8,960 件 ・ 関連度順
概要と使いどころ
Security testing checklist for HTTP APIs—authn/z, input validation, rate limits, sensitive data exposure, and common OWASP API issues. Use when reviewing or testing REST/GraphQL endpoints before release.
日本語の概要は準備中です。原文の説明を表示しています。
"Implement Generalized Second Price auction for ad slot allocation and pricing. Use this skill when the user needs to understand search ad auctions, compute ad positions and costs-per-click, or analyze bidding dynamics — even if they say 'how does Google Ads auction work', 'ad rank calculation', or 'second price auction for ads'.".
日本語の概要は準備中です。原文の説明を表示しています。
Verify compliance with OWASP Top 10 2021 security standards. Use when performing OWASP compliance checks and security certification.
日本語の概要は準備中です。原文の説明を表示しています。
Claude-native review of code for quality, structure, naming, and maintainability (no external AI). Use when reviewing a file or diff for code quality before committing. Trigger on "review this code", "code review", "is this well-written". For security, use /security-verify; for companion-AI review, use /review.
日本語の概要は準備中です。原文の説明を表示しています。
Dispatch reviews to external companion AIs (Codex, Gemini, Claude) for an independent second opinion on code changes, PR readiness, doc completeness, architecture, or implementation status. Use when you want a fresh-eyes review beyond Claude-native. Trigger on "get a second opinion", "companion review", "review my changes", "review the PR". For Claude-only quality checks use /code-review.
日本語の概要は準備中です。原文の説明を表示しています。
Audit Dockerfiles and Compose files against the 10 common Docker mistakes — image security, build efficiency, runtime safety. Use when reviewing or hardening Docker configs. Trigger on "audit my Dockerfile", "check this Compose file", "Docker best practices", "is my container secure".
日本語の概要は準備中です。原文の説明を表示しています。
Orchestrates the full law interpretation pipeline: MvT research, machine_readable generation with validation/BDD testing, and reverse validation. Invokes /law-mvt-research, /law-generate, and /law-reverse-validate sequentially. Use this skill proactively when: user wants to make a law executable, add machine_readable sections, or mentions "interpret" in the context of a Dutch law YAML file. Activate automatically when user opens a corpus YAML file without machine_readable sections and wants to make it executable.
日本語の概要は準備中です。原文の説明を表示しています。
Generates machine_readable execution logic for Dutch law YAML files: writes the machine_readable sections, validates against the schema, and (when a shell is available) runs the BDD suites until the model is correct. Use this skill proactively when: editing or creating machine_readable sections in law YAML files, working with corpus regulation files, or when user mentions 'generate', 'machine_readable', or wants to make a law executable. Activate automatically when user discusses law YAML files that need executable logic.
日本語の概要は準備中です。原文の説明を表示しています。
Create high-converting, visually distinctive landing pages. Use when building marketing pages, product launches, SaaS homepages, or any single-page conversion-focused website. Guides section-by-section composition with anti-AI-slop principles.
日本語の概要は準備中です。原文の説明を表示しています。
Builds a stylized 3D animated ad on the Novoads REST API as a STORYBOARD: four to six beats, each rendered from its own key frame, narration laid into the gaps, a music bed, captions burned on, assembled locally with ffmpeg. Carries the genre's beat formulas (anthropomorphized problem character, protagonist reveal, mascot mechanism scene, composited end card). Use for ANY Pixar-style, Disney-style, 3D animated or animated-film-look ad at ANY length: "Pixar style ad", "3D animated ad", "animated movie look", "cute 3D character ad", "a quick animated ad", "15 second animated ad", "30 second animated ad", "storyboard ad", "several scenes", "animated ad with a voice-over", "little mascots", or a product URL or photo for an emotional animated spot. No one-call tier, so ffmpeg is required. Not for stop-motion clay (use claymation-ad), talking-head UGC (novoads-api), video cloning, or static image ads.
日本語の概要は準備中です。原文の説明を表示しています。
Use when building Django applications - security hardening, authentication and permissions, ORM optimization, PostgreSQL features, Django 6.0, migrations, testing, and ecosystem libraries
日本語の概要は準備中です。原文の説明を表示しています。
Legal, security, privacy, and deliverability requirements every delivered app must satisfy — legal pages, PII/deletion rights, CSP/Trusted-Types/Zod, AI-agent security, RFC7807 errors, email domain auth.
日本語の概要は準備中です。原文の説明を表示しています。
Section-by-section media planning and generation. Image generation (GPT Image 2 primary, built-in fallback), logo/icon generation (Ideogram v3 → favicon set), video generation (Veo 3.1), social preview images (OG 1200x630 + AI search optimization), stock photo curation (Pexels, Pixabay), critique/remix loops (max 3 rounds), asset compression pipeline, and media performance budgets.
日本語の概要は準備中です。原文の説明を表示しています。
Use when writing or reviewing code that parses user input, builds SQL/shell commands, handles secrets/credentials, hashes passwords, changes auth checks, deserializes untrusted data, or constructs paths/URLs from input
日本語の概要は準備中です。原文の説明を表示しています。
Tauri 2.x deny-by-default security model, capabilities, permissions, scopes, ACL
日本語の概要は準備中です。原文の説明を表示しています。
Perform a direct five-axis code review across correctness, security, performance, readability, and maintainability. Use when the user asks for `/review`, PR review, security review, pre-merge review, production readiness review, or blocking issue assessment.
日本語の概要は準備中です。原文の説明を表示しています。
TLS/SSL configuration audit. Tests protocol versions (SSLv2/3, TLS 1.0/1.1/1.2/1.3), cipher strength and ordering, certificate chain validation (intermediates, CT logs, OCSP stapling, pinning), known vulnerabilities (POODLE, BEAST, CRIME, Heartbleed, ROBOT, DROWN, Ticketbleed, GOLDENDOODLE), session management (ticket reuse, resumption, fixation), renegotiation attacks, TLS 1.3-specific issues (0-RTT replay, PSK modes, downgrade), HSTS deep analysis (preload, subdomains, bypass), and certificate revocation (CRL, OCSP responder, stapled response freshness). Compliance-mapped to PCI DSS 4.0 (full Section 4), NIST SP 800-52r2, and FedRAMP. Uses testssl.sh, sslscan, sslyze, openssl, nmap NSE scripts, and nuclei SSL templates. Multi-port scanning across 20+ TLS-bearing services.
日本語の概要は準備中です。原文の説明を表示しています。
Essential exploitation payloads: anti-virus test files, file name exploits, malicious files. Curated for testing.
日本語の概要は準備中です。原文の説明を表示しています。
Generates CVE request packages from pentest findings. Reads cve-candidates.json (auto-generated at pentest completion) or findings.json directly, then produces for each qualifying vulnerability: MITRE CVE form data, GitHub Security Advisory draft, full disclosure report, and vendor notification email. Invoke manually after a pentest engagement when you have true-positive findings that warrant CVE IDs.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit misconfigured Spring Boot Actuator endpoints. This skill covers how to extract sensitive configuration details, heap dumps, environment variables, and ultimately escalating to Remote Code Execution (RCE) via `spring-cloud-starter` vulnerabilities.
日本語の概要は準備中です。原文の説明を表示しています。
Generate a NullPointer Studio styled PDF penetration test report from findings.json. Produces a professional dark-themed PDF with executive summary, risk dashboard, per-finding cards with business risk, remediation summary, and clean controls section.
日本語の概要は準備中です。原文の説明を表示しています。
Sandbox escape playbook. Use when breaking out of Python sandbox, Lua sandbox, seccomp filter, chroot jail, container/Docker, browser sandbox, or namespace isolation to achieve unrestricted code execution or file access.
日本語の概要は準備中です。原文の説明を表示しています。
SSRF playbook. Use when the server fetches URLs, resolves hostnames, imports remote content, or can be driven toward internal networks, cloud metadata, or secondary protocols.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit Prototype Pollution vulnerabilities in JavaScript/Node.js applications. This skill covers the progression from polluting `Object.prototype` to identifying functional gadgets (like `child_process.spawn`) to achieve Remote Code Execution (RCE).
日本語の概要は準備中です。原文の説明を表示しています。