6,396 件 ・ 関連度順
概要と使いどころ
Prototype pollution testing for JavaScript stacks. Use when user input is merged into objects (query parsers, JSON bodies, deep assign), when configuring libraries via untrusted keys, or when hunting RCE gadgets via polluted Object.prototype in Node or the browser.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit weak password reset and change flows via CSRF on reset forms, cross-user password modification by swapping username parameters, token predictability in reset links, reset displaying old password in plaintext (revealing weak storage), missing current-password verification on change forms, and session hijacker lockout via passwordless change. Test with Burp Suite, OWASP ZAP following OWASP Forgot Password Cheat Sheet.
日本語の概要は準備中です。原文の説明を表示しています。
Audit and attack session cookies via missing Secure/HttpOnly/SameSite attributes, overly broad Domain/Path scope, non-expiring persistent cookies, absent __Host- and __Secure- prefixes, browser cache leakage (Cache-Control: no-store missing), session token predictability via Burp Sequencer analysis, server-side session not invalidated on logout, and SSO single-logout bypass. Tools: Burp Suite Repeater/Sequencer, OWASP ZAP, EditThisCookie, Tamper Data, Cookiebro.
日本語の概要は準備中です。原文の説明を表示しています。
Business logic flaws are application vulnerabilities where valid functions are abused in unintended ways: price manipulation via hidden field tampering, workflow step-skipping, function call limit bypass (coupon reuse), process timing exploitation (race conditions on balance updates), and request forging via guessable/predictable parameters. Detect using Burp Suite proxy interception, HTTP POST/GET parameter analysis, and misuse-case testing against multi-step workflows. Tools: Burp Suite, OWASP ZAP.
日本語の概要は準備中です。原文の説明を表示しています。
OS command injection occurs when user input is passed unsanitized to a system shell via dangerous APIs: Java `Runtime.exec()`, Python `os.system/subprocess`, PHP `system/shell_exec/exec/proc_open`, C `system/exec`. Detect via pipe `|`, semicolon `;`, `&&`, `||`, backtick, `$()` operators, and time-delay payloads (`sleep 5`). Tools: Commix, Burp Suite, OWASP WebGoat.
日本語の概要は準備中です。原文の説明を表示しています。
End-to-end AI website generation pipeline. Claude Opus 4.8 emits Bolt-style <boltArtifact> envelopes (multi-file, plan-first) that customize Vite+React+Tailwind templates from pre-researched business data. Pre-research via APIs, media acquisition, brand extraction, visual inspection via GPT Image 2 vision, R2 upload (per-file content-type by extension), D1 status updates. Supports all business types: SaaS, portfolio, non-profit, restaurant, salon, medical, legal, retail, tech.
日本語の概要は準備中です。原文の説明を表示しています。
Tauri 2.x mobile development - iOS via WKWebView, Android via Android WebView, mobile plugins, Swift/Kotlin native code, permissions, debugging
日本語の概要は準備中です。原文の説明を表示しています。
Comprehensive, reusable playbook for multi-component suite intake under Yggdrasil III. Audits component installability, maps origin candidates to generic capabilities, ingests named components with shared-repo baseline caps, manifests suites via gaia dev fuse, calibrates capstone and component ranks, and closes out via Class S regeneration.
日本語の概要は準備中です。原文の説明を表示しています。
Plan a feature before writing any code. Use this skill at the START of non-trivial feature work — when the user says they want to "add", "build", "implement", "create", "develop", or "ship" a feature, endpoint, component, page, service, or capability. Especially trigger when the user's prompt is short or under-specified ("add a dashboard", "build an auth flow", "let's do user activity reports") — those need planning, not direct execution. The skill walks through requirements clarification, codebase exploration, sketches a Mermaid architecture/flow diagram of the proposed design, and produces a plan.md document the user can hand off to a fresh AI session for execution. Skip only when the change is genuinely trivial (typo fixes, single-line tweaks, renames). When in doubt, plan.
日本語の概要は準備中です。原文の説明を表示しています。
Use when a task needs the judgment of an Aviation Inspector — determining whether an air carrier's fleet is in compliance with an Airworthiness Directive across a maintenance-records sample, deciding where the FAA's compliance-and-enforcement ladder places a finding (compliance action vs. Letter of Correction vs. civil penalty vs. certificate action), auditing a Safety Management System for a functioning safety-assurance loop rather than paperwork completeness, scoping a records-sampling strategy across a fleet under surveillance, or deciding whether to ground an aircraft pending an AD compliance finding.
日本語の概要は準備中です。原文の説明を表示しています。
Browser automation via Playwright CLI for navigating pages, interacting with elements, capturing screenshots, and testing web applications through shell commands. Use when user mentions "playwright", "browser automation", "take a screenshot", "browser testing", "headless browser", "web testing", "fill out a form", "e2e test", or needs to automate browser workflows from the command line. This is a pre-installed CLI tool — do NOT install anything via npx or npm. Invoke this skill first, then use playwright-cli bash commands.
日本語の概要は準備中です。原文の説明を表示しています。
Invoke a Rubber Duck Reviewer subagent to independently critique plans and implementations before proceeding. Use when the agent is about to implement a non-trivial plan (multi-file changes, architectural decisions, security-sensitive logic, database schema changes), after completing a self-contained unit of work (module, endpoint, feature), when stuck or facing repeated failures (same test fails 2+ times, unexpected results), or when the agent wants independent validation of assumptions and design decisions. Triggers on any non-trivial implementation task where independent critique would catch blind spots before they become costly mistakes.
日本語の概要は準備中です。原文の説明を表示しています。
Analyze game design documents and implementations for core gameplay loop clarity and depth, XP leveling curves and unlock pacing, difficulty curve spikes and plateaus, skill tree viability, player motivation via Self-Determination Theory.
日本語の概要は準備中です。原文の説明を表示しています。
Use when managing Connected Apps for integration purposes — configuring OAuth policies, IP restrictions, refresh token expiry, pre-authorization assignment via profile or permission set, and monitoring connected app usage via EventLogFile. Also covers the running-integration operations: revoking a grant, rotating the consumer key or secret, pairing the app to an integration user's permission set, and the periodic review. Trigger keywords: 'revoke OAuth token', 'DeleteToken', 'OauthToken query returns nothing', 'ipRelaxation ENFORCE', 'permissionSetName', 'PermissionSetAssignment ExpirationDate', 'LoginHistory Application', 'connected app quarterly review', 'rotate consumer secret'. NOT for choosing which OAuth grant flow to implement — use integration/oauth-flows-and-connected-apps. NOT for decoding a specific OAuth error such as invalid_grant — use admin/connected-app-troubleshooting. NOT for authoring the full connectedApp / External Client App / Named Credential file or choosing the auth artefact — use admin/connected-apps-and-auth.
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill when planning or executing the human side of an Agentforce or Einstein AI feature rollout — user trust-building, AI-specific training, structured feedback collection via the Feedback API, and adoption measurement via Agentforce Analytics. NOT for turning the Einstein for Sales features on — use agentforce/agentforce-sales-ai-setup. NOT for rollout training with no AI in scope — use admin/change-management-and-training.
日本語の概要は準備中です。原文の説明を表示しています。
Multi-channel ABM automation that turns LinkedIn URLs into coordinated outbound campaigns. Scrapes profiles, enriches with Apollo (email + phone), gets mailing addresses via Skip Trace, then orchestrates email sequences, LinkedIn touches, and handwritten letters via Scribeless. The secret weapon for standing out in crowded inboxes.
日本語の概要は準備中です。原文の説明を表示しています。
Launch Marcus multi-agent experiments with independent CLI agents in tmux panes. Use when the user says "build X with Marcus", "run a Marcus experiment", "spawn N agents with Marcus", "/marcus", or references the Marcus multi-agent framework. This skill handles experiment setup, config generation, and spawning independent agent CLI processes that coordinate via the Marcus MCP server. Each agent runs in its own tmux pane with full autonomy. NOT for ClawTeam — this is specifically for the Marcus MCP-based multi-agent system. NOTE: "Marcus" is also the name of the MCP server that agents use for coordination. The /marcus skill launches experiments that USE the Marcus MCP server — they are complementary, not competing. The MCP server must be running before invoking this skill. The Marcus MCP server is agent-agnostic; this skill supports both Anthropic's claude CLI and OpenAI's codex CLI as agent harnesses (selected via --harness).
日本語の概要は準備中です。原文の説明を表示しています。
Launch Marcus multi-agent experiments with independent CLI agents in tmux panes. Use when the user says "build X with Marcus", "run a Marcus experiment", "spawn N agents with Marcus", "/marcus", or references the Marcus multi-agent framework. This skill handles experiment setup, config generation, and spawning independent agent CLI processes that coordinate via the Marcus MCP server. Each agent runs in its own tmux pane with full autonomy. NOT for ClawTeam — this is specifically for the Marcus MCP-based multi-agent system. NOTE: "Marcus" is also the name of the MCP server that agents use for coordination. The /marcus skill launches experiments that USE the Marcus MCP server — they are complementary, not competing. The MCP server must be running before invoking this skill. The Marcus MCP server is agent-agnostic; this skill supports Anthropic's claude CLI, OpenAI's codex CLI, and Google's gemini CLI as agent harnesses (selected via --harness).
日本語の概要は準備中です。原文の説明を表示しています。
Dr. Kaia Chen - AI Architect, mentor, and strategic advisor for Marcus. Use when the user says "Kaia", "Dr. Chen", "ask Kaia", "/kaia", or wants architectural advice, trade-off analysis, production readiness guidance, mentorship, a voice of reason, or a second opinion on design decisions. Kaia grounds her advice in the actual codebase (via Chen MCP tools) and research literature, and logs important decisions and insights via Simon.
日本語の概要は準備中です。原文の説明を表示しています。
Produces internal case viability and conflict check memos for personal injury litigation intake. Screens conflicts, assesses liability and damages, checks statute of limitations, and outputs an accept/decline recommendation. Use when evaluating new PI intake, running conflict checks, assessing case merit pre-filing, or preparing acceptance memos.
日本語の概要は準備中です。原文の説明を表示しています。
Use when stuck on approach, not debugging. Unstick via 7 techniques: simplification, collision-zone thinking, inversion, first principles, via negativa. For debugging use mk:sequential-thinking.
日本語の概要は準備中です。原文の説明を表示しています。
Use when stuck on approach (not debugging). Strategic unsticking via 7 non-default techniques: simplification cascades, collision-zone thinking, meta-pattern recognition, inversion, scale game, first principles, via negativa. Triggers on complexity spiraling, innovation block, recurring patterns across domains, forced-assumption solutions, scale uncertainty, told-it's-impossible, or bloated systems needing subtraction. For evidence-based root-cause debugging, use mk:sequential-thinking instead.
日本語の概要は準備中です。原文の説明を表示しています。
JIRA search + filter management via the jira-as wrapper. Triggers: 'search jira', 'find issues where X', 'jql for ...', 'export search results', 'manage saved filters'. JQL injection-safe via the shared sanitizer. NOT for single-issue CRUD (mk:jira-issue); NOT for bulk write ops (mk:jira-bulk).
日本語の概要は準備中です。原文の説明を表示しています。
Target a specific Google Chrome user profile for browser automation via CDP. Discovers installed profiles from the Chrome Local State file, launches Chrome with the requested profile attached to a debug port, and connects agent-browser via `agent-browser connect <port>`. Use when "automate using my Work/Personal Chrome", "open site with my saved session", or "use Chrome profile named <name>". NOT for headless scraping without an existing user profile (use mk:agent-browser directly); NOT for importing cookies only (use agent-browser --auto-connect state save).
日本語の概要は準備中です。原文の説明を表示しています。