「org」の検索結果

CSRF testing playbook. Use when reviewing state-changing web flows, anti-CSRF defenses, SameSite behavior, JSON CSRF, login CSRF, and OAuth state handling.

日本語の概要は準備中です。原文の説明を表示しています。

Identify and map the external corporate footprint of a target organization. Use this skill at the absolute beginning of an engagement (Reconnaissance) to identify all registered domains, subdomains, IP ranges, and Autonomous System Numbers (ASNs) owned by the target. This skill forms the foundation for all subsequent external penetration testing and attack surface management.

日本語の概要は準備中です。原文の説明を表示しています。

Identify and exploit Cross-Site Request Forgery (CSRF) vulnerabilities by bypassing weak or flawed anti-CSRF token implementations, SameSite cookie attributes, and Origin/Referer headers. Use this skill when testing state-changing web application endpoints for session riding attacks. Covers token removal, token fixation, multipart manipulation, and chaining with XSS for complete bypass.

日本語の概要は準備中です。原文の説明を表示しています。

Implement the 5-stage Funnel workflow (Notes → Leads → Primitives → Findings → Reports) for structured bug bounty hunting. Based on Critical Thinking Bug Bounty Podcast Episode 166.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit Server-Side Request Forgery (SSRF) vulnerabilities to extract AWS IAM credentials from the Instance Metadata Service version 2 (IMDSv2). This skill details how to bypass the token requirement of IMDSv2 by chaining HTTP verbs (PUT then GET) if the SSRF vulnerability allows full control over the request headers and methods.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit Server-Side Request Forgery (SSRF) vulnerabilities on Amazon Web Services (AWS) EC2 instances to access the highly sensitive Instance Metadata Service (IMDS). Circumvent basic protections and extract temporary IAM access keys, escalating privileges comprehensively across the AWS Cloud environment.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit Server-Side Request Forgery (SSRF) vulnerabilities in applications hosted on AWS EC2 instances to extract IAM credentials and User Data from the Instance Metadata Service (IMDS). This skill covers techniques for bypassing basic filters to access IMDSv1 and concepts of IMDSv2.

日本語の概要は準備中です。原文の説明を表示しています。

Business logic flaws are application vulnerabilities where valid functions are abused in unintended ways: price manipulation via hidden field tampering, workflow step-skipping, function call limit bypass (coupon reuse), process timing exploitation (race conditions on balance updates), and request forging via guessable/predictable parameters. Detect using Burp Suite proxy interception, HTTP POST/GET parameter analysis, and misuse-case testing against multi-step workflows. Tools: Burp Suite, OWASP ZAP.

日本語の概要は準備中です。原文の説明を表示しています。

Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every technique includes actual payloads, commands, and verification logic. Chains from /pentester or /codebase when API endpoints are discovered, chains into /web-exploit when classic injection points are found in API parameters, chains into /post-exploit when RCE is achieved, and chains into /ai-redteam when an LLM/AI endpoint is discovered (chat APIs, completion endpoints, RAG search, agentic tool-use, MCP servers).

日本語の概要は準備中です。原文の説明を表示しています。

Execute a complete Active Directory penetration test from initial enumeration to domain dominance. Use this skill for AD security assessments including LDAP enumeration, Kerberos attacks (Kerberoasting, AS-REP roasting), BloodHound attack path analysis, credential dumping with Mimikatz, lateral movement via PsExec/WMI/DCOM, DCSync for NTDS extraction, and Golden/Silver ticket forging. Covers the full kill chain from domain user to domain admin.

日本語の概要は準備中です。原文の説明を表示しています。

Forge highly privileged Kerberos Ticket Granting Tickets (TGTs) to gain persistent, undetectable, and long-term administrative access across an entire Active Directory domain. Use this skill during the final stages of a Red Team operation after Domain Admin access has been achieved, simulating an Advanced Persistent Threat (APT) establishing deep persistence that survives password resets.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit AI assistants equipped with web-browsing capabilities or internal API plugins to perform Server-Side Request Forgery (SSRF). This skill details injecting prompts that force the LLM to request sensitive internal endpoints, such as underlying cloud metadata services or internal networks.

日本語の概要は準備中です。原文の説明を表示しています。

Create a bilingual Notion job application tracker and organize job links, full JDs, screenshots, and application updates into it. Use for bulk job tracking, exhaustive employer-requirement extraction, and CPT/OPT/sponsorship recording.

日本語の概要は準備中です。原文の説明を表示しています。

Use when implementing Django authentication - local accounts, OAuth, email verification, MFA, OIDC, django-organizations

日本語の概要は準備中です。原文の説明を表示しています。

Implements features in vertical slices, always starting with homepage. Enforces anti-placeholder rules — no lorem ipsum, no TODO stubs, no gray boxes. Real content, real images, real interactions. TypeScript strict mode, Zod validation, and structured file organization.

日本語の概要は準備中です。原文の説明を表示しています。

One-line-prompt → cinematic, gorgeous, functional, well-tested, deployed website. Pre-hydrated SPA + full PWA kit + JSON-LD rich snippets + third-party integrations. React 19+Vite default (Angular optional). 100 concrete improvements grouped into 10 categories that EVERY single-prompt site build must satisfy before being marked done. Trigger whenever the user says 'make a website for X', 'build a site for X', 'rebuild X.com', or any equivalent one-liner.

日本語の概要は準備中です。原文の説明を表示しています。

Gorgeous/cinematic requirements every delivered app's UI must meet — anti-slop premium bar, exact brand tokens, motion, logo/image quality, WCAG 2.2 visual accessibility.

日本語の概要は準備中です。原文の説明を表示しています。

Frappe CRM guidance for leads, deals, contacts, organizations, pipelines, activities, assignment, dashboards, and sales workflows. Use when work touches Frappe CRM or CRM-style sales processes in the Frappe ecosystem.

日本語の概要は準備中です。原文の説明を表示しています。

Biome v2 unified linter, formatter, and import organizer — single Rust-powered tool replacing ESLint + Prettier with 97% Prettier compatibility and 20x faster performance

日本語の概要は準備中です。原文の説明を表示しています。

Clerk managed authentication - ClerkProvider, middleware, pre-built components, hooks, server-side auth, organizations, webhooks

日本語の概要は準備中です。原文の説明を表示しています。

In-house legal workflows for contract review against playbooks, NDA triage with GREEN/YELLOW/RED ratings, compliance briefings, and vendor checks. Use when the user invokes /review-contract, /triage-nda, /legal-risk-assessment, or /vendor-check for organisation-standard legal analysis.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files). Triggers include: any mention of 'Word doc', 'word document', '.docx', or requests to produce professional documents with formatting like tables of contents, headings, page numbers, or letterheads. Also use when extracting or reorganizing content from .docx files, inserting or replacing images in documents, performing find-and-replace in Word files, working with tracked changes or comments, or converting content into a polished Word document. If the user asks for a 'report', 'memo', 'letter', 'template', or similar deliverable as a Word or .docx file, use this skill. Do NOT use for PDFs, spreadsheets, Google Docs, or general coding tasks unrelated to document generation.

日本語の概要は準備中です。原文の説明を表示しています。

Maintain this repository's Mintlify documentation from uploaded Markdown files. Use when asked to add, update, or organize docs pages in `docs/`, place new content under `get_started`, `core`, `core/models`, or `troubleshooting`, and keep `docs/docs.json` navigation in sync with new pages.

日本語の概要は準備中です。原文の説明を表示しています。

Generate tailored SaaS and product marketing ideas across organic, paid, community, partnerships, product-led growth, retention, and launch channels. Use when the user asks for `/marketing-ideas`, marketing brainstorms, launch ideas, channel ideas, growth tactics, or a prioritized marketing plan.

日本語の概要は準備中です。原文の説明を表示しています。