「auth」の検索結果

Agent skill for authentication - invoke with $agent-authentication

日本語の概要は準備中です。原文の説明を表示しています。

IDOR and broken object authorization testing playbook. Use when requests expose object identifiers, tenant boundaries, writable fields, or missing object-level authorization checks.

日本語の概要は準備中です。原文の説明を表示しています。

JWT and OAuth token attack playbook. Use when validating token trust, signing algorithms, key handling, claim abuse, bearer flows, and OAuth account-binding weaknesses.

日本語の概要は準備中です。原文の説明を表示しています。

Authentication and credential security assessment. Tests password brute-force, credential stuffing, password spraying, default credential testing, credential harvesting, lockout analysis, MFA bypass, OAuth/OIDC abuse, session token entropy, Kerberos attacks, and intelligent wordlist generation. Uses hydra, john, ncrack, medusa, cewl, crunch, netexec, impacket, kerbrute, and nuclei default-login templates. Covers OWASP A07:2021 Identification and Authentication Failures.

日本語の概要は準備中です。原文の説明を表示しています。

Identify and exploit Insecure Direct Object Reference (IDOR) or Broken Object Level Authorization (BOLA) vulnerabilities specifically within GraphQL APIs. This skill focuses on manipulating node IDs, changing variables, and utilizing aliases to access unauthorized data.

日本語の概要は準備中です。原文の説明を表示しています。

Authentication bypass testing playbook. Use when assessing login flows, password reset logic, account recovery, MFA bypass, token predictability, brute-force resistance, and session boundary flaws.

日本語の概要は準備中です。原文の説明を表示しています。

Use when hunting CI/CD bot comment command vulnerabilities where issue_comment or pull_request_review_comment triggers invoke privileged workflows without verifying the commenter's identity or authorization. Trigger on: "bot command injection", "issue_comment trigger", "@github-actions", "slash command CI", "CI bot command", "comment triggered workflow", "unauthenticated bot", "github-actions publish", "comment dispatch", no authorization check on workflow_dispatch from comment, chatops CI/CD, supply chain via PR comment.

日本語の概要は準備中です。原文の説明を表示しています。

Test horizontal and vertical authorization bypass via session ID swapping between accounts, IDOR through parameter manipulation (invoice=, user=, menuitem=, EventID=), and special header injection (X-Original-URL, X-Rewrite-URL, X-Forwarded-For, X-Remote-IP, X-Client-IP with 127.0.0.1/localhost/RFC1918 values). Tools: Burp Suite with Autorize/AuthMatrix extensions, OWASP ZAP Access Control Testing add-on.

日本語の概要は準備中です。原文の説明を表示しています。

API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.

日本語の概要は準備中です。原文の説明を表示しています。

API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit pervasive logical flaws in Multi-Factor Authentication (MFA/2FA) implementations to bypass the secondary authentication challenge entirely. Techniques include response manipulation, referal spoofing, token reuse, and predictable backup codes.

日本語の概要は準備中です。原文の説明を表示しています。

Bypass authentication via forced browsing to protected URLs, parameter tampering (authenticated=yes, debug=true, fromtrustIP=true), session ID prediction from linear/incremental cookies, SQL injection on login forms, PHP unserialize() boolean type juggling (b:1 payload), and credential transport over HTTP. Detectable with Burp Suite, OWASP ZAP, WebGoat.

日本語の概要は準備中です。原文の説明を表示しています。

Clerk managed authentication - ClerkProvider, middleware, pre-built components, hooks, server-side auth, organizations, webhooks

日本語の概要は準備中です。原文の説明を表示しています。

Hunts for Linux persistence by inspecting cron, systemd units, shell rc files, SSH authorized_keys, and common autostart locations for attacker-added entries. Activates for requests to hunt Linux persistence, audit cron/systemd for backdoors, or find unauthorized autostart and authorized_keys entries.

日本語の概要は準備中です。原文の説明を表示しています。

Use when a task needs the judgment of a credit authorizer, checker, or clerk — deciding a real-time point-of-sale credit authorization against available credit, verifying a credit application's income/employment documentation, issuing an adverse-action notice on a declined application, or intaking a chargeback/dispute within its filing window. Distinct from a credit analyst, who underwrites commercial credit with a multi-year financial spread and a risk rating — this role runs a high-volume rules engine against a preset limit, it does not assess creditworthiness from first principles.

日本語の概要は準備中です。原文の説明を表示しています。

Standalone E-E-A-T scoring rubric for a URL or content draft. Scores Experience, Expertise, Authoritativeness, and Trust 0-5 each using concrete detectable signals, framed per Google's creating-helpful-content doc. Use when user says "E-E-A-T", "EEAT", "experience expertise", "trust signals", or "author authority".

日本語の概要は準備中です。原文の説明を表示しています。

Guideline for designing, implementing, and verifying secure APIs following OWASP API Security Top 10 (2023) best practices. Use when the user wants to: (1) review API code or design for security vulnerabilities, (2) design a secure REST, GraphQL, or gRPC API architecture, (3) implement API authentication and authorization (OAuth2, JWT, API keys, mTLS), (4) configure rate limiting, input validation, or CORS, (5) audit API endpoints for BOLA, BFLA, or mass assignment vulnerabilities, (6) create API security checklists or verification plans, (7) fix API security bugs or harden existing APIs, (8) set up API security testing (OWASP ZAP, Schemathesis, Burp Suite), or (9) handle any API security concern including SSRF prevention, resource consumption limits, business flow protection, API inventory management, and secure third-party API consumption.

日本語の概要は準備中です。原文の説明を表示しています。

Implement web authentication: sessions, OAuth/OIDC, MFA, passwordless, and session security. Use when adding login and access control to apps.

日本語の概要は準備中です。原文の説明を表示しています。

Write a technical tax position memo that documents a tax filing position with authorities, facts, analysis, and conclusion. Use when a tax professional says "write a tax memo", "document this tax position", "research memo for the partner", "we need to support this deduction", "document the tax treatment", "write up the authority for this position", "technical memo on [tax issue]", "MLTN analysis", "reasonable basis memo", "document the IRC section that supports this", or needs to formally document a tax conclusion. Also trigger when someone has a tax question that needs a written conclusion backed by legal authority - even if they don't use the words "tax memo" or "tax position".

日本語の概要は準備中です。原文の説明を表示しています。

Diagnoses Workload Identity Federation for GKE authentication failures for Pods (403 "iam.serviceAccounts.getAccessToken" / permission denied, "could not find default credentials", or GKE metadata server unreachable) by verifying cluster and node-pool Workload Identity configuration, the Kubernetes ServiceAccount (KSA) to IAM binding (direct principal binding and legacy Google ServiceAccount impersonation), target-resource IAM roles, and gke-metadata-server health. Use when a Pod cannot authenticate to Google Cloud APIs even though Workload Identity is expected to be in effect. Don't use for in-cluster Kubernetes RBAC errors (API-server authorization), general workload crashes (use gke-workload-troubleshooting), or Workload Identity setup and hardening (use gke-workload-security).

日本語の概要は準備中です。原文の説明を表示しています。

Provides expert guidance on authenticating and authorizing to Google Cloud services and APIs, covering human users, service identities, Application Default Credentials (ADC), and best practices for secure access.

日本語の概要は準備中です。原文の説明を表示しています。

Build robust backend systems — APIs (REST, GraphQL, gRPC), authentication (OAuth 2.1, JWT), databases, performance optimization, security (OWASP Top 10), scalability patterns (microservices, caching, sharding), and testing. Use when designing APIs, implementing auth, optimizing queries, handling security vulnerabilities, building microservices, or developing production-ready backend systems.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when building, reviewing, or refreshing a RACI (Responsible / Accountable / Consulted / Informed) matrix for a Salesforce project so that every Salesforce-specific decision — data model change, automation tier choice, security model, integration boundary, deployment, license/edition — has exactly one accountable owner and a documented escalation path that downstream agents can route to. Trigger keywords: RACI matrix salesforce project, stakeholder authority salesforce, escalation path salesforce decisions, who approves data model change, salesforce decision rights, REFUSAL_NEEDS_HUMAN_REVIEW routing. NOT for the change advisory board operating model itself (use admin/change-management-and-deployment). NOT for end-user training rollout plans (use admin/change-management-and-training). NOT for the technical mechanics of permission set assignment authority (use admin/permission-set-architecture). NOT for pure stakeholder requirements elicitation (use admin/requirements-gathering-for-sf). More trigger keywords: who approves a sandbox refresh, who signs off a data load, release update activation owner, delegated admin authority vs RACI, multi-org decision rights, escalation time-box.

日本語の概要は準備中です。原文の説明を表示しています。

Configure Einstein Activity Capture (EAC) for an org: enable the feature, create Configuration profiles, set auth type (User-Level or Org-Level OAuth), define email and calendar sync scope, excluded domains and privacy settings, assign users, verify sync health. NOT for querying synced emails or events in SOQL, Apex or reports — use apex/einstein-activity-capture-api. NOT for Opportunity Scoring or Pipeline Inspection — use agentforce/einstein-copilot-for-sales.

日本語の概要は準備中です。原文の説明を表示しています。