「findings」の検索結果

Detect insecure JWT (JSON Web Token) implementations in a codebase using a two-phase approach: first map all JWT issuance and verification sites to understand the token lifecycle and signing configuration, then check each verification site for exploitable weaknesses such as algorithm confusion, missing signature verification, weak secrets, header injection, and missing claim validation. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/jwt-results.md. If no JWT usage is found in Phase 1, Phase 2 is skipped. Use when asked to find JWT, token forgery, or authentication bypass bugs.

日本語の概要は準備中です。原文の説明を表示しています。

Detect SQL injection vulnerabilities in a codebase using a three-phase approach: recon (find unsafe SQL construction sites), batched verify (trace user input to those sites in parallel subagents, 3 sites each), and merge (consolidate batch results). Covers string concat, f-strings, unsafe ORM methods, and dynamic identifiers. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/sqli-results.md. Use when asked to find SQLi or database injection bugs.

日本語の概要は準備中です。原文の説明を表示しています。

Detect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload sites), batched verify (check extension bypass and related issues in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/fileupload-results.md. Use when asked to find file upload, unrestricted upload, or extension bypass bugs.

日本語の概要は準備中です。原文の説明を表示しています。

Detect XML External Entity (XXE) vulnerabilities in a codebase using a three-phase approach: recon (find XML parsing sites without external-entity hardening), batched verify (trace user input to each site in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/xxe-results.md. Use when asked to find XXE or XML injection bugs.

日本語の概要は準備中です。原文の説明を表示しています。

Detect missing authentication and broken function-level authorization vulnerabilities in a codebase using a three-phase approach: recon (map endpoints and the role/permission system), batched verify (check auth/authz in parallel subagents, 3 endpoints each), and merge (consolidate batch results). Covers unauthenticated access and vertical privilege escalation (e.g., regular user accessing admin-only functions). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/missingauth-results.md. Use when asked to find missing auth, broken access control, or privilege escalation bugs.

日本語の概要は準備中です。原文の説明を表示しています。

Detect GraphQL injection vulnerabilities in a codebase using a three-phase approach: recon (confirm GraphQL usage and find unsafe operation document assembly sites), batched verify (trace user input to those sites in parallel subagents, up to 3 candidate sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/graphql-results.md. If no GraphQL technology is found in Phase 1, later phases are skipped. Use when asked to find GraphQL injection, unsafe GraphQL document construction, or operation string injection bugs.

日本語の概要は準備中です。原文の説明を表示しています。

Detect Server-Side Request Forgery (SSRF) vulnerabilities in a codebase using a three-phase approach: recon (find outbound call sites), batched verify (trace user input to destinations in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/ssrf-results.md. Use when asked to find SSRF or server-side request forgery bugs.

日本語の概要は準備中です。原文の説明を表示しています。

Consolidate all SAST vulnerability results from the sast/ folder into a single final report ranked by severity and confidentiality impact. Reads all *-results.md files and produces sast/final-report.md. Run after all vulnerability detection skills complete. Use when asked to generate a final report, consolidate findings, or summarize security results.

日本語の概要は準備中です。原文の説明を表示しています。

Detect Server-Side Template Injection (SSTI) vulnerabilities in a codebase using a three-phase approach: recon (find template rendering sites that use dynamic strings), batched verify (trace user input to those sites in parallel subagents, 3 candidates each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/ssti-results.md. Use when asked to find SSTI or template injection bugs.

日本語の概要は準備中です。原文の説明を表示しています。

Detect Cross-Site Scripting (XSS) vulnerabilities in a codebase using a three-phase approach: recon (find HTML/JS/DOM sink sites), batched verify (trace user input to sinks in parallel subagents, 3 sink sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/xss-results.md. Use when asked to find XSS or cross-site scripting bugs.

日本語の概要は準備中です。原文の説明を表示しています。

Detect path traversal vulnerabilities in a codebase using a three-phase approach: recon (find file-loading sinks with dynamic paths), batched verify (trace user input and mitigations in parallel subagents, 3 sinks each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/pathtraversal-results.md. Use when asked to find path traversal, directory traversal, or file disclosure bugs.

日本語の概要は準備中です。原文の説明を表示しています。

Run fast, progressive experiments to map tunable parameters and their effects. Use when optimizing code, prompts, configurations, or other artifacts against a goal or benchmark, or when a long research run needs a planned hypothesis queue, focused trials, and durable findings.

日本語の概要は準備中です。原文の説明を表示しています。

Audit a repo's agent context — CLAUDE.md files, codebase docs, skills, and tool/MCP designs — against Anthropic's Claude 5 context-engineering guidance ("unhobbling": Anthropic cut ~80% of Claude Code's system prompt with no eval loss). Finds overconstraint, conflicting instructions, redundancy, stale facts, and missing "unknown knowns"; produces a scored findings report with concrete rewrites, then applies approved fixes. Use when someone says "audit my CLAUDE.md", "context audit", "unhobble this repo", "review our agent docs/skills/tools", or after upgrading to Claude 5-generation models.

日本語の概要は準備中です。原文の説明を表示しています。

Pick the right way to represent a dataset so a reader gets the finding in three seconds — a catalog of 20+ chart and diagram forms with when-to-use and failure modes, plus the encoding decisions that make any of them readable (takeaway headline, direct labels, kill the axis, highlight-and-mute, show the caveat). Style-agnostic — use with whatever palette or design system the destination already has. Use when charting survey results, benchmark data, usage metrics, or research findings for a post, brief, deck, or report, and whenever the default bar chart feels like it's burying the point.

日本語の概要は準備中です。原文の説明を表示しています。

Use when articulating what an Accounting, Organizations and Society (AOS) manuscript contributes — converting findings into a claim that changes how the field understands accounting's social, organizational, behavioral or institutional operation. Frames the payoff; it does not produce new analysis (aos-data-analysis).

日本語の概要は準備中です。原文の説明を表示しています。

Use when reasoning about how an ACL paper travels through ACL Rolling Review and conference commitment, covering reviewer and area-chair roles, meta-reviews, the commitment decision by senior area chairs and program chairs, Findings versus main-conference outcomes, ethics review escalation, and resubmission strategy across cycles.

日本語の概要は準備中です。原文の説明を表示しています。

Use when deciding whether a project fits ACL versus EMNLP, NAACL, EACL, TACL, Computational Linguistics, COLM, or an ML venue, covering contribution typing for NLP work, long-versus-short paper choice, the annual theme track, Findings-tier expectations, and sharpening the computational-linguistics framing before writing starts.

日本語の概要は準備中です。原文の説明を表示しています。

Use when preparing an accepted ACL main-conference or Findings paper for camera-ready, covering the extra content page, de-anonymization and acknowledgements, AI-assistance disclosure, keeping the Limitations section, ACL Anthology metadata and CC BY 4.0 publication, meta-review-driven edits, and presentation-mode logistics.

日本語の概要は準備中です。原文の説明を表示しています。

Use when appraising the cumulative evidence and ensuring balance in an Academy of Management Annals (Annals) review — weighing conflicting findings by credibility, steelmanning rival schools, and handling the author's own work even-handedly. Audits evidence quality and fairness; it does not design the framework (amann-organizing-framework) or build exhibits (amann-tables-figures).

日本語の概要は準備中です。原文の説明を表示しています。

Orchestrate Xcode build optimization by benchmarking first, running the specialist analysis skills, prioritizing findings, requesting explicit approval, delegating approved fixes to xcode-build-fixer, and re-benchmarking after changes. Use when a developer wants an end-to-end build optimization workflow, asks to speed up Xcode builds, wants a full build audit, or needs a recommend-first optimization pass covering compilation, project settings, and packages.

日本語の概要は準備中です。原文の説明を表示しています。

Security audit of Solidity code while you develop. Trigger on "audit", "check this contract", "review for security", "loop mode", "run the auditor in loop mode", "run 3 passes". Modes - default (full repo) or a specific filename. Loop mode runs several passes in one scan, each pass told what the earlier ones found, and ends in one combined report; it remembers findings between scans in a ledger.

日本語の概要は準備中です。原文の説明を表示しています。

Pre-sales-call intelligence composite. Deep dives on the person AND their company before a sales call, then maps findings to your product to generate talking points, objection prep, and a call strategy. Goes beyond generic attendee research — this is sales-specific intelligence that helps SDRs, AEs, and founders walk into calls with a plan. Tool-agnostic — works with any CRM, research source, and calendar.

日本語の概要は準備中です。原文の説明を表示しています。

Pre-flight policy check for Meta ads. Takes ad copy plus advertiser context, resolves and fetches the relevant Meta transparency-center policy pages at runtime, and returns a Pass / Fix Required / Block verdict with cited findings and rewrites.

日本語の概要は準備中です。原文の説明を表示しています。

Use when asked to run Design Error Detection (quick defect scan), find design errors in a Simulink model, perform root cause analysis on DED findings, fix division-by-zero, overflow, dead logic or out-of-bounds defects detected by SLDV, or diagnose why missing coverage cannot be achieved (dead logic blocking coverage objectives). Do NOT use for requirement verification, test generation, Inf/NaN detection, active logic analysis, or coverage measurement.

日本語の概要は準備中です。原文の説明を表示しています。