577 件 ・ 関連度順
概要と使いどころ
Hunt business logic flaws — race conditions, workflow state bypass, parameter pollution affecting logic, coupon/discount abuse, refund logic, multi-step process bypass, integer overflow, negative quantities, double-spend. Use when looking for non-CVE bugs that require understanding the app's intended workflow.
日本語の概要は準備中です。原文の説明を表示しています。
Write production-grade HackerOne reports — title formula, impact-led writing, CVSS 3.1 scoring, complete PoC formatting, attached files, and submission etiquette. Use AFTER triage-validation passes and you're ready to submit on HackerOne.
日本語の概要は準備中です。原文の説明を表示しています。
Design ornamental patterns using modern and speculative aesthetics with colorblind-accessible color scales. Breaks free from historical period constraints to explore cyberpunk, solarpunk, biopunk, brutalist, vaporwave, and other contemporary genres. Includes CVD (Color Vision Deficiency) awareness and perceptually uniform scales (viridis, cividis, inferno). Use when creating ornamental designs in modern or genre-specific aesthetics, designing patterns that must be colorblind-accessible, or exploring hybrid motifs combining historical ornament with contemporary visual language.
日本語の概要は準備中です。原文の説明を表示しています。
Use when writing an SELinux or AppArmor policy, a seccomp-bpf filter, enabling CET, PAC, or BTI, or triaging a kernel CVE. Not for KASAN report analysis: use kernel-debugging.
日本語の概要は準備中です。原文の説明を表示しています。
Use when reading or writing RV32/RV64 assembly, inline asm in C, the RISC-V psABI, IMAFD extension naming, compressed instructions, or QEMU RISC-V debugging.
日本語の概要は準備中です。原文の説明を表示しています。
Use when a query needs direct SMT solving, an unsat core needs debugging, or another tool reports a solver timeout or unknown. Not for deciding what to prove: use proof-driven.
日本語の概要は準備中です。原文の説明を表示しています。
Use when dependency upgrades need batching for CVEs, a major release, forced compatibility, a scheduled or vulnerability-triggered sweep. Not for PR queue triage: use github-backlog-triage.
日本語の概要は準備中です。原文の説明を表示しています。
Optimize ChatGPT Voice in the Codex desktop app into an ear-first control plane for free-form task coordination and opt-in workflows. Apply spoken synthesis, routing-only coordination, owning-task role contracts, project placement, explicit authority, safe speech, current-state verification, honest recovery, and the optional Slopware Dev Stack: MSL, MSW, CODER Loop, and Timebox. Load named workflows only when invoked: Freeway for parallel lanes, Decision Walkthrough for read-only authority convergence, and Tutorial for teaching-first onboarding. Use when the user invokes the voice optimizer, coordinates Codex work through voice, assigns the current voice task as coordinator, runs Freeway, starts a decision walkthrough, learns voice orchestration, routes development through CODER, authorizes Timebox, or asks CVO to install or use Slopware companions.
日本語の概要は準備中です。原文の説明を表示しています。
Use Kanpeki component library in React projects. Activate when user wants to add, use, customize, or compose accessible UI components from Kanpeki (@kanpeki/*). Triggers: shadcn CLI, copy-paste components, Field.Root, composeRenderProps, ~/components/ui/*, React Aria Components + Tailwind CSS 4.1 + CVA. Covers installation, component patterns, forms (React Hook Form, TanStack Form), theming, and dark mode.
日本語の概要は準備中です。原文の説明を表示しています。
Score a PhD applicant's profile and rank candidate advisors using a connection-first 4.0-scale scoring system. Best-supported for physics / HEP and materials science (MSE), with the scoring engine extensible to chemistry, biology, CS, math, EE, ChemE, earth science (each with field-specific caveats — see references/journal_tiers.md). Use when the user wants to evaluate their PhD application chances, find matching advisors at top US programs, score a CV for graduate school, or compare candidate professors. Also triggers when the user mentions phdtaketaketake or its connection-first philosophy of valuing advisor network over h-index.
日本語の概要は準備中です。原文の説明を表示しています。
Generate PDFs from LaTeX (.tex) or Markdown (.md) using Tectonic, a self-contained TeX engine. Use whenever the user wants a PDF, whether converting markdown, compiling existing LaTeX, writing a document from scratch (reports, resumes, letters, CVs), or live-rebuilding while the user edits. Trigger on words like "make a PDF", "convert to PDF", "render this markdown", "compile this tex", "latex", "tectonic", "typeset" — even when the tool is never named.
日本語の概要は準備中です。原文の説明を表示しています。
Use when the user asks about carding, BIN attacks, payment-card breach markets, fullz/CVV2 trade, autoshops (BidenCash, Brian's Club, Russianmarket, B1ack's Stash), or financial-fraud TTPs. Self-updating knowledge cell.
日本語の概要は準備中です。原文の説明を表示しています。
Assess identified vulnerabilities for exploitability, impact, and risk. Provide CVSS scoring and remediation strategies. Use when analyzing security findings.
日本語の概要は準備中です。原文の説明を表示しています。
Audit dependency freshness — scan outdated deps and CVEs, classify severity, record update/defer/skip decisions in Atrium, gate PASS/WARN/FAIL. Use when checking for outdated packages or deciding whether to upgrade. Trigger on "outdated dependencies", "dependency audit", "are my deps up to date", "should I upgrade".
日本語の概要は準備中です。原文の説明を表示しています。
Run security verification — SAST pattern scanning, DAST against a running app, OWASP Top 10 compliance, CVSS assessment, and adversarial code audit. Use before commit/push or when checking code for vulnerabilities. Trigger on "security scan", "is this vulnerable", "OWASP check", "security verify", "scan for vulnerabilities".
日本語の概要は準備中です。原文の説明を表示しています。
Full penetration test using MCP tools — recon, scanning, exploitation, and reporting. Tailored for OpenCode (BYO LLM). Supports network/web targets and local codebases. Chains into analyze-cve, threat-modeling, and remediate skills automatically.
日本語の概要は準備中です。原文の説明を表示しています。
Detects code quality vulnerabilities in mobile apps (Android/iOS). Trigger on: SQL injection in SQLite, JavaScript injection in WebViews, intent injection, unsafe deserialization, NSKeyedUnarchiver, NSCoding, Java serialization, Parcelable, buffer overflow, JNI native code, PIE disabled, NX disabled, stack canary absent, RELRO, ARC disabled, third-party library CVE, vulnerable dependency, outdated SDK, targetSdkVersion, update enforcement missing, implicit Intent, URL loading in WebView, object persistence, memory corruption, OWASP dependency check. Covers MASVS-CODE-1/2/3/4.
日本語の概要は準備中です。原文の説明を表示しています。
Java "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026). Use when attacking Java services where 16-bit char is silently narrowed to 8-bit byte to bypass WAF/IDS for SQL injection, deserialization RCE, file upload (Webshell), path traversal, CRLF injection, request smuggling, and SMTP injection. Affects Tomcat, Spring, Jetty, Undertow, Vert.x, Jackson, Fastjson, Apache Commons BCEL, Apache HttpClient, Angus Mail, JDK HttpServer, Lettuce, Jodd, XMLWriter and re-enables many "patched" CVEs through WAF bypass.
日本語の概要は準備中です。原文の説明を表示しています。
White-box source code security review structured around OWASP ASVS 5.0 (427 verification requirements across 16 chapters). Reads and understands application source code to build a security-aware knowledge base that enriches all downstream skills. Covers: tech stack identification, route/endpoint mapping, authentication and authorization architecture, dangerous function patterns, source-to-sink data flow tracing, IaC review, dependency analysis, ASVS compliance mapping, and LLM integration security (prompt injection, tool abuse, output handling, RAG poisoning, MCP server patterns). When LLM/AI framework usage is detected, automatically reviews OWASP LLM Top 10 patterns from source code and chains into /ai-redteam with white-box context for live endpoint testing. Chains into /pentester, /threat-modeling, /web-exploit, /api-security, /cloud-security, /analyze-cve, /credential-audit, and /ai-redteam — providing white-box context that transforms black-box testing into targeted, informed assessment.
日本語の概要は準備中です。原文の説明を表示しています。
Use when building or styling a component in libs/ui-react or libs/ui-rnative — the cross-platform styling principles, plus routing to the platform mechanics: Tailwind + cva + cn on web, useStyleSheet + themeJS + lx on React Native. Load this before writing component styles.
日本語の概要は準備中です。原文の説明を表示しています。
Reverses proprietary command-and-control protocols: locating send/recv routines, recovering the message framing and encryption/encoding, and reconstructing the command set to build a decoder or emulator. Activates for requests to reverse a custom C2 protocol, decode beacon traffic, or document a malware command structure.
日本語の概要は準備中です。原文の説明を表示しています。
Prove a UI or generation feature actually works before asking a human to look at it. Covers A/B-ing an imported design against its source render, driving controls headlessly so a dead button cannot ship, proving the generator really spawns, and launching the real host (VCV Rack, a DAW). Use before any "take a look" on imported UI, plugin shells, or prompt-to-artifact pipelines.
日本語の概要は準備中です。原文の説明を表示しています。
Set up, format, fix, and clean up LaTeX regression and estimation tables in empirical economics or finance papers. Use when (a) creating a .tex, results.tex, main.tex, or preamble to display regression or estimation output from Python (pyfixest), Stata, or R — including any mention of estout, esttab, estauto, estwide, or table fragments; (b) formatting or repairing estout-style regression tables that overflow the right margin, have cramped or boxed notes, misaligned columns, or poor significance stars, or when asked to match a reference paper, make the note fill the table width, or choose among \estwide, \estauto, and landscape layouts; (c) diagnosing "Misplaced \omit" errors from \input-ed table fragments inside tabular environments. Covers \@@input, \estwide, \estauto, \estautoLT, \specialcell, \sym, minipage notes below tabulars, and the convert-and-verify workflow. Do NOT trigger for general LaTeX documents like beamer presentations, problem sets, letters, or CVs.
日本語の概要は準備中です。原文の説明を表示しています。
Use when a task needs the judgment of a Diesel Truck Mechanic — diagnosing a DPF/DEF/SCR derate or fault code, deciding whether a defect meets CVSA out-of-service criteria, sequencing a PM-A/PM-B preventive maintenance interval, triaging a roadside breakdown against downtime cost, or writing up a DOT annual inspection failure.
日本語の概要は準備中です。原文の説明を表示しています。