「endpoint」の検索結果

Hunt JWT cryptographic failures — alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge a token for any identity (e.g. an admin) without knowing a secret. Use when the app authenticates with a JSON Web Token (an `eyJ...` Bearer token in the Authorization header, a cookie, or a login response). This skill OWNS JWT signature/crypto forgery (alg:none, key confusion, kid/jku header injection); hunt-ato covers JWT as one ATO path, hunt-auth-bypass covers SSO/SAML token trust, hunt-api-misconfig covers non-crypto JWT handling. Critical when a forged token grants access to another user's data or an admin-only endpoint.

日本語の概要は準備中です。原文の説明を表示しています。

Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10). Patterns: direct injection ('ignore previous instructions'), indirect injection via documents/web pages/email the model reads, ASCII smuggling (Unicode Tags block U+E0000-U+E007F, invisible to humans, decoded by the model), tool-use exfiltration (model has fetch/browse tool, attacker injects OOB URL, model exfils chat history/secrets), markdown-image zero-click exfil, system-prompt extraction, IDOR-via-AI (cross-tenant data). Targets: chatbots, RAG, summarizers, agentic copilots, MCP tools. Detection: any LLM-backed endpoint, doc upload triggering AI processing, autonomous agent with tools. Validate: OOB/Collaborator callback for exfil, verbatim-reproducible system-prompt leak (run twice), verifiable cross-tenant leak or RCE. Confabulation is NOT a finding. Use when hunting AI features, chatbots, RAG, agentic systems, MCP.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

日本語の概要は準備中です。原文の説明を表示しています。

Use when starting any task the organization may already have an approved skill, prompt, MCP server, or Agent for: reviewing code, a commit, a diff, or a pull request; writing tests or documentation; querying a database, API, or service; automating a browser or web page; running untrusted code; connecting to a SaaS tool; drafting, researching, or any other substantive work. The user will not mention Observal: the task type is the trigger. Check what is already installed, then run observal discover search as the first action, before reading the repository or working from scratch. Also use when the user wants to log in, configure Observal, inspect local harness setup, share or open a repository Agent share, manage a teamspace or invitation, process inbox items, check installed registry items, or call an endpoint without a dedicated command.

日本語の概要は準備中です。原文の説明を表示しています。

Convert a GraphQL endpoint, OpenAPI spec, or MCP server into bash CLI commands and a `tools.*` JS API runnable inside `just-bash`'s `js-exec` sandbox. Use when the user wants to expose a remote API to a sandboxed bash agent, build a tool-calling agent on top of just-bash, or generate CLI commands from an existing API spec.

日本語の概要は準備中です。原文の説明を表示しています。

Plug-in vision for text-only models. Hard rule: when a file path or URL with an image extension (.png, .jpg, .jpeg, .webp, .gif, .heic, .heif) appears anywhere in the conversation (typed by the user, injected as a `[Image: source: <path>]` line, or inside a tag) and you cannot see that image's content, run this skill on it before any other approach: no self-built OCR, no PIL, no tesseract. Also triggers on pasted-image placeholders such as `[Image #1]` and `[Unsupported Image]`. If you can actually see the image, do not use this skill. When unsure, run `modlens guard` before the first read of a session: a deny verdict means the active model has native vision and must read the image itself. Runs the modlens CLI to convert the image into structured JSON evidence: every word transcribed, layout regions, semantics, visual clues. Also use when the user asks how to install, configure, or switch modlens providers (Gemini API key, OpenAI-compatible endpoints, Claude API or Claude Code CLI).

日本語の概要は準備中です。原文の説明を表示しています。

Deploy serverless browser automation as cloud functions using Browserbase. Use when the user wants to deploy browser automation to run on a schedule or cron, create a webhook endpoint for browser tasks, run automation in the cloud instead of locally, or asks about Browserbase Functions.

日本語の概要は準備中です。原文の説明を表示しています。

Turn a website's observable HTTP traffic into a best-effort OpenAPI 3.1 spec by analyzing a `browser-trace` capture. Use when the user wants to discover/extract API endpoints from a browser session, build an OpenAPI doc from network traffic, or document a third-party site's XHR/fetch surface for client integration.

日本語の概要は準備中です。原文の説明を表示しています。

Supply-chain Bottlenecks reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Volatility Surface reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Strategy Builder reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Hedging Scenarios reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Put-spread Backtest reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Earnings IV Crush reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Volatility Smile reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Unusual Options Activity reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Greeks reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Market Sentiment reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Prediction Markets reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Payoff Simulation reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user wants to discover trending social topics, hashtags, sounds, posts, reels, shorts, creators, or formats in a niche. Searches public trend and discovery endpoints, ranks evidence, and turns trends into practical content angles.

日本語の概要は準備中です。原文の説明を表示しています。

Use when a <cross-session-message> from another Claude session asks for a change in this repo (a new endpoint, a field, a client update, a package bump). Covers getting the user's go-ahead, filling gaps in the request, pushing back on the contract, and the reply shape the requester depends on.

日本語の概要は準備中です。原文の説明を表示しています。

Use when work in this repo depends on a change in a different repo that has its own running Claude session (frontend needing a backend endpoint, backend needing a client change, a shared package bump). Covers finding the peer session, what to put in the request so it needs no follow-ups, and how to handle the reply.

日本語の概要は準備中です。原文の説明を表示しています。

Search the live web and read URLs through the You.com MCP server. Use when you need current information beyond training data: recent releases, docs, pricing, news, or any question where facts may have changed. Two endpoints: keyless basic search at https://api.you.com/mcp?profile=free, or full tools with an API key from https://you.com/platform/api-keys.

日本語の概要は準備中です。原文の説明を表示しています。