill evidence", "build the evidence database". Also invoke as the first step before running ev-star-verification, ev-adversarial-audit, or ev-link-validation — nothing downstream is meaningful without a fresh, compiled index. Covers GitHub repo links, stargazer signals, YouTube showcases, arXiv papers, peer reviews, benchmark results, blog/newsletter posts, and self-attestation artifacts.

日本語の概要は準備中です。原文の説明を表示しています。

Account-based marketing for B2B SaaS. Use this skill to build a target account list, tier it 1:1 / 1:few / 1:many, size it against sales capacity, turn intent and engagement signals into plays, write the multi-channel orchestration contract each tier runs on, and measure the program in account coverage, penetration and pipeline instead of MQLs. Also triggers on: ABM, account-based marketing, target account list, TAL, named accounts, account tiering, 1:1 ABM, one-to-few, programmatic ABM, account selection, ideal customer profile fit, intent data, buying signals, 6sense, Bombora, Demandbase, account penetration, account coverage, sales and marketing alignment on accounts, enterprise account program.

日本語の概要は準備中です。原文の説明を表示しています。

Generate AI video ads and image ads through the Novoads REST API (api.novoads.ai). Use when the user wants a UGC video, a product video, a talking-head ad, an AI actor holding a product, a TikTok or Reels or Shorts ad, a static image ad, or asks to "make me an ad", "generate a video", or names a model (Seedance, Seedance 2.5, Seedance Mini, Omni Flash, Veo 3.1, Sora 2, GPT Image 2, Nano Banana Pro, Reve). Handles upload, dialogue approval, cost confirmation, generation, polling, QA, and download. A product photo lands here when it SEEDS a new scene; when the picture itself should move, unchanged, that is image-to-motion. Not for editing an existing video file and not for publishing to an ad platform.

日本語の概要は準備中です。原文の説明を表示しています。