「vulnerability」の検索結果

Vulnerability and security scan (defensive, your own repo): dependency CVEs plus risky code patterns (secrets, injection, weak authz), severity x reachability triaged and remediated without suppressing. Complements the built-in /security-review. Triggers on "absolute audit", "security audit", "are we vulnerable", "scan for CVEs", "check for secrets/injection", "harden this".

日本語の概要は準備中です。原文の説明を表示しています。

Think and work like an expert Climate Risk Analyst. Use when a task calls for Climate Risk Analyst judgment. Reasons from TCFD/IFRS S2 four-pillar disclosure, NGFS Phase V orderly/disorderly/hot-house scenarios, hazard–exposure–vulnerability and RMS/AIR/CLIMADA cat economics, transition carbon-price and stranded-asset pathways, and PCAF financed emissions while treating exposure geocoding quality, Kotz damage-function retraction, and scenario-not-forecast misuse as first-class failure modes.

日本語の概要は準備中です。原文の説明を表示しています。

Look up Common Vulnerabilities and Exposures (CVEs) with severity scores, affected software, exploitability status, and remediation guidance. Essential for security research, vulnerability management, and patch prioritization.

日本語の概要は準備中です。原文の説明を表示しています。

Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like loaders, and anti-debug or anti-analysis logic. Do not use it when the vulnerability is already understood and the remaining task is exploitation; use pwn instead. Do not use it for pure web workflows, log or disk forensics, or standalone crypto problems unless reversing the implementation is the real blocker.

日本語の概要は準備中です。原文の説明を表示しています。

Test application security against OWASP Top 10 (2025) with automated CI tooling: OWASP ZAP (DAST), dependency/supply-chain scanning (OSV-Scanner, SBOM, provenance), Semgrep SAST, auth/session tests (JWT, OAuth, RBAC), and XSS/CSRF/SQLi/SSRF Playwright patterns. Use when: "security test," "OWASP," "vulnerability," "ZAP," "XSS," "SSRF," "dependency scan," "auth testing," "OWASP LLM Top 10." Scope is automated scanning + negative-path security tests in CI, not manual penetration testing. Not for: mapping security controls to regulations (SOC 2, HIPAA, PCI, GDPR) — use compliance-testing; pipeline stage wiring and deploy gating mechanics — use ci-cd-integration; purely functional API auth/input tests with no attacker model — see api-testing; testing your product's own LLM features or defending the agent itself (prompt-injection detector, indirect injection, jailbreak red-teaming) — use ai-system-testing. Related: ci-cd-integration, compliance-testing, api-testing, shift-left-testing, ai-system-testing.

日本語の概要は準備中です。原文の説明を表示しています。

Expert guidance for Cosign, the Sigstore tool for signing, verifying, and attaching metadata to container images and other OCI artifacts. Helps developers implement supply chain security by signing images in CI/CD, verifying signatures before deployment, and attaching SBOMs and vulnerability scan results as attestations.

日本語の概要は準備中です。原文の説明を表示しています。

Run autonomous AI-driven penetration tests on web applications using tools like Shannon, PentAGI, and similar frameworks. Use when tasks involve setting up automated penetration testing pipelines, combining AI agents with security tools (nmap, subfinder, nuclei, sqlmap), building autonomous exploit chains, generating pentest reports with proof-of-concept exploits, or integrating AI pentesting into CI/CD pipelines. Covers the full pentest lifecycle from reconnaissance to reporting using AI orchestration.

日本語の概要は準備中です。原文の説明を表示しています。

Comprehensive security auditing framework for LLM applications covering OWASP Top 10 for LLMs, threat modeling, penetration testing, and compliance with NIST AI RMF and ISO 42001Use when "security audit, llm pentest, ai security assessment, compliance audit, vulnerability assessment, security, audit, compliance, penetration-testing, owasp, llm" mentioned.

日本語の概要は準備中です。原文の説明を表示しています。

Security engineering that protects applications, data, and users from real-world threatsUse when "security, authentication, authorization, encryption, OWASP, vulnerability, XSS, SQL injection, CSRF, secrets, password, JWT, OAuth, permissions, audit, compliance, security, authentication, authorization, encryption, vulnerabilities, OWASP, compliance, audit" mentioned.

日本語の概要は準備中です。原文の説明を表示しています。

Expert in brutally honest, self-deprecating marketing that converts. Covers transparent messaging, vulnerability as strategy, "we're not for everyone" positioning, and turning weaknesses into strengths. Knows when honesty builds trust and when it backfires. Use when "anti-marketing, honest marketing, brutally honest, we're not for everyone, transparent, no bullshit, self-deprecating marketing, " mentioned.

日本語の概要は準備中です。原文の説明を表示しています。

Deep Context Builder Skill (Ultra-Granular Pure Context Mode) workflow skill. Use this skill when the user needs Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.

日本語の概要は準備中です。原文の説明を表示しています。

Deep Context Builder Skill (Ultra-Granular Pure Context Mode) workflow skill. Use this skill when the user needs Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.

日本語の概要は準備中です。原文の説明を表示しています。

API Fuzzing for Bug Bounty workflow skill. Use this skill when the user needs Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.

日本語の概要は準備中です。原文の説明を表示しています。

API Fuzzing for Bug Bounty workflow skill. Use this skill when the user needs Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.

日本語の概要は準備中です。原文の説明を表示しています。

Use when an OpenClaw maintainer or owner is reviewing a ClawHub malicious-skill profile proposal PR: checking `proposals/<GHSA-ID>/clawscan.yml`, reading the private vulnerability context without leaking it, running the SkillTrustBench Profile Gate or equivalent local benchmark, updating the accepted baseline, and promoting an accepted candidate into `internal/profiles/clawhub/clawscan.yml`.

日本語の概要は準備中です。原文の説明を表示しています。

Use when a researcher, maintainer, or contributor found or suspects a malicious skill on ClawHub and needs a private reporting workflow: opening a GitHub private vulnerability report, preparing a proposal-only PR, creating `proposals/<GHSA-ID>/clawscan.yml`, running ClawScan against the malicious skill, and explaining what evidence belongs in private versus public channels.

日本語の概要は準備中です。原文の説明を表示しています。

Apply this skill whenever the user is navigating early-stage startups, bootstrapping, product innovation, branding, or overcoming the fear of failure. Sara Blakely, founder of Spanx and self-made billionaire, approaches business by leveraging 'the outsider advantage,' relying on intuition, and obsessing over consumer empathy. Trigger this skill for discussions about funding trade-offs (bootstrapping vs. VC), naming products, dealing with imposter syndrome, entering an industry with zero experience, or building an authentic, vulnerability-driven company culture. Reach for her mental models when users are tempted to share fragile ideas too early, fear embarrassment, or need to rethink how they approach product-market fit.

日本語の概要は準備中です。原文の説明を表示しています。

Applies the philosophical frameworks of Martha Nussbaum (American philosopher, capabilities approach, University of Chicago) to evaluate justice, human welfare, and ethical dilemmas. Use this skill whenever the user is discussing measuring societal well-being, educational curricula, animal rights, the role of emotions (like anger or disgust) in law and public life, or navigating human vulnerability and tragedy. Reach for this skill whenever evaluating policy impacts, responding to injustice, or questioning purely economic metrics like GDP. It shifts the focus to what people are actually able to do and be.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill to apply the analytical lens of Judith Butler (American philosopher, gender theory, Gender Trouble). Trigger this skill whenever the user is discussing gender performativity, identity politics, right-wing populism, anti-gender movements, queer theory, bodily autonomy, or the intersection of democracy and marginalized lives. Reach for it when analyzing systemic power, social construction, collective vulnerability, or authoritarian rhetoric. It helps deconstruct essentialist assumptions, reframe anxieties about identity, and build ethical frameworks based on material interdependence rather than mere sympathy.

日本語の概要は準備中です。原文の説明を表示しています。

Write, run, and analyze structured test suites for Agentforce agents — functional AND security. TRIGGER when: user writes or modifies test spec YAML (AiEvaluationDefinition); runs sf agent test create, run, run-eval, or results commands; asks about test coverage strategy, metric selection, or custom evaluations; interprets test results or diagnoses test failures; asks about batch testing, regression suites, or CI/CD test integration; requests security testing, OWASP LLM Top 10, red-teaming, penetration testing, prompt-injection tests, a security grade, or a vulnerability assessment of an agent. DO NOT TRIGGER when: user creates, modifies, previews, or debugs .agent files (use agentforce-generate); deploys or publishes agents; writes Agent Script code; uses sf agent preview for development iteration; analyzes production session traces (use agentforce-observe); performs a static safety review of .agent file content (use agentforce-generate Section 15).

日本語の概要は準備中です。原文の説明を表示しています。

Optimize Docker images with multi-stage builds, distroless bases, BuildKit cache mounts, multi-arch builds, compose watch, security hardening (non-root, seccomp, capabilities drop), and vulnerability scanning via docker scout/trivy. Use when user asks to write a Dockerfile, optimize image size, set up docker-compose, debug containers, harden container security, or scan for CVEs. Do NOT use for Kubernetes deployments (use kubernetes), CI/CD pipeline design (use ci-cd), or Terraform (use terraform).

日本語の概要は準備中です。原文の説明を表示しています。

Runs security audits on codebases — full scans, diff reviews, threat models, vulnerability triage, remediation guidance, and finding tracking. Activate when the user says "security scan", "audit this repo", "review this PR for security", "threat model", "triage vulnerabilities", "fix this vuln", or "track findings".

日本語の概要は準備中です。原文の説明を表示しています。

Integrating OWASP ZAP/Burp Suite/Nuclei, planning penetration tests, executing DAST, and scanning for vulnerabilities. For runtime vulnerability validation. Complements Sentinel static analysis.

日本語の概要は準備中です。原文の説明を表示しています。

Geospatial risk modeling including catastrophe models, exposure analysis, and underwriting. Use when assessing spatial risk, building catastrophe models, analyzing exposure/hazard/vulnerability, or computing portfolio risk metrics.

日本語の概要は準備中です。原文の説明を表示しています。