「secure」の検索結果

Multi-backend database security auditor. Audits Supabase, Firebase (Firestore/RTDB/Storage/Functions/Remote Config), MongoDB (self-hosted + Atlas), self-hosted PostgreSQL, and self-hosted MySQL for RLS/rules misconfigurations, exposed credentials, auth bypasses, MongoBleed (CVE-2025-14847), pgBouncer CVE-2025-12819, mysql_native_password drift, ghost auth, and storage exposures. Use this skill whenever the user mentions database security, RLS or rule audits, security review, penetration testing a vibe-coded app, checking if their DB is exposed, hardening a backend, fixing security rules, or auditing apps built with Lovable/Bolt/Replit/Cursor/Claude Code on any of these backends. Trigger on phrases like 'is my app secure', 'check my database', 'audit my Firebase', 'audit my MongoDB', 'audit my Postgres', 'audit my Supabase', 'is my DB exposed', or any cross-backend variant ('audit my full stack').

日本語の概要は準備中です。原文の説明を表示しています。

Comprehensive guide for building robust, secure, and efficient CI/CD pipelines using GitHub Actions. Use when the task involves `creating or editing GitHub Actions workflows`, `.github/workflows/*.yml`, `CI/CD pipelines`, `GitHub Actions best practices`, or `workflow optimization`.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks 'is my site secure', 'run a security audit', 'check for vulnerabilities', 'was my site hacked', or 'fix the vulnerable plugins'. Runs the Respira security audit, reads its indicators, coverage and known vulnerabilities honestly, never calls a partial scan clean, and fixes what it finds one approved step at a time.

日本語の概要は準備中です。原文の説明を表示しています。

OWASP secure design review for code and architecture. Checks input validation, authentication, authorization, data protection.

日本語の概要は準備中です。原文の説明を表示しています。

Evaluates make-whole premium claims in bankruptcy with contract interpretation, present value disputes, and secured status analysis. Use when analyzing make-whole claims, evaluating redemption disputes, or assessing premium recovery.

日本語の概要は準備中です。原文の説明を表示しています。

PowerShell 7+ scripting and Windows system administration -- cross-platform automation, secure credential handling, Pester testing, DSC, and JEA patterns.

日本語の概要は準備中です。原文の説明を表示しています。

Design security-conscious interfaces that protect users without frustrating them. Use when the user asks about MFA, password UX, breach notifications, trust indicators, secure forms, account recovery, or making security feel safe rather than scary.

日本語の概要は準備中です。原文の説明を表示しています。

Hunt Insecure Direct Object Reference (IDOR) — test horizontal and vertical privilege escalation across user IDs, org IDs, tenant boundaries, and unguessable identifiers. Use when the user has an API endpoint with an identifier in the path/body that may be tested for unauthorized cross-user access.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user needs to deploy, operate, secure, or scale running infrastructure — cloud architecture (multi-region, VPC, FinOps), CI/CD and deployment strategies, secrets/IAM/supply-chain security, observability and SLO alerting, SRE and incident response, Kubernetes vs ECS and autoscaling, Terraform/Pulumi/CDK, or platform engineering and DORA metrics. Also for generating runbooks, pipeline configs, Terraform modules, or Kubernetes manifests. For choosing the system's architecture or stack before it runs (monolith vs microservices, which database), use software-architect.

日本語の概要は準備中です。原文の説明を表示しています。

Implement secure secrets management in Kubernetes using SealedSecrets for GitOps, External Secrets Operator for cloud secret managers, and rotation strategies. Handle TLS certificates, API keys, and credentials with encryption at rest and RBAC controls. Use when storing sensitive configuration for Kubernetes applications, implementing GitOps where secrets must be version-controlled, integrating with AWS Secrets Manager or Azure Key Vault, rotating credentials without downtime, or migrating from plaintext Secrets to encrypted solutions.

日本語の概要は準備中です。原文の説明を表示しています。

Trademark filing procedures covering EUIPO (EU), USPTO (US), and WIPO Madrid Protocol (international). Walks through pre-filing conflict checks, Nice classification, descriptiveness assessment, mark type decisions, filing basis strategy, office-specific e-filing procedures, Madrid Protocol extension, post- filing monitoring, and open-source trademark policy drafting. Use after running screen-trademark to confirm the mark is clear, when ready to secure trademark rights in one or more jurisdictions.

日本語の概要は準備中です。原文の説明を表示しています。

Audit project dependencies for version staleness, security vulnerabilities, and compatibility issues. Covers lock file analysis, upgrade path planning, and breaking change assessment. Use before a release to ensure dependencies are current and secure, during periodic maintenance reviews, after receiving a security advisory, when upgrading to a new language version, before submitting to CRAN or npm, or when inheriting a project to assess its dependency health.

日本語の概要は準備中です。原文の説明を表示しています。

Security audit checklist based on OWASP Top 10 and best practices. Covers authentication, injection, XSS, CSRF, secrets management, and more. Use when reviewing security, before deploy, asking "is this secure", "security check", "vulnerability".

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user wants to run SQL - especially analytical SQL - on local files (parquet/csv/json), URLs, S3 paths, or remote databases (Postgres, MySQL, MongoDB, ClickHouse Cloud, Iceberg, Delta Lake) without setting up a server. Provides chDB - embedded ClickHouse SQL in Python with 1000+ functions, Session for stateful multi-step pipelines, parametrized queries, and cross-source joins via `s3()`, `mysql()`, `postgresql()`, `iceberg()`, `deltaLake()`, `remoteSecure()` table functions. TRIGGER when: user wants SQL on parquet/csv/files or across remote analytical sources; uses ClickHouse SQL features (window functions, windowFunnel, geoToH3, JSON path ops, Session, parametrized queries); imports `chdb` or calls `chdb.query()`. SKIP this skill for pandas-style DataFrame method-chaining (use chdb-datastore instead) or ClickHouse server administration.

日本語の概要は準備中です。原文の説明を表示しています。

Use for ANY bug bounty, penetration test, or web/API/mobile security assessment: recon, testing endpoints, analyzing Burp traffic or any bug-bounty platform's MCP (HackerOne, Intigriti, Bugcrowd, YesWeHack, Immunefi), reviewing APKs, bypassing a WAF, enforcing scope, hunting a specific vuln class, validating findings, writing reports, or when you are stuck on a target and about to give up. Activates automatically for all bug-bounty and pentest sessions. Runs an autonomous, never-surrender predator methodology: refuses to conclude "secure", exhausts each vuln class to depth, proves a real attacker-path with impact and no false positives, tracks coverage so nothing is re-tested or skipped, diagnoses failed tooling from full logs, and hunts at maximum effort with intelligent token use until the goal is found. Activates and follows instructions in ANY language the operator writes in (the skill itself is English). Bundles a per-class web-exploitation KB, a writeup library, and PayloadsAllTheThings.

日本語の概要は準備中です。原文の説明を表示しています。

Security audit checklist based on OWASP Top 10 and best practices. Covers authentication, injection, XSS, CSRF, secrets management, and more. Use when reviewing security, before deploy, asking "is this secure", "security check", "vulnerability".

日本語の概要は準備中です。原文の説明を表示しています。

Secure environment variable management with Varlock. Use when handling secrets, API keys, credentials, or any sensitive configuration. Ensures secrets are never exposed in terminals, logs, traces, or Claude's context. Trigger phrases include "environment variables", "secrets", ".env", "API key", "credentials", "sensitive", "Varlock".

日本語の概要は準備中です。原文の説明を表示しています。

Provides a complete workflow for implementing verified email retrieval on Android Credential Manager API. Use this skill to integrate a secure, OTP-less email verification flow into an Android app. This skill solves the problem of high-friction sign-up processes by leveraging cryptographically verified credentials from trusted providers like Google.

日本語の概要は準備中です。原文の説明を表示しています。

Build frontend Solana applications with Phantom Connect SDK and Helius infrastructure. Covers React, React Native, and browser SDK integration, transaction signing via Helius Sender, API key proxying, token gating, NFT minting, crypto payments, real-time updates, and secure frontend architecture.

日本語の概要は準備中です。原文の説明を表示しています。

Build frontend Solana applications with Phantom Connect SDK and Helius infrastructure. Covers React, React Native, and browser SDK integration, transaction signing via Helius Sender, API key proxying, token gating, NFT minting, crypto payments, real-time updates, and secure frontend architecture.

日本語の概要は準備中です。原文の説明を表示しています。

REQUIRED before writing code for any feature touching auth, payments, credentials, tokens, sessions, file upload, user data, untrusted input, deserialization, network endpoints, or data deletion. Scope by that surface, not the task label — a research/experimental/local-only feature with none of it doesn't need this. Invoke it, record answers inline in the design doc or PR description, then write the code. Skipping this is how auth bypass, token leakage, and delete-the-wrong-record bugs ship. If the feature touches any of those surfaces and this hasn't run, the design is incomplete — do not proceed to implementation.

日本語の概要は準備中です。原文の説明を表示しています。

REQUIRED skill for any security-related request. Use this skill whenever the user wants to find anything dangerous, sensitive, or risky in their code, files, or repository. This includes but is not limited to: scanning for secrets/keys/tokens/credentials, checking dependencies for vulnerabilities, auditing destructive commands for missing safeguards, reviewing files for PII or internal data before open-sourcing, checking .env files or git history for leaked credentials, or any request where the concern is "is this safe/secure/exposed?" This skill provides a structured audit methodology and checklist you MUST follow — do not attempt security reviews without it. Skip this skill ONLY for pure feature work, refactoring, bug fixes, or non-security code review.

日本語の概要は準備中です。原文の説明を表示しています。

Implement authentication and authorization with Better Auth - a framework-agnostic TypeScript authentication framework. Features include email/password authentication with verification, OAuth providers (Google, GitHub, Discord, etc.), two-factor authentication (TOTP, SMS), passkeys/WebAuthn support, session management, role-based access control (RBAC), rate limiting, and database adapters. Use when adding authentication to applications, implementing OAuth flows, setting up 2FA/MFA, managing user sessions, configuring authorization rules, or building secure authentication systems for web applications.

日本語の概要は準備中です。原文の説明を表示しています。

Expert IoT engineer specializing in connected device architectures, edge computing, and IoT platform development. Masters IoT protocols, device management, and data pipelines with focus on building scalable, secure, and reliable IoT solutions.

日本語の概要は準備中です。原文の説明を表示しています。