4,721 件 ・ 関連度順
概要と使いどころ
Heap exploitation playbook. Use when targeting ptmalloc2/glibc heap vulnerabilities including UAF, double free, overflow, off-by-one/null, and leveraging tcache/fastbin/unsortedbin attacks for arbitrary write or code execution.
日本語の概要は準備中です。原文の説明を表示しています。
Execute Indirect Prompt Injection attacks against Large Language Models (LLMs) by subtly embedding malicious instructions within external data sources (e.g., websites, documents, databases) that the LLM autonomously ingests. This forces the model to execute attacker-controlled commands under the guise of processing legitimate user requests.
日本語の概要は準備中です。原文の説明を表示しています。
Entry P1 category router for file access and upload workflows. Use when testing download endpoints, file paths, local file inclusion, upload flows, preview pipelines, archive extraction, or storage and sharing boundaries.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit GraphQL API vulnerabilities by leveraging Introspection queries to dump the entire database schema, performing query batching to bypass rate limits (brute forcing), and extracting deeply nested unauthorized data via graph relationship abuse.
日本語の概要は準備中です。原文の説明を表示しています。
Analyze and detect synthetic media, including deepfake videos, AI-generated images, and cloned voice audio. Use this skill when investigating potential disinformation campaigns, verifying the authenticity of digital evidence, or assessing social engineering attacks leveraging synthetic media (e.g., vishing with voice clones, spear-phishing with deepfake video calls). Covers artifact analysis, frequency detection, metadata tracing, and automated detection tools.
日本語の概要は準備中です。原文の説明を表示しています。
White-box source code security review structured around OWASP ASVS 5.0 (427 verification requirements across 16 chapters). Reads and understands application source code to build a security-aware knowledge base that enriches all downstream skills. Covers: tech stack identification, route/endpoint mapping, authentication and authorization architecture, dangerous function patterns, source-to-sink data flow tracing, IaC review, dependency analysis, ASVS compliance mapping, and LLM integration security (prompt injection, tool abuse, output handling, RAG poisoning, MCP server patterns). When LLM/AI framework usage is detected, automatically reviews OWASP LLM Top 10 patterns from source code and chains into /ai-redteam with white-box context for live endpoint testing. Chains into /pentester, /threat-modeling, /web-exploit, /api-security, /cloud-security, /analyze-cve, /credential-audit, and /ai-redteam — providing white-box context that transforms black-box testing into targeted, informed assessment.
日本語の概要は準備中です。原文の説明を表示しています。
Cloud security posture assessment for AWS, Azure, and GCP. Tests IAM privilege escalation paths, public storage exposure, serverless attack surface, database exposure, logging gaps, container registry security, and cloud-specific attacks. Both authenticated (with cloud credentials) and unauthenticated (external) modes. Uses nuclei cloud templates, Prowler, ScoutSuite, manual IMDS/metadata probing, and deep AWS/Azure/GCP CLI enumeration. Produces: cloud architecture diagram, attack path map, findings per category, compliance mapping (SOC 2, PCI DSS 4.0, HIPAA, CIS), PoCs for confirmed exploits. Chains into /gh-export for issue filing.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit flaws in API rate limiting enforcement. Use this skill when encountering HTTP 429 Too Many Requests errors during password brute-forcing, OTP validation, credential stuffing, or enumeration attacks. These bypasses leverage IP spoofing, parameter manipulation, and edge-case application logic.
日本語の概要は準備中です。原文の説明を表示しています。
Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every technique includes actual payloads, commands, and verification logic. Chains from /pentester or /codebase when API endpoints are discovered, chains into /web-exploit when classic injection points are found in API parameters, chains into /post-exploit when RCE is achieved, and chains into /ai-redteam when an LLM/AI endpoint is discovered (chat APIs, completion endpoints, RAG search, agentic tool-use, MCP servers).
日本語の概要は準備中です。原文の説明を表示しています。
Execute a DCSync attack mimicking the behavior of a legitimate Active Directory Domain Controller (DC). Leverage Directory Replication Service Remote Protocol (DRSR) permissions to silently request and extract the password hashes (NTLM/Kerberos) of any or all users in the domain without executing code on the target Domain Controller.
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill when the user wants the full existing-registry Trust Magnitude inspector: understand why a named Gaia skill has a particular star rank, what its Trust Magnitude (TM) score is, which evidence rows are contributing (or dead), how far it is from the next grade, or what evidence to add to move the needle. Also use when asked for a full leaderboard of all named skills ranked by TM. Triggers: "why does X have 3 stars", "what's the TM for X", "inspect TM", "explain the score for X", "what evidence would rank up X", "show leaderboard", "rank all skills by TM", "what's dragging down X's score", "dead evidence rows", "how close is X to grade A/S".
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill when the user wants to understand why a named Gaia skill has a particular star rank, what its Trust Magnitude (TM) score is, which evidence rows are contributing (or dead), how far it is from the next grade, or what evidence to add to move the needle. Also use when asked for a full leaderboard of all named skills ranked by TM. Triggers: "why does X have 3 stars", "what's the TM for X", "inspect TM", "explain the score for X", "what evidence would rank up X", "show leaderboard", "rank all skills by TM", "what's dragging down X's score", "dead evidence rows", "how close is X to grade A/S".
日本語の概要は準備中です。原文の説明を表示しています。
Design focus modes that actually protect attention: Do Not Disturb schedules, app filtering, notification tiers, and context-specific setups. Use when interruptions fragment your day or 'do not disturb' never stays on.
日本語の概要は準備中です。原文の説明を表示しています。
Building robust document ingestion — chunking, metadata, and multi-format pipelines for search and RAG.
日本語の概要は準備中です。原文の説明を表示しています。
Split documents for retrieval effectively — fixed, semantic, structural, and hierarchical chunking with overlap tuning. Use when RAG retrieval quality depends on how documents are divided.
日本語の概要は準備中です。原文の説明を表示しています。
Build LLM applications with chain-style orchestration frameworks — prompts, chains, tool-calling agents, memory, and retrieval pipelines. Use when structuring multi-step LLM programs, adding tools to a model, or composing RAG systems in code.
日本語の概要は準備中です。原文の説明を表示しています。
Build data-centric LLM applications with indexing and retrieval frameworks — document ingestion, indices, query engines, and RAG pipelines. Use when the core problem is getting the right data in front of the model.
日本語の概要は準備中です。原文の説明を表示しています。
This skill provides expert-level guidance for Test-Driven Development (TDD) in VS Code extension development following t-wada methodology. Use when writing tests before implementation, creating comprehensive test suites, implementing Red-Green-Refactor cycles, or improving test coverage for extension components like WebViews, terminal managers, and activation logic.
日本語の概要は準備中です。原文の説明を表示しています。
This skill provides comprehensive guidance for setting up and configuring test environments for VS Code extension projects. Use when initializing a new test infrastructure, configuring test runners (Vitest), setting up CI/CD test pipelines, integrating coverage tools (v8/c8), or troubleshooting test configuration issues.
日本語の概要は準備中です。原文の説明を表示しています。
Generate tests from Allium specifications. Use when the user wants to propagate tests, generate test files from a spec, write tests for a specification, create property-based tests, produce state machine tests, check test coverage against spec obligations, or understand what tests a specification requires.
日本語の概要は準備中です。原文の説明を表示しています。
Decide whether several finished branches ship as ONE PR or stay separate. Use when holding 2+ green branches before `shipyard pr`. Trades CI cost against revert granularity, urgency, and the diff-coverage gate.
日本語の概要は準備中です。原文の説明を表示しています。
Generate and maintain browser demos of Pulp audio plugins (both web ABIs — WAM and WCLAP) from one declarative config, so every demo mounts the SAME shared player and the two ABIs stay in lockstep. Invoke it whenever you publish/update a browser demo of a Pulp plugin, add a plugin to a demo gallery, stand up a new gallery, or touch demo pages/hosting. It runs a deterministic generator (config → stamped WAM+WCLAP site + owned-files manifest) and a blocking validator (config schema, cross-origin-isolation coverage, OG metadata, regeneration ownership). Customization is declarative config in <repo>/.pulp-web-demo/config.json (schema bundled) plus at most two typed module seams; the shared player (pinned @danielraffel/web-player) holds all UX behavior and is never vendored. Works in Claude and Codex.
日本語の概要は準備中です。原文の説明を表示しています。
Leveraged-prototype dev loop (`pulp loop`) — focus marker plus normal watch/rebuild loop, with AOT analyzer guidance and deferred ar-swap/PR-monitor playbook. Use when porting an existing UI/bundle to Pulp, doing visual/behavioral parity work, or batching upstream framework gap fixes.
日本語の概要は準備中です。原文の説明を表示しています。
Marketing analytics and data-driven optimization for B2B SaaS campaigns. Use this skill when analyzing marketing performance, optimizing conversion rates, running A/B tests, conducting customer research, creating marketing dashboards, building attribution models, analyzing funnel metrics, or storytelling with data. Also triggers on: marketing ops, performance analytics, CRO, A/B testing, data storytelling, customer insights, tracking plan, event taxonomy, UTM taxonomy, GA4 audit, consent mode, instrumentation contract, sample size calculation, minimum detectable effect, test duration, not enough traffic to A/B test, statistical significance, Bayesian vs frequentist, sample ratio mismatch, experiment feasibility, martech stack, marketing tech stack audit, tool consolidation, build vs buy, vendor evaluation, shadow IT tools, ESP/CRM/platform migration, switching cost, cutover plan, suppression list migration, data portability, customer interviews, survey design, sampling frame, non-response bias, how many people should I interview, thematic saturation, voice of customer, jobs-to-be-done, buyer persona research, is this finding real, data enrichment, which enrichment provider should we buy, waterfall enrichment, contact data quality, match rate, our list data is bad, email verification, catch-all domain, accept-all, bounce rate from bad data, B2B data decay, how often should we re-verify contacts, ZoomInfo vs Apollo vs Clearbit evaluation, cost per usable record, where did this list come from, GDPR Article 14 notice, purchased list compliance, suppression screening, TAM list building, demand planning, marketing plan, how many leads do we need, what pipeline target should marketing carry, funnel model, top-down vs bottom-up plan, plan of record, annual marketing planning, quarterly planning, pipeline coverage we have to create, sales cycle lag, our leads cannot close this quarter, carry-in pipeline, scenario planning, conservative moderate aggressive forecast, stretch target, reforecast, re-forecast triggers, assumption register, capacity ceiling, addressable audience ceiling, marginal cost per lead, blended CPL is wrong, we missed plan and nobody knows why, AI policy for the marketing team, AI governance, AI acceptable use policy, which AI tools are we allowed to use, can I paste customer data into ChatGPT, shadow AI, AI use register, human review of AI output, when can we stop reviewing every AI draft, can the agent send on its own, the AI made a mistake now what, pull back AI autonomy, AI evals, our AI vendor changed the model, AI output went out wrong, prompt injection, can our AI read prospect replies safely, lethal trifecta, the AI leaked internal notes, turn off auto-generated ad assets, auto-applied recommendations, AI literacy training, EU AI Act Article 4, duplicate records in the CRM, dedupe before import, which value wins in a merge, CRM cleanup.
日本語の概要は準備中です。原文の説明を表示しています。