4,075 件 ・ 関連度順
概要と使いどころ
bu skill covers security hardening for serverless compute platforms including AWS Lambda, Azure Functions, and Google Cloud Functions. It addresses least privilege IAM roles, dependency vulnerability scanning, secrets management integration, input validation, function URL authentication, and runtime monitoring to protect against injection attacks, credential theft, and supply chain compromises.
日本語の概要は準備中です。原文の説明を表示しています。
bu skill guides practitioners through hardening AWS Identity and Access Management configurations to enforce least privilege access across cloud accounts. It covers IAM policy scoping, permission boundaries, Access Analyzer integration, and credential rotation strategies to reduce the blast radius of compromised identities.
日本語の概要は準備中です。原文の説明を表示しています。
tespit etmeand Araştır: Azure service principal abuse including privilege escalation, credential compromise, admin consent bypass, and unauthorized enumeration in Microsoft Entra ID environments.
日本語の概要は準備中です。原文の説明を表示しています。
Implement Amazon Macie to automatically discover, classify, and protect sensitive data in S3 buckets using machine learning and pattern matching for PII, financial data, and credentials Tespit.
日本語の概要は準備中です。原文の説明を表示しています。
tespit etmeabnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetObject spikes), and potential data exfiltration using statistical baselines and time-series anomaly Tespit.
日本語の概要は準備中です。原文の説明を表示しています。
tespit etmeunusual API call patterns in AWS CloudTrail logs using boto3, statistical baselining, and behavioral analysis to identify credential compromise, privilege escalation, and unauthorized resource access.
日本語の概要は準備中です。原文の説明を表示しています。
Implements API rate limiting and throttling controls using token bucket, sliding window, and fixed window algorithms to protect against brute force attacks, credential stuffing, resource exhaustion, and API abuse. The engineer configures per-user, per-IP, and per-endpoint rate limits using Redis-backed counters, API gateway plugins, or application middleware, and implements proper HTTP 429 responses with Retry-After headers. Activates for requests involving rate limiting implementation, API t...
日本語の概要は準備中です。原文の説明を表示しています。
Implement API abuse Tespit using token bucket, sliding window, and adaptive rate limiting algorithms to prevent DDoS, brute force, and credential stuffing attacks.
日本語の概要は準備中です。原文の説明を表示しています。
Tests APIs for Broken Function Level Authorization (BFLA) vulnerabilities where regular users can invoke administrative functions or access privileged API endpoints by directly calling them. The tester identifies admin and privileged endpoints, then attempts to access them with regular user credentials by manipulating HTTP methods, URL paths, and request parameters. Maps to OWASP API5:2023 Broken Function Level Authorization. Activates for requests involving BFLA testing, admin endpoint bypas...
日本語の概要は準備中です。原文の説明を表示しています。
tespit etmeand prevent API enumeration attacks including BOLA and IDOR exploitation by monitoring sequential identifier access patterns and authorization failures.
日本語の概要は準備中です。原文の説明を表示しています。
Use to create, update or verify the Lean 4 executable specification under lean/ from the exploration documents (event-timeline, hotspots, ubiquitous-language, ux-review, model-review) — initial generation, reflecting a session's results, fixing lake build, adding a command or a screen, checking a proposed feature against the model. Formalization questions go to model-review.md as MQ, never to the expert directly.
日本語の概要は準備中です。原文の説明を表示しています。
大学業務で「この資料を AI に入れて大丈夫か」「どのサービスなら安全か」と 判断が求められた時に使う、機密情報取扱の判断フレームワーク。情報分類が 個人感覚に揺れている現場で、3 段分類 (Level 1: 公開 / Level 2: 学内限定 / Level 3: 機密) に基づく一貫した可否判断を提供する。テキスト本文だけでなく ファイルメタデータ / EXIF / OCR リスクや、Custom GPT / Projects / Gem 等の 事前設定機能に登録する情報も同じ軸で扱う。所属大学規程が優先される前提での 汎用的な判定軸であり、法的助言ではない。
Explain and list Peephole sec-debt markers — deliberate, human-authorized security trade-offs recorded in code. Use when the user says /sec-debt, wants to knowingly accept a security finding, or asks what deferred security items exist.
日本語の概要は準備中です。原文の説明を表示しています。
Review the current changes for the CWE classes Peephole enforces, as a checklist including the absence-of-guard classes regexes cannot catch. Use when the user says /sec-review or asks for a security review of recent code before committing.
日本語の概要は準備中です。原文の説明を表示しています。
Print Peephole's security audit report for this project — current mode, binary integrity, the CWE-mapped decision tally, sec-debt items needing approval, and tamper-evident log-chain status. Use when the user says /sec-audit or asks what Peephole has blocked or flagged.
日本語の概要は準備中です。原文の説明を表示しています。
Show or change Peephole's enforcement mode (guided (default), audit, strict, hardened, off). Use when the user says /peephole, wants to see the current security mode, or asks to make enforcement stricter or looser.
日本語の概要は準備中です。原文の説明を表示しています。
Run a Busabase-backed sales prospecting and first-touch outreach desk with a bundled Hono App-in-Skill deployable to AirApp. Use whenever the user invokes $kelly-sales-outreach or /kelly-sales-outreach, wants to enter a product or service and discover its ideal customers, asks to continuously find target accounts or public business contacts, needs evidence-based ICP scoring and personalized outreach drafts, or wants to review and send cold outreach safely. Four subcommands - setup, profile, research, send - plus the desk itself. Every first-touch message requires human approval; one company receives one initial email; guessed addresses, purchased lists, secret exposure, automated spam, and unreviewed external sends are forbidden.
日本語の概要は準備中です。原文の説明を表示しています。
Run a Busabase-backed job-search outreach desk with a bundled Hono App-in-Skill deployable to AirApp. Use when the user invokes $kelly-jobhunt or /kelly-jobhunt, wants to turn a resume into a structured profile and a typeset PDF, wants to find target companies and their contact addresses instead of applying through a job board, wants one tailored application email drafted per company, or wants to review and approve each send. Four subcommands - setup, profile, research, send - plus the desk itself. One company receives exactly one email; mailbox credentials live in the Busabase Vault and never reach browser code.
日本語の概要は準備中です。原文の説明を表示しています。
Personal App-in-Skill inbound-inquiry reception desk (Busabase App-in-Skill) for cross-border/foreign-trade sellers, aggregating WhatsApp, Instagram, Messenger, and email inquiries into a pipeline with a product knowledge base, quote worksheet, approval queue, and follow-up reminders. Use when the user invokes $kelly-inquiry or /kelly-inquiry, mentions 询盘, inquiry desk, WhatsApp leads, quote management, 报价, foreign trade sales, follow-up reminders, or a lead pipeline, wants inquiries triaged into new/replied/quoted/negotiating/won/lost stages, agent-drafted replies and quotes reviewed before sending, or stale deals surfaced.
日本語の概要は準備中です。原文の説明を表示しています。
Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with SPNs for offline password cracking.
日本語の概要は準備中です。原文の説明を表示しています。
Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic SIEM
日本語の概要は準備中です。原文の説明を表示しています。
Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17), abnormal ticket lifetimes, and krbtgt account anomalies in Splunk and Elastic SIEM
日本語の概要は準備中です。原文の説明を表示しています。
Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Use when analyzing suspicious mobile applications for data exfiltration, command-and-control communication, credential stealing, SMS interception, or other malware indicators. Activates for requests involving mobile malware analysis, app behavior monitoring, trojan detection, or suspicious app investigation.
日本語の概要は準備中です。原文の説明を表示しています。
Detect Mimikatz execution through command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.
日本語の概要は準備中です。原文の説明を表示しています。