「action」の検索結果

Use when testing file upload endpoints for unrestricted file upload, MIME type bypass, magic byte spoofing, polyglot files, SVG XSS, XXE via Office documents, ZIP slip, and path traversal in filenames. Trigger on: multipart/form-data endpoints, avatar/document upload flows, import-from-file features, profile image, CSV/Excel import, DOCX/XLSX parsing, image resizing pipelines, archive extraction, and any endpoint that stores or serves user-supplied files. Detects extension bypass (shell.php.jpg), null byte injection, double extension, ImageMagick exploits, and content-type confusion.

日本語の概要は準備中です。原文の説明を表示しています。

Identify and exploit Insecure Direct Object Reference (IDOR), or Broken Object Level Authorization (BOLA), vulnerabilities. Manipulate internal identifiers (e.g., user IDs, database primary keys, transaction IDs) within HTTP request parameters or API payloads to unauthorizedly access, modify, or delete data belonging to other users.

日本語の概要は準備中です。原文の説明を表示しています。

Test Large Language Models for direct prompt injection vulnerabilities where user input overrides system instructions, extracts system prompts, bypasses safety filters, or causes unauthorized actions. Use this skill when assessing chatbots, AI assistants, LLM-powered tools, or any application that processes natural language input through an LLM. Covers role-playing attacks, instruction hierarchy exploitation, multi-turn manipulation, and context window abuse for comprehensive AI security testing.

日本語の概要は準備中です。原文の説明を表示しています。

iOS pentesting playbook. Use when testing iOS applications for keychain extraction, URL scheme hijacking, Universal Links exploitation, runtime manipulation, binary protection analysis, data storage issues, and transport security bypass during authorized mobile security assessments.

日本語の概要は準備中です。原文の説明を表示しています。

Entry P1 category router for file access and upload workflows. Use when testing download endpoints, file paths, local file inclusion, upload flows, preview pipelines, archive extraction, or storage and sharing boundaries.

日本語の概要は準備中です。原文の説明を表示しています。

Identify and exploit Clickjacking (UI Redressing) vulnerabilities where a malicious website iframes a target application, tricking victims into performing unintended actions (e.g., transferring funds, deleting accounts, or granting permissions) via hidden layers.

日本語の概要は準備中です。原文の説明を表示しています。

Clickjacking playbook. Use when testing whether target pages can be framed, whether X-Frame-Options or CSP frame-ancestors are properly configured, and whether UI redress attacks can trigger sensitive actions.

日本語の概要は準備中です。原文の説明を表示しています。

Execute sophisticated Prompt Injection and Jailbreak techniques against Large Language Models (LLMs) to bypass safety filters, extract system prompts, and manipulate the AI's output to perform malicious or disallowed actions.

日本語の概要は準備中です。原文の説明を表示しています。

Execute a complete Active Directory penetration test from initial enumeration to domain dominance. Use this skill for AD security assessments including LDAP enumeration, Kerberos attacks (Kerberoasting, AS-REP roasting), BloodHound attack path analysis, credential dumping with Mimikatz, lateral movement via PsExec/WMI/DCOM, DCSync for NTDS extraction, and Golden/Silver ticket forging. Covers the full kill chain from domain user to domain admin.

日本語の概要は準備中です。原文の説明を表示しています。

Android pentesting playbook. Use when testing Android applications for SSL pinning bypass, exported component abuse, WebView vulnerabilities, intent redirection, root detection bypass, tapjacking, and backup extraction during authorized mobile security assessments.

日本語の概要は準備中です。原文の説明を表示しています。

Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every technique includes actual payloads, commands, and verification logic. Chains from /pentester or /codebase when API endpoints are discovered, chains into /web-exploit when classic injection points are found in API parameters, chains into /post-exploit when RCE is achieved, and chains into /ai-redteam when an LLM/AI endpoint is discovered (chat APIs, completion endpoints, RAG search, agentic tool-use, MCP servers).

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.

日本語の概要は準備中です。原文の説明を表示しています。

Measure CI churn cost for a pull request: how many commits and how many CI-compute seconds were burned on avoidable "fix the CI" push rounds. Use when you want to understand the efficiency cost of a PR's iteration cycle, get actionable pre-push check suggestions, or include a churn summary in a pipeline report. Triggers: "ci churn", "how much CI did we burn", "avoidable commits", "ci efficiency", "wasted CI time", "churn report", "/ci-churn". Called automatically by /fp-drift at pipeline close.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill whenever the user wants to see how their branch will look on the live Gaia website before merging — "preview this branch", "show me what this looks like", "deploy a preview", "trigger a design preview", "can I see the site with these changes", "preview the skill profile", "check how this renders on the site", "spin up a preview deployment". This skill dispatches a Cloudflare Worker preview deployment for the current branch via GitHub Actions — no local build tooling required. Ideal for containerized environments, design reviews, and confirming that newly curated skills or profile pages render correctly before a PR is merged to main. The preview does NOT regenerate docs; it deploys `docs/` from the branch as-is. If your change depends on regenerated Class S artifacts, run `gaia dev docs` and commit those first — the preview then reflects them.

日本語の概要は準備中です。原文の説明を表示しています。

Firecrawl gives AI agents and apps fast, reliable web context with strong search, scraping, and interaction tools. One install command sets up three skill segments: live CLI tools, app-integration build skills, and outcome-focused workflow skills. Route the reader to the right usage path after install.

日本語の概要は準備中です。原文の説明を表示しています。

Craft UI animations with Framer Motion: page transitions, micro-interactions, scroll reveals, and shared layouts for polished interfaces. Use for interface animation beyond basics.

日本語の概要は準備中です。原文の説明を表示しています。

Build HTML emails that render everywhere: table layouts, MJML, dark mode, testing, and deliverability basics. Use for transactional and marketing email.

日本語の概要は準備中です。原文の説明を表示しています。

Run structured design critiques with frameworks for feedback that is honest, specific, and actionable.

日本語の概要は準備中です。原文の説明を表示しています。

Deploy and operate endpoint detection and response — policy tuning, behavioral detections, threat hunting, and response actions.

日本語の概要は準備中です。原文の説明を表示しています。

Apply classic design patterns judiciously: when each pattern fits, modern alternatives, and anti-patterns. Use when designing object interactions or reviewing pattern usage.

日本語の概要は準備中です。原文の説明を表示しています。

Design clear, actionable dashboards with KPI hierarchy, data visualization best practices, and layout patterns.

日本語の概要は準備中です。原文の説明を表示しています。

Systematic contract review assistance — clause extraction, risk flagging, and comparison — use when analyzing agreements.

日本語の概要は準備中です。原文の説明を表示しています。

Write persuasive copy for ads, landing pages, emails, and more — headlines, hooks, and calls-to-action that convert.

日本語の概要は準備中です。原文の説明を表示しています。

Audit organizational communications — channel effectiveness, message clarity, overload, and actionable improvement plans.

日本語の概要は準備中です。原文の説明を表示しています。