「escalation」の検索結果

Design and review autonomous or semi-autonomous agent loops — systems where an agent prompts itself, runs on a schedule or event, and iterates toward a goal without a human at the keyboard. Use this whenever the user wants to build, design, harden, or audit any kind of self-running agent, agentic workflow, control loop, background worker, cron/heartbeat/webhook-driven agent, "Ralph loop", auto-PR-fixer, monitoring agent, or any long-running task that should keep going on its own until done. Trigger this even when the user says "agentic workflow", "automation that runs itself", "an agent that keeps trying until X", or "make my agent stop running away / burning tokens" without using the word "loop". Also use it to review an existing loop's stopping conditions, guardrails, verification, and escalation paths.

日本語の概要は準備中です。原文の説明を表示しています。

Architect escalation approval — extend iteration limit for a phase that has hit its cap. Records the approval decision in state and allows the blocked transition to proceed.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when routing adversary findings in Phase 4. Provides routing logic, iteration limit enforcement, and escalation protocols.

日本語の概要は準備中です。原文の説明を表示しています。

Reasoning data lost across agent steps and missing low-confidence fallback Keywords: sqlite, triangulation, escalation, confidence

日本語の概要は準備中です。原文の説明を表示しています。

Complete operational workflow for implementer agents (Codex, Gemini, etc.) making code changes and writing tests. Defines the Code Change Loop, Test Writing Loop, and Issue Filing process with circuit breakers, severity levels, and escalation rules. Includes bundled scripts for specialist-review (code review) and test-review-request (test audit) that delegate to Claude CLI. Use this skill when starting any implementation task.

日本語の概要は準備中です。原文の説明を表示しています。

Complete operational workflow for implementer agents (Codex, Gemini, etc.) making code changes and writing tests. Drives all work through atomic commits — each loop operates on the smallest complete, reviewable change. Defines the Code Change Loop, Test Writing Loop, Lint Gate, and Issue Filing process with circuit breakers, severity levels, and escalation rules. Requires `committer` for all commits. Includes bundled provider-aware review scripts that keep same-model shell-outs as the last resort, plus a fresh-context Codex fallback for code review and test audit. Use this skill when starting any implementation task.

日本語の概要は準備中です。原文の説明を表示しています。

Use when assessing cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, or IaC security gaps. Covers AWS, Azure, and GCP posture assessment with MITRE ATT&CK mapping.

日本語の概要は準備中です。原文の説明を表示しています。

Draft a professional customer-facing response tailored to the situation and relationship. Use when answering a product question, responding to an escalation or outage, delivering bad news like a delay or won't-fix, declining a feature request, or replying to a billing issue.

日本語の概要は準備中です。原文の説明を表示しています。

Stand up or reset project governance for new, complex, or troubled initiatives using PMBOK 8 value delivery, OKR alignment, and Scrum or SAFe cadence choices where relevant. Use when a project needs a charter, decision rights, stakeholder map, RAID logic, escalation path, or reporting rhythm. Do not use for simple task lists, isolated sprint notes, or code implementation planning.

日本語の概要は準備中です。原文の説明を表示しています。

Summarize support tickets, chats, and customer threads into issue, impact, status, owner, and next response. Use for customer service handoffs, escalation triage, and support backlog review.

日本語の概要は準備中です。原文の説明を表示しています。

Build multi-project RAID and RAG views for portfolios, programs, or cross-functional workstreams. Use when PMOs, program managers, or leaders need a real status picture across milestones, dependencies, owners, and escalations. Do not use for a single standup note, one issue ticket, or generic meeting minutes.

日本語の概要は準備中です。原文の説明を表示しています。

Draft clear, professional business emails from rough notes, context, or instructions. Handles cold outreach, internal updates, client responses, and escalation drafts. Use when the work is routine email writing with known context and audience. Do not use for sensitive legal notices, formal regulatory correspondence, or board-level communication without review.

日本語の概要は準備中です。原文の説明を表示しています。

Post-exploitation workflow. Covers privilege escalation (Linux SUID/sudo/kernel, Windows UAC/service/token), persistence assessment, local enumeration, credential harvesting, and pivot preparation. Structured workflows for Linux and Windows targets using impacket, netexec, john, linpeas/winpeas, and standard Kali tools. Includes kernel exploit reference tables, GTFOBins exploitation chains, Potato attack selection, Docker/container escapes, DLL hijacking, SSH key harvesting, credential recovery from memory, and Windows token manipulation. Chains from /pentester or /credential-audit when access is obtained.

日本語の概要は準備中です。原文の説明を表示しています。

Test Model Context Protocol (MCP) servers and tool-calling systems for security vulnerabilities including tool injection, parameter manipulation, privilege escalation, and data exfiltration through AI agent tool interfaces. Use this skill when assessing MCP server implementations, AI agent tool integrations, or any system that exposes tools to language models. Covers tool confusion attacks, cross-tool exploitation, and MCP server hardening assessment.

日本語の概要は準備中です。原文の説明を表示しています。

Use when testing APIs and web frameworks for mass assignment vulnerabilities where user-controlled request body fields are bound directly to model attributes without a field allowlist. Trigger on: ORM update/create endpoints, REST APIs accepting JSON body, Rails strong parameters, Django model forms, Laravel fillable/guarded, Node.js Mongoose/Sequelize, PUT/PATCH requests, registration endpoints, profile update endpoints, GraphQL mutations. Detects privilege escalation via role/admin/isAdmin fields, plan upgrades via subscription fields, and horizontal access via ownerId/userId injection.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit Mass Assignment vulnerabilities in APIs and web frameworks to inject unauthorized parameters. This skill details how attackers uncover hidden fields and manipulate JSON or HTTP bodies to elevate privileges or tamper with data logic.

日本語の概要は準備中です。原文の説明を表示しています。

Deep OAuth 2.0 / OpenID Connect security assessment. Covers the full attack surface: redirect_uri validation bypass (path traversal, open redirect chains, subdomain confusion, URL parsing tricks, parameter pollution, response mode switching), missing/broken state parameter CSRF, PKCE downgrade and absent-challenge attacks, implicit grant token leakage (Referer, browser history, XSS fragment theft), authorization code injection, scope escalation, client confusion attacks, mutable-claims account takeover (iss+sub confusion, email-keyed identity merging), pre-account takeover via unverified registration, OpenID Connect dynamic client registration SSRF (logo_uri, jwks_uri, sector_identifier_uri, request_uri), nonce replay, ID token validation failures, Device Code phishing flow, mobile custom URI scheme hijacking, refresh token persistence, token introspection enumeration, consent screen clickjacking, host header injection, and cross-IdP mix-up attacks. Uses KOAuth, jwt_tool, nuclei oauth templates, and manual http(action="request", ...) payloads. Every technique includes actual request payloads and verification logic. Chains from /pentester or /api-security when OAuth endpoints are discovered. Chains into /web-exploit for open redirect, XSS, and SSRF chaining. Chains into /post-exploit when full account takeover is achieved. Chains into /credential-audit when access tokens or refresh tokens are recovered.

日本語の概要は準備中です。原文の説明を表示しています。

Identify and exploit Insecure Direct Object Reference (IDOR), or Broken Object Level Authorization (BOLA), vulnerabilities. Manipulate internal identifiers (e.g., user IDs, database primary keys, transaction IDs) within HTTP request parameters or API payloads to unauthorizedly access, modify, or delete data belonging to other users.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit misconfigured Kubernetes Role-Based Access Control (RBAC) to escalate privileges within a cluster. This skill covers identifying overly permissive roles and bindings, and leveraging them to gain cluster-admin access or compromise the host nodes.

日本語の概要は準備中です。原文の説明を表示しています。

Identify and exploit misconfigured Linux Capabilities. This skill covers how attackers escalate privileges to root without relying on SUID binaries or kernel exploits by abusing excessive capabilities like cap_dac_read_search, cap_sys_ptrace, or cap_setuid assigned to ordinary files.

日本語の概要は準備中です。原文の説明を表示しています。

Linux kernel exploitation playbook. Use when exploiting kernel vulnerabilities (UAF, OOB, race condition, type confusion) for privilege escalation via commit_creds, modprobe_path overwrite, or kernel ROP chains in CTF and real-world scenarios.

日本語の概要は準備中です。原文の説明を表示しています。

Insecure deserialization playbook. Use when Java, PHP, or Python applications deserialize untrusted data via ObjectInputStream, unserialize, pickle, or similar mechanisms that may lead to RCE, file access, or privilege escalation.

日本語の概要は準備中です。原文の説明を表示しています。

Use when hunting Broken Object Level Authorization (BOLA) or Insecure Direct Object Reference (IDOR) vulnerabilities in APIs or web applications. Trigger on: "BOLA", "IDOR", "broken object level", "access other users", "object reference", numeric or UUID IDs in URLs or request bodies, user-scoped resources, horizontal privilege escalation, "change the ID in the request", second-order IDOR, blind IDOR, indirect reference, encoded ID, deprecated API version, JSON globbing.

日本語の概要は準備中です。原文の説明を表示しています。

Cloud security posture assessment for AWS, Azure, and GCP. Tests IAM privilege escalation paths, public storage exposure, serverless attack surface, database exposure, logging gaps, container registry security, and cloud-specific attacks. Both authenticated (with cloud credentials) and unauthenticated (external) modes. Uses nuclei cloud templates, Prowler, ScoutSuite, manual IMDS/metadata probing, and deep AWS/Azure/GCP CLI enumeration. Produces: cloud architecture diagram, attack path map, findings per category, compliance mapping (SOC 2, PCI DSS 4.0, HIPAA, CIS), PoCs for confirmed exploits. Chains into /gh-export for issue filing.

日本語の概要は準備中です。原文の説明を表示しています。