6,861 件 ・ 関連度順
概要と使いどころ
Exploit insecure deserialization in Node.js applications (specifically targeting libraries like `node-serialize`) by crafting malicious Immediately Invoked Function Expressions (IIFE) hidden within serialized JSON objects to achieve Remote Code Execution (RCE).
日本語の概要は準備中です。原文の説明を表示しています。
IDOR and broken object authorization testing playbook. Use when requests expose object identifiers, tenant boundaries, writable fields, or missing object-level authorization checks.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit Java Insecure Deserialization vulnerabilities leading to Remote Code Execution (RCE). Identify serialized Java objects natively passed within HTTP parameters, cookies, or sockets (e.g., `rO0AB...`). Utilize `ysoserial` to meticulously craft malignant payload chains exploiting vulnerable gadget libraries like CommonsCollections inherently present in the application's classpath.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit Broken Object Level Authorization (BOLA), historically known as Insecure Direct Object Reference (IDOR), in API architectures. Extremely common and critical flaw where an API fails to validate whether the currently authenticated user actually owns or retains permissions over the specifically requested database resource (ID).
日本語の概要は準備中です。原文の説明を表示しています。
API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.
日本語の概要は準備中です。原文の説明を表示しています。
Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every technique includes actual payloads, commands, and verification logic. Chains from /pentester or /codebase when API endpoints are discovered, chains into /web-exploit when classic injection points are found in API parameters, chains into /post-exploit when RCE is achieved, and chains into /ai-redteam when an LLM/AI endpoint is discovered (chat APIs, completion endpoints, RAG search, agentic tool-use, MCP servers).
日本語の概要は準備中です。原文の説明を表示しています。
Frappe customization-surface guidance covering Custom Field, Property Setter, Client Script, Server Script, Workspace, Web Page, Page, Print Format, Report, Dashboard, Workflow, Role, Notification, Webhook, and related builder/admin DocTypes. Use when choosing or changing Frappe customization layers.
日本語の概要は準備中です。原文の説明を表示しています。
Use when optimizing or reviewing large lists, virtual scrolling, windowing, react-window, TanStack Virtual, variable-height rows, dynamic measurement, infinite scroll, grid virtualization, or scroll performance; Chinese triggers include virtual lists, large list optimization, scroll performance.
日本語の概要は準備中です。原文の説明を表示しています。
Full-funnel paid advertising operations for B2B SaaS. Use this skill for PPC strategy, Google Ads optimization, LinkedIn Ads, social media advertising, programmatic buying, creative strategy, attribution modeling, budget allocation, budget pacing and planned-vs-delivered reconciliation, audience overlap and campaign self-competition audits, suppression lists, ROAS improvement, media spend optimization, and the media no auction sells — newsletter and podcast sponsorships, community and industry-publication placements, paid review-site listings on G2 and Capterra, and pay-per-lead content syndication. It also covers buying on the AI answer surface — ads inside Google AI Overviews and AI Mode that existing Search, Shopping and Performance Max campaigns already serve into with no opt-out, no placement targeting and no segmented reporting, and ChatGPT Ads and Microsoft Copilot as separate opt-in platforms with their own plan-tier reach limits, no negative keywords, and a landing-page crawler gate. It also owns the conversion signal the bidding algorithms learn from — CRM pipeline stages (SQL, opportunity, closed-won) sent back to Google Ads, LinkedIn, Meta and Microsoft Ads through offline conversion import, enhanced conversions for leads, the Google Data Manager API and the LinkedIn Conversions API, with click-ID capture, stage values, dedupe, EEA consent signals and retractions. It also gates connected TV (CTV) and streaming video for B2B — whether a reach medium belongs in the plan, how a vendor ties a TV household to a target account (member data, IP-to-account graph or contextual), the server-side ad insertion (SSAI) fraud questions, Programmatic Guaranteed deals, and a holdout lift test because CTV has no click. It also runs person-led paid social — LinkedIn Thought Leader Ads and Meta partnership ads that put spend behind an employee's or creator's post — on a paid-usage term, an in-post disclosure check and an end-date register, because the platform approval carries no term. Also triggers on: CTV, connected TV, OTT, streaming TV ads, should we run CTV, LinkedIn CTV, B2B CTV, account-based CTV, SSAI fraud, thought leader ads, boost an employee's post, sponsor a creator's post, partnership ads, whitelisting, creator usage rights, PPC, Google Ads, LinkedIn Ads, social ads, programmatic, ad creative, attribution, media budget, paid campaigns, ROAS, CPA, ad spend, newsletter sponsorship, podcast sponsorship, community sponsorship, sponsor a newsletter, content syndication, pay-per-lead, cost per lead vendor, media kit, rate card, insertion order, direct buy, publisher partnership, make-good, G2 paid listing, Capterra ads, review site advertising, sponsorship ROI, budget pacing, we underspent our budget, are our campaigns competing with each other, audience overlap, self-competition, campaign cannibalization, suppression list, exclusion list, ad frequency across channels, how many ad accounts do we have, ads in AI Overviews, AI Mode ads, ChatGPT Ads, OpenAI Ads Manager, Copilot ads, conversational ads, should we advertise on ChatGPT, can we buy our way into the AI answer, our ads are showing in AI Overviews and we cannot report on it, context hints, OAI-AdsBot, our ad landing page fails review, robots.txt is blocking our ads, our paid leads are junk, Google Ads is optimizing for the wrong leads, offline conversion import, OCI, enhanced conversions for leads, send CRM stages back to Google Ads, upload SQLs to LinkedIn, LinkedIn Conversions API, LinkedIn CAPI, Meta conversion leads, CRM to ad platform, gclid, li_fat_id, msclkid, value-based bidding, optimize for pipeline not form fills, low match rate, conversion lag.
日本語の概要は準備中です。原文の説明を表示しています。
End-to-end SEO operations for B2B SaaS organic visibility. Use this skill when you need keyword research, technical SEO audits, content optimization, link building strategy, international expansion, AI/AEO optimization, schema markup, Core Web Vitals improvements, and organic traffic growth planning. Also triggers on: SEO, keyword research, can we rank for this keyword, which keywords are actually worth it, qualify these keywords, check the SERPs, keyword shortlist, too many keywords, technical SEO, link building, content optimization, international SEO, hreflang, x-default, multilingual site, translated pages not ranking, our German site gets no traffic, language switcher, auto-redirect by country, machine translation SEO, content parity, ccTLD vs subfolder, AI search, AEO, GEO, Core Web Vitals, schema markup, organic traffic, G2 listing, Capterra, TrustRadius, review-platform category page, best software roundup, listicle placement, directory submissions, do we need a Google Business Profile in [country], local SEO with no office, Google Business Profile eligibility, virtual office address SEO, coworking address business profile, business profile suspended, NAP consistency, local citations for SaaS, LocalBusiness schema, server log analysis, log file analysis, what is Googlebot crawling, is Googlebot hitting errors, verify Googlebot, fake Googlebot, crawl budget, do we have a crawl budget problem, Crawl Stats report, new pages not getting crawled.
日本語の概要は準備中です。原文の説明を表示しています。
Comprehensive SEO analysis for any website or business type. Orchestrates 52 sub-skills (52 active): full site audits, technical SEO (CWV/INP), schema, E-E-A-T content quality, images, sitemaps, GEO for AI Overviews, llms.txt generation, AI crawler audit, plus live GSC and Ahrefs MCP data. GSC: overview, drops, opportunities, brand-vs-nonbrand, cannibalization, compare, content-decay, index-issues, new-keywords. Ahrefs: overview, backlinks, keywords, competitors, content-gap, broken-links, new-links, anchor-analysis, dr-history, top-pages. Cross-MCP: serp, content-brief, brand-radar, site-audit-pro, report. Local: log-analysis, ai-content-check, internal-links, local, migration-check, obsidian-kb. AI Readability: llms-txt, robots-ai. Performance: lighthouse-audit, core-web-vitals, page-experience. Quality & AI Search: rich-results, ai-optimization, eeat-audit, helpful-content. Triggers on: "SEO", "audit", "schema", "Core Web Vitals", "sitemap", "E-E-A-T", "AI Overviews", "GEO", "technical SEO", "content quality", "structured data", "GSC", "Ahrefs", "backlinks", "keywords", "search console", "domain rating", "local SEO", "migration", "lighthouse", "pagespeed", "LCP", "INP", "CLS", "page experience", "interstitials", "mobile friendly", "rich results", "rich snippets", "schema eligibility", "AI optimization", "AI search readiness", "EEAT", "trust signals", "helpful content", "people-first", "content quality gate".
日本語の概要は準備中です。原文の説明を表示しています。
Detect keyword cannibalization by identifying queries where multiple pages are competing for the same ranking. Uses Google Search Console data to find queries appearing across 2 or more pages. Use when user says "keyword cannibalization", "same keyword multiple pages", "cannibalizing keywords", or "duplicate rankings".
日本語の概要は準備中です。原文の説明を表示しています。
Bootstraps Flux CD on Kubernetes clusters, creates and manages GitOps sources (Git/Helm/OCI/Bucket), configures kustomizations and Helm releases, reconciles resources, sets up image automation and alerting, and pushes OCI artifacts. Use this skill whenever the user mentions the flux CLI, flux bootstrap, flux create source, flux create kustomization, flux create helmrelease, flux reconcile, flux get, Flux CD, GitOps with Flux, or asks about managing Kubernetes deployments via GitOps. Also trigger when users ask about creating Git/Helm/OCI/Bucket sources, building or diffing kustomizations, pushing OCI artifacts, setting up image automation, creating Flux alerts/receivers, or bootstrapping Flux on GitHub/GitLab/Gitea/Bitbucket. Even if the user just says "flux" in a Kubernetes context, this skill applies.
日本語の概要は準備中です。原文の説明を表示しています。
Analyzes SIEM alert pipelines for rule optimization, alert fatigue reduction, criticality scoring, asset-based prioritization, and correlation rule design using NIST CSF and detection engineering principles..
日本語の概要は準備中です。原文の説明を表示しています。
Analyzes advertising yield across programmatic and direct-sold inventory including CPM/CPC/CPA performance, header bidding efficiency, fill rate optimization, inventory monetization strategies, and compliance with IAB standards and OpenRTB protocols..
日本語の概要は準備中です。原文の説明を表示しています。
Analyze packaging configurations for carton size selection, void fill minimization, palletization efficiency, sustainable materials, and total packaging cost reduction aligned with ISTA and ASTM D4169 standards..
日本語の概要は準備中です。原文の説明を表示しています。
Image optimization analysis for SEO and performance. Checks alt text, file sizes, formats, responsive images, lazy loading, CLS prevention, image SERP rankings (via DataForSEO), and image file optimization (WebP/AVIF conversion, IPTC/XMP metadata injection). Use when user says "image optimization", "alt text", "image SEO", "image size", "image audit", "optimize images", "image metadata", "image SERP", "convert to webp", or "image file optimize".
日本語の概要は準備中です。原文の説明を表示しています。
AI citation readiness audit as part of SEO, covering classic Google search and AI search surfaces together. Use whenever the user wants their content to rank or be cited in ChatGPT, Perplexity, Claude, Gemini, Copilot, You.com, Google AI Overviews, or Google AI Mode. AI citation optimization audit scoring blog posts for major answer surfaces. Evaluates evidence-backed citability, purpose clarity, entity clarity, structured data, and AI crawler accessibility. Suggests evidence-backed explanations and a 0-100 AI Citation Readiness score. Use when user says "geo", "ai citation", "ai optimization", "citation audit", "aeo", "perplexity optimization", "chatgpt citation".
日本語の概要は準備中です。原文の説明を表示しています。
Detect keyword cannibalization across blog posts by extracting primary keywords from titles and headings, clustering semantically similar targets, and flagging posts competing for the same search intent. Supports local-only mode (grep-based) and DataForSEO API mode (Page Intersection endpoint at ~$0.01/call). Outputs severity-scored report with merge or differentiate recommendations. Use when user says "cannibalization", "keyword overlap", "competing pages", "duplicate keywords", "cannibalize".
日本語の概要は準備中です。原文の説明を表示しています。
Scaffold and operate Claude Blog Brain, a source-cited Obsidian brain for blog content creation, optimization, and management dual-optimized for Google rankings (E-E-A-T, the 2026 core updates) and AI citations (GEO/AEO), spanning writing, rewriting and freshness, SERP-informed briefs and outlines, editorial calendars and strategy, semantic topic clusters, schema and internal linking, multilingual publishing, the FLOW framework, factchecking, personas, distribution, and the blog delivery contract, grounded in the claude-blog skill. Use when the user says "claude-blog-brain", "Claude Blog Brain", "create a blog content creation, optimization, and management dual-optimized for Google rankings (E-E-A-T, the 2026 core updates) and AI citations (GEO/AEO), spanning writing, rewriting and freshness, SERP-informed briefs and outlines, editorial calendars and strategy, semantic topic clusters, schema and internal linking, multilingual publishing, the FLOW framework, factchecking, personas, distribution, and the blog delivery contract, grounded in the claude-blog skill brain", "import sources", "synthesize plan", "render report", or wants a persistent vault-backed operating system for blog content creation, optimization, and management dual-optimized for Google rankings (E-E-A-T, the 2026 core updates) and AI citations (GEO/AEO), spanning writing, rewriting and freshness, SERP-informed briefs and outlines, editorial calendars and strategy, semantic topic clusters, schema and internal linking, multilingual publishing, the FLOW framework, factchecking, personas, distribution, and the blog delivery contract, grounded in the claude-blog skill.
日本語の概要は準備中です。原文の説明を表示しています。
Deploys a baseline landing zone foundation for a Google Cloud Organization, establishing security guardrails using Organization Policies, resource hierarchy folders and projects, billing association, and centralized logging and monitoring. Deploys Google Cloud's recommended security controls and architecture. Use when setting up a new Google Cloud Organization or establishing a secure, enterprise-grade landing zone foundation. Don't use for individual project onboarding (use google-cloud-recipe-onboarding or product-specific skills instead).
日本語の概要は準備中です。原文の説明を表示しています。
Answer natural language questions and perform analysis on GKE cluster and workload costs using BigQuery billing exports, cost allocation data, and live cluster monitoring metrics. Use when querying GKE costs across projects, namespaces, or workloads, analyzing billing reports in BigQuery (`bq`), checking cluster cost budgets (`gcloud billing`), or diagnosing cost drivers like pod requests vs. actual utilization (`kubectl top`). Don't use for applying cost optimization changes, creating rightsizing manifests (VPA/MPA), or selecting ComputeClasses (use gke-cost-optimization instead).
日本語の概要は準備中です。原文の説明を表示しています。
Turn Caveman's exact report-only repository observations into an operator-chosen optimization candidate with a paired baseline/candidate evaluation. Use when the user asks to inspect an optimization observation, evaluate a candidate change, or act on the current Caveman optimization report. Require a logged-in Caveman CLI connection and explicit approval; never infer money or actuation from a profile.
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill when prioritizing a Salesforce backlog with the MoSCoW method (Must / Should / Could / Won't) plus an effort + value lens, deciding what fits in the next sprint or release, and using WSJF as a tie-break when MoSCoW alone produces ties. Trigger keywords: MoSCoW prioritization, must should could won't, WSJF salesforce, prioritize salesforce stories, sprint commit, backlog grooming. NOT for story writing or splitting (use admin/user-story-writing-for-salesforce). NOT for release train planning (use agents/release-train-planner). NOT for sizing/estimation method debates — this skill assumes a sizing convention is already in place.
日本語の概要は準備中です。原文の説明を表示しています。