4,742 件 ・ 関連度順
概要と使いどころ
Generates CVE request packages from pentest findings. Reads cve-candidates.json (auto-generated at pentest completion) or findings.json directly, then produces for each qualifying vulnerability: MITRE CVE form data, GitHub Security Advisory draft, full disclosure report, and vendor notification email. Invoke manually after a pentest engagement when you have true-positive findings that warrant CVE IDs.
日本語の概要は準備中です。原文の説明を表示しています。
Server-Side Request Forgery (SSRF) occurs when user-controlled input is used to construct URLs that the server fetches, enabling access to internal services, cloud metadata endpoints (169.254.169.254), and local files via `file://` scheme. Detect via parameters accepting URLs or hostnames, PDF/report generators rendering `<iframe>/<img>/<script>`, and blind SSRF via out-of-band DNS callbacks. Bypass filters using IP decimal/octal/hex encoding, URL-userinfo tricks, and URL fragments. Tools: Burp Collaborator, curl.
日本語の概要は準備中です。原文の説明を表示しています。
Identify Open Redirect vulnerabilities where applications route users to arbitrary external URLs based on unvalidated input. Prove maximum impact by chaining Open Redirects with OAuth token theft, SSRF, or Phishing, graduating this typically low-risk finding into a high-severity report.
日本語の概要は準備中です。原文の説明を表示しています。
Full penetration test using MCP tools — recon, scanning, exploitation, and reporting. Tailored for OpenCode (BYO LLM). Supports network/web targets and local codebases. Chains into analyze-cve, threat-modeling, and remediate skills automatically.
日本語の概要は準備中です。原文の説明を表示しています。
CSV/spreadsheet formula injection (DDE, Excel/LibreOffice, Google Sheets IMPORT*). Use when exports, imports, or user fields feed spreadsheets or reporting tools.
日本語の概要は準備中です。原文の説明を表示しています。
Formats all confirmed pentest findings from findings.json into copy-pasteable GitHub issue markdown blocks, following the AppSec reporting guide template.
日本語の概要は準備中です。原文の説明を表示しています。
Full ASVS 5.0 compliance assessment against a codebase and/or architecture diagrams. Reads all 346 controls from the companion CSV, performs targeted code analysis per control, and produces a complete matrix marked COMPLIANT / NON_COMPLIANT / NOT_RELEVANT — with per-control reasoning and evidence (code snippets, file:line references, diagram observations). Outputs a reviewed CSV matrix and a self-contained HTML evidence report.
日本語の概要は準備中です。原文の説明を表示しています。
Triages an Aikido security findings CSV against a local codebase. For each finding, reads the flagged file, traces the code path, and verdicts it as KEEP OPEN or CLOSE with a specific reason. Outputs a reviewed CSV and a self-contained HTML evidence report. Run this at the end of a pentest when an Aikido CSV is available.
日本語の概要は準備中です。原文の説明を表示しています。
Write flux commentary for P&L and balance-sheet lines over threshold, comparing current period against prior period and budget with drivers explained from underlying activity. Use for month-end close packages and management reporting.
日本語の概要は準備中です。原文の説明を表示しています。
Read every application.yaml in the workspace and report the state of the search — the ranked queue, what is waiting on you, what has gone quiet, and the regression of the pipeline's own predictions against actual outcomes. Writes the calibration findings back into job_search.md and preferences.yaml.
日本語の概要は準備中です。原文の説明を表示しています。
Frappe Insights and analytics guidance for dashboards, query design, charts, permissions, metrics, ERPNext reporting, and operational analytics. Use when work touches Frappe Insights or analytics in the Frappe ecosystem.
日本語の概要は準備中です。原文の説明を表示しています。
ERPNext-aware reasoning for accounting, selling, buying, stock, manufacturing, projects, HR, support, education, CRM, and other ERPNext module work. Use when a task affects ERPNext module behavior, configuration, reports, dashboards, workflows, or customizations.
日本語の概要は準備中です。原文の説明を表示しています。
Frappe customization-surface guidance covering Custom Field, Property Setter, Client Script, Server Script, Workspace, Web Page, Page, Print Format, Report, Dashboard, Workflow, Role, Notification, Webhook, and related builder/admin DocTypes. Use when choosing or changing Frappe customization layers.
日本語の概要は準備中です。原文の説明を表示しています。
Frappe backend guidance for Python and backend-adjacent JavaScript surfaces such as client interaction patterns, hooks, APIs, patches, scheduler logic, reports, and server-side review. Use when implementing or reviewing Frappe backend behavior.
日本語の概要は準備中です。原文の説明を表示しています。
Inspect a codebase, a stack the user describes, or a description of what they want to build; map what is there to agents-inc catalog skills — or intent to candidate built-in stacks the user picks from — and emit a SeedPayload plus a human-readable proposal report. Use when seeding a configuration for a project that has none.
日本語の概要は準備中です。原文の説明を表示しています。
Toolkit for styling artifacts with a theme. These artifacts can be slides, docs, reportings, HTML landing pages, etc. There are 10 pre-set themes with colors/fonts that you can apply to any artifact that has been creating, or can generate a new theme on-the-fly.
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill any time a spreadsheet file is the primary input or output. This means any task where the user wants to: open, read, edit, or fix an existing .xlsx, .xlsm, .csv, or .tsv file (e.g., adding columns, computing formulas, formatting, charting, cleaning messy data); create a new spreadsheet from scratch or from other data sources; or convert between tabular file formats. Trigger especially when the user references a spreadsheet file by name or path — even casually (like "the xlsx in my downloads") — and wants something done to it or produced from it. Also trigger for cleaning or restructuring messy tabular data files (malformed rows, misplaced headers, junk data) into proper spreadsheets. The deliverable must be a spreadsheet file. Do NOT trigger when the primary deliverable is a Word document, HTML report, standalone Python script, database pipeline, or Google Sheets API integration, even if tabular data is involved.
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files). Triggers include: any mention of 'Word doc', 'word document', '.docx', or requests to produce professional documents with formatting like tables of contents, headings, page numbers, or letterheads. Also use when extracting or reorganizing content from .docx files, inserting or replacing images in documents, performing find-and-replace in Word files, working with tracked changes or comments, or converting content into a polished Word document. If the user asks for a 'report', 'memo', 'letter', 'template', or similar deliverable as a Word or .docx file, use this skill. Do NOT use for PDFs, spreadsheets, Google Docs, or general coding tasks unrelated to document generation.
日本語の概要は準備中です。原文の説明を表示しています。
Re-read pinned on-chain facts and watch documentary source fingerprints behind failure scenarios monthly, reporting drift without approving or changing scenario records automatically.
日本語の概要は準備中です。原文の説明を表示しています。
Route a vague Prisma Next prompt to the right specific skill. Use for "help me with Prisma Next", "what is Prisma Next", "explain Prisma Next", "I'm new to PN", "where do I start", "what can I do with Prisma Next", "what can I do next with Prisma", "just ran createprisma", "tour of Prisma Next", "Prisma Next overview", and comparison questions like "Prisma Next vs Prisma 7", "PN vs Drizzle", "PN vs Kysely", "PN vs TypeORM". Do NOT use when the prompt clearly matches a workflow skill — adoption / quickstart / first-touch orientation / brownfield introspection, schema / contract editing, migration authoring (db update / migration plan / migrate), migration review on deploy / concurrent migrations, queries / db.orm / db.sql / TypedSQL, runtime / db.ts / middleware wiring, build / Vite plugin / Next.js plugin, debug / structured error envelopes / PN-* error codes, or feedback / bug report / feature request — load that sibling skill directly.
日本語の概要は準備中です。原文の説明を表示しています。
Review a PR or the current branch for a Lumen design-system change — routes each changed file to React (web/Tailwind) or React Native (useStyleSheet) guidelines, checks the Nx version plan, and reports a flat, severity-scored finding list. Use when the user asks to review a PR, review code changes, check a branch, do a local code review, or provides a GitHub PR URL.
日本語の概要は準備中です。原文の説明を表示しています。
Append a session/state snapshot to MEMORY.md (regardless of where it lives — for this repo it's `founder/MEMORY.md`). Use when the user says "snapshot memory", "save state to memory", "/memory-snapshot", "log what happened in MEMORY", or otherwise asks to record the current session's outcomes for the next orchestrator. Locates the project's MEMORY.md, prepends a dated entry above the previous snapshot (newest first), preserves every existing entry (NEVER overwrites or truncates), and reports back the file path + byte delta. Not for one-off feedback memories (use the user-level memory system at ~/.claude/.../memory/ for those). Not for trimming or deleting old entries.
日本語の概要は準備中です。原文の説明を表示しています。
Publish a new post (announcement, link, or LaTeX-style meta report) to the Gaia site. Use when you want to add any update to the registry's public feed and landing page.
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill when the user wants to turn code graph analysis into tracked GitHub issues — "audit the architecture", "find god nodes", "triage architectural debt", "run graphify and log issues", "what's over-coupled in this codebase", "create issues from graphify findings", "check for structural problems", "scan for architectural smells", or any request that combines codebase topology analysis with issue tracking. This skill runs graphify to build a dependency graph, parses GRAPH_REPORT.md for god nodes and structural patterns, converts findings into GitHub issue payloads, and optionally pushes them to the repo. It bridges static analysis and project management in a single automated pass. Requires graphify and gh CLI.
日本語の概要は準備中です。原文の説明を表示しています。