「dpo」の検索結果

Hunt Forgot Password / Account Recovery Authentication Flaws — 5 distinct patterns: (1) username enumeration via different responses for valid vs invalid email, (2) reset token exposed directly in the API response body, (3) reset token not invalidated after use (replay), (4) password reset link works from a different IP/browser (no binding), (5) no rate limit on the reset request endpoint. These are the standalone recovery-flow broken-auth primitives — distinct from reset-email host-header poisoning (hunt-host-header) and the full ATO chain (hunt-ato owns password-reset as an ATO path; prove the primitive here, chain it there). Detection: trace the full forgot-password flow from request to token to use; check response diffs between valid/invalid emails; test token replay after consumption. Medium to High (enumeration=Medium, token-reuse=High, account-takeover=Critical when chained to known-email).

日本語の概要は準備中です。原文の説明を表示しています。

Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact, severity-request paragraph as first body section, OOS-clause rebuttal templates (rate limiting on auth-flow endpoints, debug-info framing, user-enumeration with sensitive PII, theoretical-issue counter), chained-finding cross-reference patterns, target selection for QA-vs-prod programs, researcher-side hygiene (Bugcrowdninja email alias, account state restoration, friendly-tester posture). Use when filing a Bugcrowd submission, when VRT default seems wrong, when triager closes as OOS or downgrades severity, when chaining linked submissions, or when scope distinguishes production from QA. Pairs with report-writing and triage-validation.

日本語の概要は準備中です。原文の説明を表示しています。

Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled origin can perform a CREDENTIALED cross-origin read of sensitive data and you have proven it in a browser. Use when testing API endpoints, SPAs, or any app emitting Access-Control-* headers.

日本語の概要は準備中です。原文の説明を表示しています。

Hunt JWT cryptographic failures — alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge a token for any identity (e.g. an admin) without knowing a secret. Use when the app authenticates with a JSON Web Token (an `eyJ...` Bearer token in the Authorization header, a cookie, or a login response). This skill OWNS JWT signature/crypto forgery (alg:none, key confusion, kid/jku header injection); hunt-ato covers JWT as one ATO path, hunt-auth-bypass covers SSO/SAML token trust, hunt-api-misconfig covers non-crypto JWT handling. Critical when a forged token grants access to another user's data or an admin-only endpoint.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

日本語の概要は準備中です。原文の説明を表示しています。

Use when starting any task the organization may already have an approved skill, prompt, MCP server, or Agent for: reviewing code, a commit, a diff, or a pull request; writing tests or documentation; querying a database, API, or service; automating a browser or web page; running untrusted code; connecting to a SaaS tool; drafting, researching, or any other substantive work. The user will not mention Observal: the task type is the trigger. Check what is already installed, then run observal discover search as the first action, before reading the repository or working from scratch. Also use when the user wants to log in, configure Observal, inspect local harness setup, share or open a repository Agent share, manage a teamspace or invitation, process inbox items, check installed registry items, or call an endpoint without a dedicated command.

日本語の概要は準備中です。原文の説明を表示しています。

Convert a GraphQL endpoint, OpenAPI spec, or MCP server into bash CLI commands and a `tools.*` JS API runnable inside `just-bash`'s `js-exec` sandbox. Use when the user wants to expose a remote API to a sandboxed bash agent, build a tool-calling agent on top of just-bash, or generate CLI commands from an existing API spec.

日本語の概要は準備中です。原文の説明を表示しています。

Plug-in vision for text-only models. Hard rule: when a file path or URL with an image extension (.png, .jpg, .jpeg, .webp, .gif, .heic, .heif) appears anywhere in the conversation (typed by the user, injected as a `[Image: source: <path>]` line, or inside a tag) and you cannot see that image's content, run this skill on it before any other approach: no self-built OCR, no PIL, no tesseract. Also triggers on pasted-image placeholders such as `[Image #1]` and `[Unsupported Image]`. If you can actually see the image, do not use this skill. When unsure, run `modlens guard` before the first read of a session: a deny verdict means the active model has native vision and must read the image itself. Runs the modlens CLI to convert the image into structured JSON evidence: every word transcribed, layout regions, semantics, visual clues. Also use when the user asks how to install, configure, or switch modlens providers (Gemini API key, OpenAI-compatible endpoints, Claude API or Claude Code CLI).

日本語の概要は準備中です。原文の説明を表示しています。

Unusual Options Activity reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Strategy Builder reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Prediction Markets reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Market Sentiment reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Volatility Smile reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Payoff Simulation reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Greeks reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Supply-chain Bottlenecks reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Volatility Surface reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Put-spread Backtest reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Earnings IV Crush reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Hedging Scenarios reference method. Use when studying this focused method, not to run an API request. External API-key access for its legacy endpoints is not published in this release.

日本語の概要は準備中です。原文の説明を表示しています。

Turn a website's observable HTTP traffic into a best-effort OpenAPI 3.1 spec by analyzing a `browser-trace` capture. Use when the user wants to discover/extract API endpoints from a browser session, build an OpenAPI doc from network traffic, or document a third-party site's XHR/fetch surface for client integration.

日本語の概要は準備中です。原文の説明を表示しています。

Deploy serverless browser automation as cloud functions using Browserbase. Use when the user wants to deploy browser automation to run on a schedule or cron, create a webhook endpoint for browser tasks, run automation in the cloud instead of locally, or asks about Browserbase Functions.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user wants to discover trending social topics, hashtags, sounds, posts, reels, shorts, creators, or formats in a niche. Searches public trend and discovery endpoints, ranks evidence, and turns trends into practical content angles.

日本語の概要は準備中です。原文の説明を表示しています。

Use when a <cross-session-message> from another Claude session asks for a change in this repo (a new endpoint, a field, a client update, a package bump). Covers getting the user's go-ahead, filling gaps in the request, pushing back on the contract, and the reply shape the requester depends on.

日本語の概要は準備中です。原文の説明を表示しています。