5,812 件 ・ 関連度順
概要と使いどころ
Active Directory and network lateral movement assessment. Pass-the-hash, pass-the-ticket, Kerberoasting, AS-REP roasting, NTLM relay, SMB relay, WMI/WinRM/PSRemoting abuse, constrained/unconstrained delegation, RBCD, cross-trust exploitation, and pivoting. Uses impacket, netexec, enum4linux-ng, smbmap, smbclient, bloodhound-python, Responder, ntlmrelayx, mitm6, and ldap-utils. Chains from /post-exploit or /credential-audit.
日本語の概要は準備中です。原文の説明を表示しています。
Authentication and credential security assessment. Tests password brute-force, credential stuffing, password spraying, default credential testing, credential harvesting, lockout analysis, MFA bypass, OAuth/OIDC abuse, session token entropy, Kerberos attacks, and intelligent wordlist generation. Uses hydra, john, ncrack, medusa, cewl, crunch, netexec, impacket, kerbrute, and nuclei default-login templates. Covers OWASP A07:2021 Identification and Authentication Failures.
日本語の概要は準備中です。原文の説明を表示しています。
DOM-based XSS occurs when JavaScript reads attacker-controlled sources (`location.hash`, `document.referrer`, `window.name`, `location.search`) and passes them to dangerous sinks (`document.write`, `innerHTML`, `eval`, `location.href`, `setTimeout`, `jQuery.html()`) without sanitization. Unlike reflected/stored XSS, payloads never reach the server. Detect by auditing JavaScript for tainted data flow from DOM sources to sinks. Tools: Burp Suite DOM Invader, Chrome DevTools, DOMPurify (fix).
日本語の概要は準備中です。原文の説明を表示しています。
Email infrastructure security audit. Tests SPF, DKIM, DMARC configuration, open relay, email spoofing resilience, S/MIME, MTA-STS, TLS-RPT, and SMTP security. Uses swaks, dnsrecon, nmap SMTP scripts, smtp-user-enum, and dig. Pure skill markdown — no new infrastructure needed.
日本語の概要は準備中です。原文の説明を表示しています。
White-box source code security review structured around OWASP ASVS 5.0 (427 verification requirements across 16 chapters). Reads and understands application source code to build a security-aware knowledge base that enriches all downstream skills. Covers: tech stack identification, route/endpoint mapping, authentication and authorization architecture, dangerous function patterns, source-to-sink data flow tracing, IaC review, dependency analysis, ASVS compliance mapping, and LLM integration security (prompt injection, tool abuse, output handling, RAG poisoning, MCP server patterns). When LLM/AI framework usage is detected, automatically reviews OWASP LLM Top 10 patterns from source code and chains into /ai-redteam with white-box context for live endpoint testing. Chains into /pentester, /threat-modeling, /web-exploit, /api-security, /cloud-security, /analyze-cve, /credential-audit, and /ai-redteam — providing white-box context that transforms black-box testing into targeted, informed assessment.
日本語の概要は準備中です。原文の説明を表示しています。
Audit and attack session cookies via missing Secure/HttpOnly/SameSite attributes, overly broad Domain/Path scope, non-expiring persistent cookies, absent __Host- and __Secure- prefixes, browser cache leakage (Cache-Control: no-store missing), session token predictability via Burp Sequencer analysis, server-side session not invalidated on logout, and SSO single-logout bypass. Tools: Burp Suite Repeater/Sequencer, OWASP ZAP, EditThisCookie, Tamper Data, Cookiebro.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit Cross-Origin Resource Sharing (CORS) misconfigurations. Use this skill when auditing APIs or web applications that share sensitive data across domains, forcing victims' browsers to inadvertently leak private information (e.g., API keys, PII, CSRF tokens) to an attacker-controlled website.
日本語の概要は準備中です。原文の説明を表示しています。
Active Directory security audit using the MITRE ATT&CK framework. Full domain enumeration, trust mapping, GPO analysis, ACL abuse paths, ADCS attacks (ESC1-ESC8), delegation abuse (constrained/unconstrained/RBCD), fine-grained password policies, LAPS deployment, service account security, and Kerberos configuration. Uses enum4linux-ng, netexec, impacket, ldapsearch, certipy-ad, bloodhound-python, and rpcclient. Produces attack path diagrams, prioritized risk register, and PoCs. Chains into /gh-export for issue filing.
日本語の概要は準備中です。原文の説明を表示しています。
Bug bounty findings secretary, tracker, and workspace initializer for the bb-huge portal. Use this skill for web security research, vulnerability hunting, and hunt workspace setup. Triggers on: "log finding", "save finding", "add to bb-huge", "record vulnerability", "update finding", "show findings", "bb-huge stats", "mark as confirmed", "mark as rewarded", "setup workspace", "pull evidence", "continue working on finding", "dump attachments", "list my skills", "what skills do I have", "/bb-huge init", "init hunt workspace", "new bug bounty program", "start hunting", "mobile bug bounty", "binary analysis", "source code review", "white-box audit", "h1-brain", "hack program", "hack()", "search disclosed", "fetch rewarded". Also auto-activates whenever a vulnerability is discovered during any recon, fuzzing, or manual testing session — do not wait to be asked.
日本語の概要は準備中です。原文の説明を表示しています。
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
日本語の概要は準備中です。原文の説明を表示しています。
Run bounded, read-only semantic advisory sidecar passes for candidate mapping, issue triage, upstream diffs, evidence verification triage, and meta audit hints. Enforces monthly spend limits with explicit fallback to worker-luna.
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill when the user wants to turn code graph analysis into tracked GitHub issues — "audit the architecture", "find god nodes", "triage architectural debt", "run graphify and log issues", "what's over-coupled in this codebase", "create issues from graphify findings", "check for structural problems", "scan for architectural smells", or any request that combines codebase topology analysis with issue tracking. This skill runs graphify to build a dependency graph, parses GRAPH_REPORT.md for god nodes and structural patterns, converts findings into GitHub issue payloads, and optionally pushes them to the repo. It bridges static analysis and project management in a single automated pass. Requires graphify and gh CLI.
日本語の概要は準備中です。原文の説明を表示しています。
Audit and repair Gaia user-tree timelines so every skill's current rank is explained by a chain of Hero's Journey events. Trigger this skill when: a contributor's profile chart shows a stale rank (e.g. still shows 3★ after a demotion to 1★); someone asks to "trace what happened" to a skill's rank; `validate_timelines.py` is failing in CI; you need to backfill missing `demote` or `rank_up` events before cutting a release; a skill was reclassified or Star-Bar-reset and the user tree was never updated; or any time the registry node and user tree disagree on a skill's current level. Uses `scripts/trace_timeline.py` (dry-run + apply) and `scripts/validate_timelines.py` (CI gate). Do NOT hand-edit `timeline[]` arrays — the script synthesises properly labelled events with `previousValue`/`newValue` so the rank chart plots correctly.
日本語の概要は準備中です。原文の説明を表示しています。
Phase 2B of the Gaia evidence verification pipeline. Verifies benchmark-result rows and benchmark-source candidates against registry/benchmark-sources.json before adversarial audit, link validation, catalog promotion, or ingestion. Use when running /ev-pipeline, checking benchmark-result evidence, reviewing benchmark-source candidates, or preparing benchmark rows for /gaia-ingest-batch.
日本語の概要は準備中です。原文の説明を表示しています。
Phase 2 of the evidence verification pipeline. Validates GitHub star counts in registry skill files against live GitHub API data and flags stale or inflated metrics without repartitioning evidence by rank. Use this after /ev-collection has compiled the unified data lake and before /ev-adversarial-audit begins. Trigger phrases: "verify stars", "check star counts", "refresh stargazer metrics", "run star verification", "ev-star-verification", "Phase 2", "live star check".
日本語の概要は準備中です。原文の説明を表示しています。
Phase 1 of the Gaia evidence verification pipeline. Use this skill whenever you need to gather, consolidate, or refresh raw evidence for named skills in the registry. Trigger phrases: "collect evidence", "populate the data lake", "gather sources", "run ev-collection", "Phase 1", "compile the evidence index", "refresh the unified lake", "aggregate skill evidence", "build the evidence database". Also invoke as the first step before running ev-star-verification, ev-adversarial-audit, or ev-link-validation — nothing downstream is meaningful without a fresh, compiled index. Covers GitHub repo links, stargazer signals, YouTube showcases, arXiv papers, peer reviews, benchmark results, blog/newsletter posts, and self-attestation artifacts.
日本語の概要は準備中です。原文の説明を表示しています。
Comprehensive, reusable playbook for multi-component suite intake under Yggdrasil III. Audits component installability, maps origin candidates to generic capabilities, ingests named components with shared-repo baseline caps, manifests suites via gaia dev fuse, calibrates capstone and component ranks, and closes out via Class S regeneration.
日本語の概要は準備中です。原文の説明を表示しています。
Design, implement, and audit firewall policy — rule hygiene, segmentation, change control, and continuous compliance.
日本語の概要は準備中です。原文の説明を表示しています。
Electronic lab notebook workflows — structuring entries, templates, linking data, and audit-ready records.
日本語の概要は準備中です。原文の説明を表示しています。
Increase conversion rates — CRO audits, A/B testing, landing page optimization, and experimentation programs.
日本語の概要は準備中です。原文の説明を表示しています。
Design backup strategies that survive real disasters: 3-2-1 rule, versioning, testing restores, and covering all devices. Use when setting up backups or auditing whether current backups actually work.
日本語の概要は準備中です。原文の説明を表示しています。
Protect your time with Muse as calendar guardian: time-blocking, buffer time, declining gracefully, weekly calendar audits, and defending focus and personal time.
日本語の概要は準備中です。原文の説明を表示しています。
Master calendar management — time blocking, scheduling hygiene, calendar audits, and executive calendaring.
日本語の概要は準備中です。原文の説明を表示しています。
Audit designs for accessibility with WCAG checklists covering color, type, focus, motion, and content.
日本語の概要は準備中です。原文の説明を表示しています。