3,659 件 ・ 関連度順
概要と使いどころ
Form and maintain execution strategy when order, effort, evidence timing or recovery materially affects the outcome, even with a settled goal. Reuse durable task records when continuity needs them; keep clear work direct.
日本語の概要は準備中です。原文の説明を表示しています。
Preserve an approved specification through a complete implementation plan and execution. Use for major refactors, migrations, or multi-session work when a confirmed spec is authoritative; keep scope and order changes explicit.
日本語の概要は準備中です。原文の説明を表示しています。
Use for hands-on repository work when a quiet, risk-scaled engineering method can improve design, execution strategy, implementation, material incorporation, debugging, review, delegation, workspace lifecycle, or verification. Keep clear local changes direct, preserve the complete requested outcome, and add method only where risk or uncertainty justifies it. Do not use for general technical explanations, simple file lookup, casual discussion, or non-engineering writing.
日本語の概要は準備中です。原文の説明を表示しています。
Choose responsibility for substantial work before deep execution: keep one responsibility's coupled parts in a single lane, and hand a bounded or independent lane to a worker when clean context, an unknown cause, independent review, or coordinator attention materially improves the outcome.
日本語の概要は準備中です。原文の説明を表示しています。
Turn meeting notes, transcripts, or rough bullets into decisions, action items, owners, due dates, and follow-up queues. Use when the work is repetitive meeting cleanup or recap writing. Do not use for negotiation strategy, legal advice, or executive decision framing.
日本語の概要は準備中です。原文の説明を表示しています。
Analyze survey and feedback data with statistical distributions, cross-tabulations, significance testing, and open-ended theme extraction. Produces executive-ready survey reports with segment comparisons and action recommendations. Use when processing NPS, CSAT, employee engagement, or market research surveys.
日本語の概要は準備中です。原文の説明を表示しています。
Write and cascade OKRs (Objectives and Key Results) for company, department, team, or project level. Ensure objectives are inspiring and key results are measurable outcomes. Includes weekly check-in template. Use at the start of each quarter or when aligning strategy to execution. Do not use for KPI performance reviews or daily task tracking.
日本語の概要は準備中です。原文の説明を表示しています。
Translate strategy into a balanced scorecard, strategy map, OKR bridge, and executive initiative portfolio with clear measures, targets, and owners. Use when leadership needs strategic alignment, portfolio prioritization, or a management dashboard tied to outcomes. Do not use for ad-hoc brainstorming with no strategic horizon.
日本語の概要は準備中です。原文の説明を表示しています。
Calculate and interpret Earned Value Management (EVM) metrics per PMBOK 8 Measurement Performance Domain. Compute SPI, CPI, EAC, ETC, TCPI, and generate variance narratives with corrective action recommendations. Use during project execution to assess schedule and cost performance.
日本語の概要は準備中です。原文の説明を表示しています。
Build structured 3-scenario financial models (Base / Bull / Bear) for business planning or investment decisions. Sensitize revenue and cost drivers across scenarios, produce P&L summaries, cash flow bridges, and executive narratives. Aligns with FP&A 2.0 and CIMA Management Accounting standards. Use when leadership needs to understand the financial impact range of a decision. Do not use for statutory financial reporting or audit-ready financials.
日本語の概要は準備中です。原文の説明を表示しています。
Design KPI dashboards with SMART metrics, visualization selection, alert thresholds, and refresh cadence. Covers leading vs lagging indicators, data dictionary, and stakeholder-specific views. Use when building operational dashboards, executive scorecards, or team performance views.
日本語の概要は準備中です。原文の説明を表示しています。
Build a Go-to-Market (GTM) plan for new product launches, market entries, or feature rollouts. Covers market sizing (TAM/SAM/SOM), positioning, messaging, channel strategy, pricing approach, and launch timeline. Use when preparing to bring something new to market. Do not use for ongoing marketing operations or campaign execution.
日本語の概要は準備中です。原文の説明を表示しています。
Purple team automation skill that links offensive emulation (Atomic Red Team, Caldera, Stratus Red Team, Leonidas) with detection validation, telemetry-gap analysis, and continuous control testing. Use to design adversary emulation plans tied to MITRE ATT&CK, execute safe tests in lab or controlled environments, and produce evidence-backed detection coverage reports.
日本語の概要は準備中です。原文の説明を表示しています。
当你有一份书面实现计划需要在单独的会话中执行，并设有审查检查点时使用
日本語の概要は準備中です。原文の説明を表示しています。
Advanced prototype pollution playbook — server-side RCE, client-side gadgets, filter bypasses, and detection techniques. Companion to ../prototype-pollution/ for basics. Use when you've confirmed pollution and need to escalate to code execution or find framework-specific gadgets.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit misconfigured Spring Boot Actuator endpoints. This skill covers how to extract sensitive configuration details, heap dumps, environment variables, and ultimately escalating to Remote Code Execution (RCE) via `spring-cloud-starter` vulnerabilities.
日本語の概要は準備中です。原文の説明を表示しています。
Reverse shell generation and listener management. Generates platform-specific reverse shell payloads (bash, python, php, powershell, java, ruby, perl, netcat, socat, msfvenom) and sets up listeners in the Kali container. Supports one-liner generation, encoded payloads for WAF/filter bypass, listener setup with session capture, and shell stabilization. Chains from /pentester, /metasploit, or /post-exploit when command execution is confirmed.
日本語の概要は準備中です。原文の説明を表示しています。
Use when hunting Pwn Request vulnerabilities where pull_request_target workflows checkout attacker-controlled PR code and execute it in a privileged context with access to repository secrets. Trigger on: "pwn request", "pull_request_target", "checkout PR head", "npm install in CI", "lifecycle scripts in CI", "preinstall script", "postinstall script", "package.json scripts CI", "npm ci ignore-scripts false", "actions/checkout ref pull request head sha", privileged workflow running PR code, "Gato-X", supply chain via PR lifecycle scripts.
日本語の概要は準備中です。原文の説明を表示しています。
Sandbox escape playbook. Use when breaking out of Python sandbox, Lua sandbox, seccomp filter, chroot jail, container/Docker, browser sandbox, or namespace isolation to achieve unrestricted code execution or file access.
日本語の概要は準備中です。原文の説明を表示しています。
Use when hunting self-hosted GitHub Actions runner vulnerabilities where fork pull requests can execute on privileged non-ephemeral runners. Trigger on: "self-hosted runner", "runs-on self-hosted", "fork PR workflow", "non-ephemeral runner", "first-time contributor approval", "runner images", "azure-builds runner", "outside collaborator approval", "runs-on matrix", "persistent runner", "Gato GitHub Attack Toolkit", "runner agent", self-hosted CI/CD runner abuse, "git config token", "workflow log deletion", runner C2.
日本語の概要は準備中です。原文の説明を表示しています。
Generate a NullPointer Studio styled PDF penetration test report from findings.json. Produces a professional dark-themed PDF with executive summary, risk dashboard, per-finding cards with business risk, remediation summary, and clean controls section.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit Prototype Pollution vulnerabilities in JavaScript/Node.js applications. This skill covers the progression from polluting `Object.prototype` to identifying functional gadgets (like `child_process.spawn`) to achieve Remote Code Execution (RCE).
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit Server-Side Template Injection (SSTI) vulnerabilities within web applications. Use this skill when testing web applications that render dynamic content using template engines like Jinja2 (Python), Twig (PHP), Freemarker (Java), or Pug (Node.js). Covers identification via mathematical evaluation, context mapping, escaping sandboxes, and achieving Remote Code Execution (RCE).
日本語の概要は準備中です。原文の説明を表示しています。
Post-exploitation workflow. Covers privilege escalation (Linux SUID/sudo/kernel, Windows UAC/service/token), persistence assessment, local enumeration, credential harvesting, and pivot preparation. Structured workflows for Linux and Windows targets using impacket, netexec, john, linpeas/winpeas, and standard Kali tools. Includes kernel exploit reference tables, GTFOBins exploitation chains, Potato attack selection, Docker/container escapes, DLL hijacking, SSH key harvesting, credential recovery from memory, and Windows token manipulation. Chains from /pentester or /credential-audit when access is obtained.
日本語の概要は準備中です。原文の説明を表示しています。