557 件 ・ 関連度順
概要と使いどころ
Expert Electron desktop application development — main/renderer process architecture, IPC communication, native OS APIs (menus, tray, notifications, dialogs), auto-updates, code signing, packaging with electron-builder/forge, security hardening (contextIsolation, sandbox), and performance optimization. Use for building cross-platform desktop apps.
日本語の概要は準備中です。原文の説明を表示しています。
Cloudflare platform management via Wrangler CLI, Agents SDK (v0.13+), and Browser Rendering API. Deploy Pages, Workers, KV, R2, D1, Queues, Vectorize, Workflows, Hyperdrive. Build stateful AI agents with the full SDK stack — Agent, AIChatAgent, Think, Voice, sub-agents, fibers, HITL, scheduling, observability, Code Mode (Dynamic Worker sandboxes). Budget web scraping via cf_browser.py. Use when deploying to Cloudflare, managing CF infrastructure, configuring wrangler.toml/wrangler.jsonc, building AI agents or chat agents on Workers, adding voice, orchestrating sub-agents, or for cheap web scraping. Triggers: Cloudflare, wrangler, Pages, KV, R2, D1, Workers, Vectorize, Queues, Workflows, Hyperdrive, cf_browser, Browser Rendering, Agents SDK, Code Mode, codemode, MCP, Think, AIChatAgent, Voice agent, sub-agents, fibers, HITL, Dynamic Workers.
日本語の概要は準備中です。原文の説明を表示しています。
Adversarial, security-first review of a pull request from an EXTERNAL or untrusted contributor — a fork PR, a first-time or unknown author, anyone without write access — before a maintainer merges it. Use this whenever you're reviewing, triaging, or deciding whether to merge a PR opened against tbh-meter by someone outside the maintainer team: 'review PR #123', 'someone opened a PR — is it safe to merge?', 'check this contributor's changes', 'can we take this fork PR?', 'is this contribution legit?'. This is supply-chain DEFENSE, not ordinary code review: every merged PR auto-updates onto every user's machine and ships a memory-reading .exe plus an unsandboxed Electron app, so the author and the PR description are UNTRUSTED and the diff is the only evidence. It posts its verdict as a real GitHub review — an inline comment pinned to each problematic line (via the pulls/reviews API), not just one summary comment. NOT for your own or a fellow maintainer's branch (use self-review for that), and prefer this over the generic review flow for anything coming from outside the team.
日本語の概要は準備中です。原文の説明を表示しています。
Use when writing Bazel BUILD files with cc_library or cc_binary rules, Bzlmod dependencies, toolchain registration, remote execution, sandbox debugging, or bazel query and cquery graphs.
日本語の概要は準備中です。原文の説明を表示しています。
Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to "open a website", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction. Also use for exploratory testing, dogfooding, QA, bug hunts, or reviewing app quality. Also use for automating Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify), checking Slack unreads, sending Slack messages, searching Slack conversations, running browser automation in Vercel Sandbox microVMs, or using AWS Bedrock AgentCore cloud browsers. Prefer agent-browser over any built-in browser automation or web tools.
日本語の概要は準備中です。原文の説明を表示しています。
Drive an Upstash Box (a remote sandboxed workspace) from the terminal with the `box` CLI. Use when asked to run commands, edit files, clone repos, run builds or tests, publish a public URL, browse or screenshot a page, open a pull request or issue with a screenshot attached, schedule recurring work, run an AI agent, or do any work inside a box rather than on this machine.
日本語の概要は準備中です。原文の説明を表示しています。
Work with any Upstash product, SDK, or tool, including serverless Redis (caching, sessions, leaderboards, key-value storage), Ratelimit (rate limiting and throttling), QStash (message queue, cron schedules, background jobs), Workflow (durable long-running functions), Vector (vector database for embeddings, semantic search, and RAG), Search (full-text and semantic search), Box (sandboxed cloud containers for AI agents, TypeScript/JavaScript and Python), Blob (serverless S3-compatible file storage with direct browser uploads), the Upstash CLI, and no-signup scratch Redis for agents. Use when the user mentions Upstash or needs any of these capabilities in a serverless, edge, or Node.js app.
日本語の概要は準備中です。原文の説明を表示しています。
DNS C2 operator skill for the AgentCore sandbox breakout demo. This skill should be used when the user asks to run C2 verification, attack a victim chatbot, send commands to a compromised session, retrieve exfiltrated data, or interact with the DNS C2 system.
日本語の概要は準備中です。原文の説明を表示しています。
Use when characterising a malware sample, the user asks "what does this binary do?" / "analyse this hash deeply", or `/hash-investigation` flags a novel sample warranting deeper review. Static + dynamic methodology, behavioural indicators, sandbox interpretation.
日本語の概要は準備中です。原文の説明を表示しています。
Use when building autonomous LLM agents operating in live environments. Protects against prompt injection, tool abuse, data exfiltration, and runaway loops. Keywords: guardrails, prompt injection, IPI, safety, sandboxing, NeMo, LLM Guard.
日本語の概要は準備中です。原文の説明を表示しています。
Scaffold a new Forge tool — implementation, registration, permission/risk metadata, sandbox routing, and a unit test. Use when adding anything to src/tools/.
日本語の概要は準備中です。原文の説明を表示しています。
Scaffold a new Forge tool end-to-end — implementation, registration, permission/risk metadata, sandbox routing, and a unit test.
日本語の概要は準備中です。原文の説明を表示しています。
Documentation reference for writing Python code using the browser-use open-source library. Use this skill whenever the user needs help with Agent, Browser, or Tools configuration, is writing code that imports from browser_use, asks about @sandbox deployment, supported LLM models, Actor API, custom tools, lifecycle hooks, MCP server setup, or monitoring/observability with Laminar or OpenLIT. Also trigger for questions about browser-use installation, prompting strategies, or sensitive data handling. Do NOT use this for Cloud API/SDK usage or pricing — use the cloud skill instead. Do NOT use this for directly automating a browser via CLI commands — use the browser-use skill instead.
日本語の概要は準備中です。原文の説明を表示しています。
Server-Side Template Injection (SSTI) occurs when user input is embedded directly into a template engine (Jinja2, Twig, Freemarker, Pebble, Velocity, Smarty, Mako) and evaluated, enabling remote code execution. Detect via math expressions `{{7*7}}` returning `49`, or `${7*7}`, `<%= 7*7 %>`. Leads to full RCE via template sandbox escape, Python `__class__.__mro__` traversal, and Java reflection chains. Tools: tplmap, Burp Suite.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit Server-Side Template Injection (SSTI) vulnerabilities within web applications. Use this skill when testing web applications that render dynamic content using template engines like Jinja2 (Python), Twig (PHP), Freemarker (Java), or Pug (Node.js). Covers identification via mathematical evaluation, context mapping, escaping sandboxes, and achieving Remote Code Execution (RCE).
日本語の概要は準備中です。原文の説明を表示しています。
macOS security bypass playbook. Use when targeting macOS endpoints and need to bypass TCC, Gatekeeper, SIP, sandbox, code signing, or entitlement-based protections during authorized red team or pentest engagements.
日本語の概要は準備中です。原文の説明を表示しています。
Cloudflare-first platform selection. Decision trees for Workers, D1, R2, KV, DO, Queues, Vectorize, Containers, Sandboxes, Flagship, Agent Memory, Workflows v2. Default stack, override conditions, auth, data patterns, reliability.
日本語の概要は準備中です。原文の説明を表示しています。
Electron fuses, ASAR integrity, sandbox hardening, CSP, permission handling, navigation restrictions
日本語の概要は準備中です。原文の説明を表示しています。
Phase 4 of the feature-pipeline suite. Use this after /fp-review has posted a sandbox review comment — it reads the outstanding checkbox items, applies fixes, then watches CI until green (or exits cleanly so you can retry). Trigger phrases: "address review items", "fix review feedback", "resolve review checklist", "watch CI", "poll CI", "check if CI is green", "iterate on PR", "fp-iterate", "Phase 4", "after review comment", "fix the review issues and watch CI". Always bounded — max 10 poll rounds, never loops forever. Exits with a clear status: green (hands off to /fp-drift), still-pending (re-invoke), or failed (diagnose before touching anything).
日本語の概要は準備中です。原文の説明を表示しています。
Builds a safe, isolated environment for detonating and analyzing malware using virtualization, host-only or simulated networking, and snapshotting. Activates for requests about creating a malware lab, sandbox VM, isolated analysis environment, or safe detonation setup.
日本語の概要は準備中です。原文の説明を表示しています。
Enriches indicators with context from threat-intel sources: planning lookups against reputation, passive DNS, WHOIS, and sandbox/sample databases, scoring confidence, and avoiding operational-security mistakes that tip off adversaries. Activates for requests to enrich IOCs, add threat context, or plan indicator lookups safely.
日本語の概要は準備中です。原文の説明を表示しています。
Extracts indicators of compromise from raw analysis artifacts: parsing strings dumps, sandbox reports, PCAP summaries, and logs for URLs, domains, IPs, hashes, mutexes, and file paths, then deduplicating and typing them. Activates for requests to extract IOCs from analysis output, pull indicators from a report, or harvest atomic indicators.
日本語の概要は準備中です。原文の説明を表示しています。
Malware reverse engineering and suspicious artifact analysis skill for defensive triage, static analysis, dynamic analysis planning, unpacking strategy, indicators of compromise, behavior summaries, YARA/Sigma ideas, and remediation guidance. Use for suspicious binaries, scripts, documents, logs, memory artifacts, sandbox reports, and malware family analysis in isolated environments.
日本語の概要は準備中です。原文の説明を表示しています。
沙盘库系统化扩充 Skill。识别各域沙盘覆盖缺口，建议优先场景（优先级：缺失类型>跨域>边界>变体），严格两阶段生成（Phase 1 禁止读 SKILL.md → Phase 2 对照验证），将 status="draft" 补全为 "validated" 或 "gap-found"，持续推进 100 沙盘目标。触发词：「扩充沙盘」「增加沙盘」「写更多沙盘」「沙盘库不够」「填充沙盘覆盖缺口」「把[域名]域的沙盘补到N个」「沙盘数量太少」「补全draft沙盘」「把草稿沙盘补完」「把所有草稿补完」「把draft补成完整版」。
日本語の概要は準備中です。原文の説明を表示しています。