440 件 ・ 関連度順
概要と使いどころ
AI-first security scanning with Medusa. 3,000+ detection patterns covering AI/ML, agents, MCP, RAG, prompt injection, and traditional SAST vulnerabilities. Wraps Medusa CLI with SARIF/JSON parsing, structured finding output, OWASP mapping, and remediation guidance.
日本語の概要は準備中です。原文の説明を表示しています。
Verify fix commits address security findings without introducing new bugs or regressions. Analyzes diffs for anti-patterns like removed validation, weakened access control, reduced error handling, reordered external calls, and changed integer operations. Generates structured FIX_REVIEW_REPORT with finding status tracking.
日本語の概要は準備中です。原文の説明を表示しています。
Smart contract and secure API contract security analysis — invariant checking, access control, reentrancy, and integer overflow patterns. Implements Checks-Effects-Interactions pattern, formal invariant verification, and OpenSCV vulnerability taxonomy for Solidity/EVM and Rust/Solana contracts.
日本語の概要は準備中です。原文の説明を表示しています。
Write Bugcrowd-format reports — VRT (Vulnerability Rating Taxonomy) mapping, P1-P5 severity, impact-led writing, and Bugcrowd-specific submission etiquette. Use AFTER triage-validation passes for Bugcrowd programs.
日本語の概要は準備中です。原文の説明を表示しています。
Use when dependency upgrades need batching for CVEs, a major release, forced compatibility, a scheduled or vulnerability-triggered sweep. Not for PR queue triage: use github-backlog-triage.
日本語の概要は準備中です。原文の説明を表示しています。
Security audit checklist based on OWASP Top 10 and best practices. Covers authentication, injection, XSS, CSRF, secrets management, and more. Use when reviewing security, before deploy, asking "is this secure", "security check", "vulnerability".
日本語の概要は準備中です。原文の説明を表示しています。
Security audit checklist based on OWASP Top 10 and best practices. Covers authentication, injection, XSS, CSRF, secrets management, and more. Use when reviewing security, before deploy, asking "is this secure", "security check", "vulnerability".
日本語の概要は準備中です。原文の説明を表示しています。
Reviews code for quality and security issues. Combines code quality review with security vulnerability detection. Use when reviewing code after generation in Construction Phase.
日本語の概要は準備中です。原文の説明を表示しています。
Use when the user asks to write a threat / risk / vulnerability assessment, or wants the appropriate template for each type. Distinct structures and section ordering per assessment kind. Prefers graded evidence items from /quality-of-information-check and runs that skill first when handed raw URLs or text. Confidence is capped by the weakest load-bearing claim, and at Moderate when the evidence is ungraded.
日本語の概要は準備中です。原文の説明を表示しています。
Use when prioritising CVEs, the user asks "should we patch X first?" / "is CVE-YYYY-NNNNN being exploited?", or wants weaponisation, EPSS, and KEV context combined into a patch-now-vs-later recommendation.
日本語の概要は準備中です。原文の説明を表示しています。
Shodan API reference. Host reconnaissance, port scanning, and vulnerability data.
日本語の概要は準備中です。原文の説明を表示しています。
Use when you need Liberty91 platform intelligence — what actually happened (deduplicated Threat Events with every source, Admiralty reliability/credibility and verification stage), whether an IOC is already known to your account, the canonical threat library (actors, malware, vulnerabilities, clusters, ATT&CK TTPs), alert matches, or which of your customer organizations an occurrence affects — or when you need to push intelligence back: ingesting your own report, generating an intelligence package, or uploading an organization document. Also supplies event provenance fields, when the platform returns them, and Threat Library alias resolution to /source-provenance and /quality-of-information-check. Two-way, first-party integration. Commonly invoked by /ip-investigation and friends, /ioc-enrichment-workflow, /threat-actor-profiling, /campaign-tracking and /vulnerability-intelligence. Reads $LIBERTY91_API_KEY.
日本語の概要は準備中です。原文の説明を表示しています。
Executes comprehensive red team exercises that simulate real-world adversary operations against an organization's people, processes, and technology. The red team operates with stealth as a primary objective, employing the full attack lifecycle from initial reconnaissance through objective completion while testing the organization's detection and response capabilities. This differs from penetration testing by focusing on adversary emulation rather than vulnerability identification. Activates for requests involving red team exercise, adversary simulation, adversary emulation, or full-scope offensive security assessment.
日本語の概要は準備中です。原文の説明を表示しています。
Assess identified vulnerabilities for exploitability, impact, and risk. Provide CVSS scoring and remediation strategies. Use when analyzing security findings.
日本語の概要は準備中です。原文の説明を表示しています。
Build and maintain a project Risk Register per PMBOK 8 Risk Performance Domain. Identify risks, assess probability and impact, define response strategies, and track residual risk. Use throughout the project lifecycle — not just at planning. Do not use for operational incident response or security vulnerability scanning.
日本語の概要は準備中です。原文の説明を表示しています。
Generates CVE request packages from pentest findings. Reads cve-candidates.json (auto-generated at pentest completion) or findings.json directly, then produces for each qualifying vulnerability: MITRE CVE form data, GitHub Security Advisory draft, full disclosure report, and vendor notification email. Invoke manually after a pentest engagement when you have true-positive findings that warrant CVE IDs.
日本語の概要は準備中です。原文の説明を表示しています。
Essential fuzzing payloads: SQL injection, command injection, special characters. Curated essentials for vulnerability testing.
日本語の概要は準備中です。原文の説明を表示しています。
Smart contract vulnerability playbook. Use when auditing Solidity/EVM contracts for reentrancy, integer overflow, access control, delegatecall, flash loan, signature replay, and MEV-related attack patterns.
日本語の概要は準備中です。原文の説明を表示しています。
Plan and execute authorized phishing and social engineering campaigns for red team engagements. Use this skill when conducting simulated social engineering attacks including email phishing, spear phishing, vishing, pretexting, and credential harvesting. Covers GoPhish setup, pretext development, payload delivery, and measuring human vulnerability. Requires explicit written authorization before any testing.
日本語の概要は準備中です。原文の説明を表示しています。
Integrate Kaido (Caido) proxy with Claude Code CLI for automated HTTP interception, request replay, and vulnerability scanning. Based on Critical Thinking Ep. 166.
日本語の概要は準備中です。原文の説明を表示しています。
Use the H1 Brain MCP Server to pull HackerOne program policies, scope definitions, and disclosed vulnerability reports directly into Claude's context. Based on Critical Thinking Bug Bounty Podcast Episode 166.
日本語の概要は準備中です。原文の説明を表示しています。
Detect and exploit Insecure Direct Object Reference (IDOR) vulnerabilities in web applications and APIs. Use this skill when testing for unauthorized access to resources by manipulating object identifiers like user IDs, order numbers, file references, or API endpoints. Covers parameter tampering, UUID prediction, hash manipulation, and chained IDOR attacks for maximum impact in bug bounty programs.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit CVE-2023-36884, a critical Remote Code Execution vulnerability in Windows and Office associated with the Storm-0978 APT. This skill covers the weaponization of malicious Word documents to achieve code execution upon opening, bypassing Mark-of-the-Web (MotW) defenses.
日本語の概要は準備中です。原文の説明を表示しています。
Entry P0 primary router for HackSkills. Use when the task involves web application testing, API security assessment, recon, vulnerability triage, exploit path planning, or choosing the right next category skill before any deep topic skill.
日本語の概要は準備中です。原文の説明を表示しています。