4,244 件 ・ 関連度順
概要と使いどころ
Active Directory and network lateral movement assessment. Pass-the-hash, pass-the-ticket, Kerberoasting, AS-REP roasting, NTLM relay, SMB relay, WMI/WinRM/PSRemoting abuse, constrained/unconstrained delegation, RBCD, cross-trust exploitation, and pivoting. Uses impacket, netexec, enum4linux-ng, smbmap, smbclient, bloodhound-python, Responder, ntlmrelayx, mitm6, and ldap-utils. Chains from /post-exploit or /credential-audit.
日本語の概要は準備中です。原文の説明を表示しています。
JNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code path reaching InitialContext.lookup().
日本語の概要は準備中です。原文の説明を表示しています。
HTTP request smuggling exploits disagreements between a front-end proxy and back-end server on where one HTTP request ends and the next begins, using conflicting `Content-Length` and `Transfer-Encoding: chunked` headers (CL.TE, TE.CL, TE.TE variants). Enables bypassing access controls, cache poisoning, session hijacking, and capturing other users' requests. Detect via timing attacks, differential responses, and tools like Burp's HTTP Request Smuggler extension.
日本語の概要は準備中です。原文の説明を表示しています。
Execute an IPv6 DNS Spoofing attack using `mitm6` on an IPv4-only corporate network. Exploit default Windows behavior (preferring IPv6 DHCP/DNS) to intercept NTLMv2 hashes, force WPAD rogue proxy settings, and relay credentials to Active Directory services.
日本語の概要は準備中です。原文の説明を表示しています。
Analyze and detect synthetic media, including deepfake videos, AI-generated images, and cloned voice audio. Use this skill when investigating potential disinformation campaigns, verifying the authenticity of digital evidence, or assessing social engineering attacks leveraging synthetic media (e.g., vishing with voice clones, spear-phishing with deepfake video calls). Covers artifact analysis, frequency detection, metadata tracing, and automated detection tools.
日本語の概要は準備中です。原文の説明を表示しています。
CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content.
日本語の概要は準備中です。原文の説明を表示しています。
Execute and analyze malware samples within a highly controlled, instrumented sandbox environment to observe their true behavior, network communications, file system modifications, and registry changes in real-time.
日本語の概要は準備中です。原文の説明を表示しています。
Container escape playbook. Use when operating inside a Docker container, LXC, or Kubernetes pod and need to escape to the host via privileged mode, capabilities, Docker socket, cgroup abuse, namespace tricks, or runtime vulnerabilities.
日本語の概要は準備中です。原文の説明を表示しています。
Bypass antivirus and Endpoint Detection & Response solutions during red team operations using payload obfuscation, process injection, AMSI bypass, ETW patching, and custom loaders. Use this skill when AV/EDR is blocking your payloads, tooling, or post-exploitation activities. Covers shellcode encryption, syscall-based injection, unhooking techniques, and living-off-the-land approaches for opsec-safe red team operations.
日本語の概要は準備中です。原文の説明を表示しています。
Container and Kubernetes security assessment. Tests container escape vectors, Docker/containerd socket exposure, K8s RBAC misconfigurations, pod security violations, exposed API servers, etcd access, service account token abuse, image layer secrets, private registry attacks, SSRF to metadata services, cross-namespace network bypass, CIS benchmarks, crypto miner detection, resource exhaustion, and admission controller gaps. Both external and internal (compromised pod) perspectives. Uses trivy, kube-bench, kubectl, nuclei, dive, amicontained, and docker-bench-security. Covers OWASP Kubernetes Top 10 and all 22 Kubernetes Goat attack scenarios.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit pervasive logical flaws in Multi-Factor Authentication (MFA/2FA) implementations to bypass the secondary authentication challenge entirely. Techniques include response manipulation, referal spoofing, token reuse, and predictable backup codes.
日本語の概要は準備中です。原文の説明を表示しています。
401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.
日本語の概要は準備中です。原文の説明を表示しています。
Use when running or wiring OpenScientist for AI Gene Review gene-function hypotheses, especially blinded comparisons against local bioinformatics analyses.
日本語の概要は準備中です。原文の説明を表示しています。
Orchestrates implementation of all tasks for a feature using an agent team. Respects task dependencies, runs tasks in correct order, parallelizes independent tasks. Does NOT build, run tests, or commit at any point — verification is delegated to the caller (typically `/start-job`, which runs `build-verify` and `pr-review uncommitted` afterwards). Use when the user says "implement all tasks", "run the task sequence", "implement the feature", or wants to execute multiple tasks from a task list end-to-end.
日本語の概要は準備中です。原文の説明を表示しています。
Design or revise Interpreter UI for non-developers with an ultra-minimal, utilitarian style inspired by the OpenAI website and ChatGPT, not the developer platform. Use when simplifying settings, onboarding, chat, forms, empty states, or helper copy; when removing extra containers, labels, or visual noise; when replacing technical wording with plain language; when clarifying hierarchy and making the main user action obvious; when making every visible label and status understandable to an average HR admin or other non-technical user; when hiding implementation details such as logs, IDs, endpoints, paths, or protocol names; or when a screen must respect the app's existing CSS variables and light/dark theme behavior.
日本語の概要は準備中です。原文の説明を表示しています。
Use when building dynamic Django web apps with htmx - partial rendering, HTMX responses, querystring tag, CSP
日本語の概要は準備中です。原文の説明を表示しています。
Vite config, path aliases, vendor chunk splitting, environment-specific builds, Rolldown codeSplitting, Sass modern API, build targets, module preload
日本語の概要は準備中です。原文の説明を表示しています。
Recharts composable chart components - LineChart, BarChart, AreaChart, PieChart, ComposedChart, responsive sizing, custom tooltips, animations
日本語の概要は準備中です。原文の説明を表示しています。
Socket.IO v4.x client patterns, connection lifecycle, reconnection, authentication, rooms, namespaces, acknowledgments, binary data, TypeScript integration
日本語の概要は準備中です。原文の説明を表示しています。
Backend specification planning frameworks. Use when a spec touches API endpoints, database schema, middleware, or auth. Covers endpoint contracts with request/response shapes, error catalogs, auth per endpoint, schema design with constraints and indexes, migration strategy, and middleware pipeline ordering.
日本語の概要は準備中です。原文の説明を表示しています。
Tamagui universal UI - styled(), tokens, themes, optimizing compiler, responsive media queries, animations, Sheet/Dialog components
日本語の概要は準備中です。原文の説明を表示しています。
Pinecone serverless vector database -- index management, vector operations, metadata filtering, namespaces, hybrid search, inference API
日本語の概要は準備中です。原文の説明を表示しています。
Express.js routes, middleware, error handling, request/response patterns
日本語の概要は準備中です。原文の説明を表示しています。
Speech-to-text transcription and translation via OpenAI Audio API -- models, response formats, timestamps, prompting, streaming, chunking, and diarization
日本語の概要は準備中です。原文の説明を表示しています。