2,878 件 ・ 関連度順
概要と使いどころ
Use when AI contribution metadata must match the actual workflow, when model alias and dated identifiers need auditing, when verified and fabricated citation counts feed a release decision, or when a venue's AI disclosure statement needs evidence behind it.
日本語の概要は準備中です。原文の説明を表示しています。
Hunt Local File Inclusion (LFI), Remote File Inclusion (RFI), and Path Traversal — /etc/passwd read, log poisoning → RCE, PHP filter-chain RCE (no upload needed), php:// / data:// / zip:// / phar:// wrappers, RFI via allow_url_include, directory traversal read/write/delete. Covers OOB/blind LFI confirmation and false-positive discipline. Use when hunting file-include or path-traversal bugs on any target.
日本語の概要は準備中です。原文の説明を表示しています。
Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need to resolve where tools, wordlists, and clones are installed on the local machine (jhaddix, SecLists, trufflehog, ffuf, dalfox, ghauri); for pure orchestration/routing use the bug-bounty skill. Workflow it covers — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass...
日本語の概要は準備中です。原文の説明を表示しています。
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation ...
日本語の概要は準備中です。原文の説明を表示しています。
Red-team operator discipline — the mindset corrections that separate offensive testing from defensive WAPT. Built from authorized red-team work where conservative defaults caused multiple findings to be missed and one to be incorrectly retracted. Use at the START of any red-team engagement and again whenever feeling stuck or considering 'stopping' on a defended target. The single most important skill to load when scope is 'external red team' not 'bug bounty / WAPT'.
日本語の概要は準備中です。原文の説明を表示しています。
Comprehensive red team operations methodology covering full engagement lifecycle from planning through reporting. Addresses engagement scoping and rules of engagement negotiation, multi-tier C2 infrastructure design with redirectors and domain fronting, malleable traffic profiles and beacon tradecraft, OPSEC discipline including attribution avoidance and indicator management, EDR and AMSI evasion techniques using direct syscalls and unhooking, data collection with chain-of-custody controls, and structured reporting with purple team debrief workflows. Covers assumed-breach, external-to-internal, insider threat, and hybrid physical-cyber engagement scenarios with MITRE ATT&CK mapping throughout. Targets operators planning or executing adversary simulation engagements against mature defenders.
日本語の概要は準備中です。原文の説明を表示しています。
Okta-as-IdP red-team attack chain — tenant discovery, user enumeration (multiple vectors), authentication flow analysis (factors enumeration, push-notification fatigue, SMS bypass), password spray with lockout discipline, Okta-specific phishing primitives (kits, FastPass abuse, OIDC redirect_uri tampering), MFA enumeration, post-compromise admin API surface. Many enterprise orgs use Okta instead of (or alongside) Entra ID. Distinct endpoints, distinct rate-limiting, distinct factor flows. Use when recon shows `<tenant>.okta.com`, `<tenant>.okta-emea.com`, `<tenant>.oktapreview.com`, or autodiscover-style records pointing at Okta IdP.
日本語の概要は準備中です。原文の説明を表示しています。
Fetch and display BBC News stories from various sections and regions via RSS feeds. Use when the user asks for BBC news, UK news headlines, world news from BBC, or news from specific BBC sections (technology, business, politics, science, health, entertainment, regional UK news, or world regions).
日本語の概要は準備中です。原文の説明を表示しています。
Perform AI-powered web searches with real-time information using Perplexity models via LiteLLM and OpenRouter. This skill should be used when conducting web searches for current information, finding recent scientific literature, getting grounded answers with source citations, or accessing information beyond the model knowledge cutoff. Provides access to multiple Perplexity models including Sonar Pro, Sonar Pro Search (advanced agentic search), and Sonar Reasoning Pro through a single OpenRouter API key.
日本語の概要は準備中です。原文の説明を表示しています。
Securely store, search, and use secrets (API keys, tokens, passwords, SSH keys) with hal-vault, an SSH-key encrypted local secret store. Use when the user shares a credential that should be saved, asks what secrets are stored or where a key is, or when a command/workflow needs a secret injected. Core discipline - never print raw secret values into chat, logs, or files; reference secrets only by their masked form, and use --reveal only to feed another process, never into a command argument (where it lands in the machine's process table) or into text you write down.
日本語の概要は準備中です。原文の説明を表示しています。
Handle images with ImageMagick (magick) — read metadata, resize, crop, rotate, convert format, combine images (side-by-side or grids with montage), overlay logos/watermarks, and losslessly compress with oxipng before sending. Use when the user sends an image to process, when you produce an image to deliver, or before attaching any image to a message or upload — compressing first keeps transfers fast and tokens low. Core discipline - always compress before delivering, never expose local file paths to the user, and fail open (if a tool is missing or a step errors, pass the original through unchanged; never block the task).
日本語の概要は準備中です。原文の説明を表示しています。
Audit whether a "current product focus receipt" (Decision/Now/Why-now/Evidence/Not-now/Cut-suspend/First-visible-proof/ Acceptance-gate/Kill-revisit-trigger/Owner/Review-date) and the work order it gates state a real, testable decision and a real agent launch — not planning-placeholder prose that sounds like an assignment but can't be proven. Use when deciding whether to launch an agent chain against a milestone or a stated "focus," when a work order lacks explicit input/output/owner/proof-gate, or when an acceptance gate would only prove a cached UI state instead of daemon truth. NOT for distinguishing roadmap items from energy-driven sidequests (legible-roadmap-with-sidequests), reviewing a PRD/prototype for product-completeness gaps like cold start or pricing (product-reality-reviewer), or accepting already-finished work against a personal acceptance bar (port-daddy-user-surrogate-pm-review).
日本語の概要は準備中です。原文の説明を表示しています。
Rigorous benchmarking of multi-agent coordination systems: experiment design, statistical analysis, human evaluation protocols, and reproducible reporting. NOT FOR ML model evaluation (use llm-evaluation-harness), A/B testing for web products, survey design, or general data science.
日本語の概要は準備中です。原文の説明を表示しています。
Use when introducing a feature flag system, choosing between release flags / experiment flags / operational flags / kill switches / permission flags, designing percentage rollouts, building kill-switch + circuit-breaker patterns, structuring evaluation contexts (user IDs, plan tier, region), or building flag-cleanup discipline. Triggers: LaunchDarkly / GrowthBook / Unleash / Flagsmith / OpenFeature, percentage ramp, sticky bucketing, kill switch wired to alerting, "we still have flags from 2 years ago", flag debt, OpenFeature provider, evaluation context, default value on provider failure. NOT for A/B test statistical analysis (separate skill), traffic-split routing at the edge, build-time bundler defines, or environment-based config.
日本語の概要は準備中です。原文の説明を表示しています。
Refute-before-prove research discipline: automated counterexample sweeps before any formalization, meter-integrity audits for information-bound experiments, mutation-tested model checkers, pre-registered commit-or-cut gates for speculative directions, wrong-turn reporting, and numeric-claim provenance. Use when validating any new theorem, bound, equilibrium, or security claim; when building or trusting a checker, simulator, or experiment; or when deciding whether a speculative research direction lives or dies. NOT for exploratory brainstorming, product prioritization, writing style, or literature review.
日本語の概要は準備中です。原文の説明を表示しています。
Analytical methods for decomposing expert performance into cognitive and physical task components
日本語の概要は準備中です。原文の説明を表示しています。
Master of text-based visual communication using ASCII art, Unicode box-drawing, and structured diagram notation. Creates clear, maintainable diagrams for systems, processes, hierarchies, relationships, and psychological structures. Proactively generates diagrams to enhance understanding. Activate on visualization needs, system architecture, process flows, psychological mapping, or when complex concepts would benefit from visual representation. NOT for photo editing, vector graphics, or GUI-based design tools.
日本語の概要は準備中です。原文の説明を表示しています。
Analyze hierarchical DAG-like systems by separating undirected substrate from ordering metadata, then classifying diamonds, mixers, shortcuts, and hidden cycle structure. Use for workflow architecture, citation or genealogy DAG comparison, and information-flow diagnosis. NOT for ordinary cycle detection in arbitrary graphs, one-node runtime debugging, or systems with no real ordering constraint.
日本語の概要は準備中です。原文の説明を表示しています。
Expert in color theory, palette harmony, and perceptual color science for computational photo composition. Specializes in earth-mover distance optimization, warm/cool alternation, diversity-aware palette selection, and hue-based photo sequencing. Activate on "color palette", "color harmony", "warm cool", "earth mover distance", "Wasserstein", "LAB space", "hue sorted", "palette matching". NOT for basic RGB manipulation (use standard image processing), single-photo color grading (use native-app-designer), UI color schemes (use vaporwave-glassomorphic-ui-designer), or color blindness simulation (accessibility specialists).
日本語の概要は準備中です。原文の説明を表示しています。
Facilitate idea generation sessions that actually produce diverse, useful options instead of degenerating into the first plausible answer. Use for product ideation, feature exploration, problem-reframing, naming, design alternatives, strategic option-generation, or any task where the failure mode is "we picked the obvious thing too fast." Covers solo and group sessions, divergence/convergence discipline, technique selection (SCAMPER, Crazy Eights, How Might We, 6-3-5 Brainwriting, Reverse Brainstorming, Worst Possible Idea, Random Stimulus), facilitation moves for handling dominant voices and groupthink, and structured convergence to a shortlist with rationale. Outputs a session artifact with options generated, evaluation, shortlist, and the rejected-but-interesting list.
日本語の概要は準備中です。原文の説明を表示しています。
Author a pull request an AI coding agent can actually get merged: a scoped, coherent diff; a Summary and Test Plan backed by real evidence; correct triage of required-and-blocking CI gates versus external/advisory checks (e.g. a Cloudflare Pages preview build); draft-while-WIP discipline; named fixup commits for real review findings; and a clean landing through a merge queue without force-pushing or bypassing branch protection. Use when opening, updating, triaging red CI on, or landing an agent-authored GitHub PR. NOT for this repo's internal release ceremony, actor embodiments, or contributor mirror-sync mechanics (use port-daddy-internal-dev), tracking backlog/issue lifecycle across a board (use agent-issue-tracker-workflow), or deciding what to build next / sequencing a roadmap (use legible-roadmap-with-sidequests).
日本語の概要は準備中です。原文の説明を表示しています。
Designs digital experiences for ADHD brains using neuroscience research and UX principles. Expert in reducing cognitive load, time blindness solutions, dopamine-driven engagement, and compassionate design patterns. Activate on 'ADHD design', 'cognitive load', 'accessibility', 'neurodivergent UX', 'time blindness', 'dopamine-driven', 'executive function'. NOT for general accessibility (WCAG only), neurotypical UX design, or simple UI styling without ADHD context.
日本語の概要は準備中です。原文の説明を表示しています。