「sca」の検索結果

Cloud security posture assessment for AWS, Azure, and GCP. Tests IAM privilege escalation paths, public storage exposure, serverless attack surface, database exposure, logging gaps, container registry security, and cloud-specific attacks. Both authenticated (with cloud credentials) and unauthenticated (external) modes. Uses nuclei cloud templates, Prowler, ScoutSuite, manual IMDS/metadata probing, and deep AWS/Azure/GCP CLI enumeration. Produces: cloud architecture diagram, attack path map, findings per category, compliance mapping (SOC 2, PCI DSS 4.0, HIPAA, CIS), PoCs for confirmed exploits. Chains into /gh-export for issue filing.

日本語の概要は準備中です。原文の説明を表示しています。

Container and Kubernetes security assessment. Tests container escape vectors, Docker/containerd socket exposure, K8s RBAC misconfigurations, pod security violations, exposed API servers, etcd access, service account token abuse, image layer secrets, private registry attacks, SSRF to metadata services, cross-namespace network bypass, CIS benchmarks, crypto miner detection, resource exhaustion, and admission controller gaps. Both external and internal (compromised pod) perspectives. Uses trivy, kube-bench, kubectl, nuclei, dive, amicontained, and docker-bench-security. Covers OWASP Kubernetes Top 10 and all 22 Kubernetes Goat attack scenarios.

日本語の概要は準備中です。原文の説明を表示しています。

AI/LLM red-team assessment using the OWASP LLM Top 10 (2025) + OWASP AI Testing Guide (AITG v1, Nov 2025) frameworks, plus OWASP MCP Top 10 runtime testing for agentic/MCP targets. Tests prompt injection, jailbreaks, system prompt leakage, sensitive data extraction, excessive agency, improper output handling, model extraction, content bias, evasion, membership inference, MCP token exposure, MCP command injection, and more. Uses four tools in combination: FuzzyAI (single-turn jailbreak fuzzing), PyRIT (multi-turn orchestrated attacks), Garak (probe-based vulnerability scanning), and promptfoo (plugin-based red-team evaluation). Each tool covers different OWASP categories; running them together gives systematic coverage. Includes a conditional MCP reconnaissance phase and a post-access AI infrastructure phase (chained from /post-exploit). Produces: OWASP LLM Top 10 + AITG + MCP coverage matrix, findings per category, architecture diagram of the AI system, PoCs for confirmed exploits. Chains into /gh-export for issue filing.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit Active Directory environments using Pass-the-Hash (PtH). This skill details how to authenticate to remote systems using the NTLM hash of a user's password instead of the plaintext password, enabling lateral movement and privilege escalation without cracking hashes.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit Active Directory replication privileges (DS-Replication-Get-Changes) to perform a DCSync attack, allowing an attacker to impersonate a Domain Controller and extract password hashes (like the krbtgt hash for Golden Tickets) without code execution on a DC.

日本語の概要は準備中です。原文の説明を表示しています。

Identify and exploit Mass Assignment vulnerabilities in APIs. Use this skill when testing REST APIs or application forms that directly map user-supplied JSON or POST input to internal database objects. An attacker can inject undocumented variables (e.g., `is_admin`, `verified`) to illegally modify restricted properties.

日本語の概要は準備中です。原文の説明を表示しています。

AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when the user wants to turn code graph analysis into tracked GitHub issues — "audit the architecture", "find god nodes", "triage architectural debt", "run graphify and log issues", "what's over-coupled in this codebase", "create issues from graphify findings", "check for structural problems", "scan for architectural smells", or any request that combines codebase topology analysis with issue tracking. This skill runs graphify to build a dependency graph, parses GRAPH_REPORT.md for god nodes and structural patterns, converts findings into GitHub issue payloads, and optionally pushes them to the repo. It bridges static analysis and project management in a single automated pass. Requires graphify and gh CLI.

日本語の概要は準備中です。原文の説明を表示しています。

Inspect scope and unexpected registry drift against the actual PR base and leave a concise final receipt. Use for "check for drift", "wrap up the pipeline", or the final stage; never silently discard unknown changes or infer a clean diff from validator success.

日本語の概要は準備中です。原文の説明を表示しています。

Gaia Skill Tree image-generation and deterministic export harness for Ascension Overdrive v3. Use when generating, iterating, refining, cropping, color-grading, making transparent cutouts, compressing, upscaling, or validating production image assets. Always use image gen 2 / gpt-image-2 and never nano-banana.

日本語の概要は準備中です。原文の説明を表示しています。

Generate a prioritized review queue of registry skills and catalog items that need attention. Use this skill whenever someone asks: "what needs review?", "what's overdue for audit?", "where are the weak spots in the registry?", "what should I audit next?", "run a health check on the registry", "show me flagged skills", "find problems in the registry", "what skills need fixing?", or "triage the registry". This is the triage layer — it surfaces candidates ranked P0–P4 so that focused work (via /gaia-audit) targets the right things first. Run this before any audit pass. Also invoke proactively when a PR changes registry/named/ at scale, or before a release, to catch regressions early.

日本語の概要は準備中です。原文の説明を表示しています。

Master professional email — inbox zero systems, high-impact writing, etiquette, and managing email at scale.

日本語の概要は準備中です。原文の説明を表示しています。

Market franchise systems — franchisee recruitment, local-national marketing balance, and brand consistency at scale.

日本語の概要は準備中です。原文の説明を表示しています。

Build and govern scalable design systems with tokens, components, documentation, and adoption strategy.

日本語の概要は準備中です。原文の説明を表示しています。

Manage software composition analysis — SBOMs, vulnerability triage, and remediation of third-party dependencies.

日本語の概要は準備中です。原文の説明を表示しています。

Build SaaS customer support — tiered support models, SLAs, macros, escalation, and support-driven product feedback.

日本語の概要は準備中です。原文の説明を表示しています。

Build custom data visualizations with D3: selections, scales, axes, transitions, and reusable chart patterns. Use when off-the-shelf charts aren't enough.

日本語の概要は準備中です。原文の説明を表示しています。

Professional CSS: cascade mastery, modern layout, custom properties, and maintainable architecture. Use when writing, reviewing, or debugging CSS.

日本語の概要は準備中です。原文の説明を表示しています。

Secure containerized workloads — image hardening, registry scanning, runtime protection, and supply-chain integrity.

日本語の概要は準備中です。原文の説明を表示しています。

Blazing inference on Cerebras wafer-scale hardware — ultra-fast open-model APIs for speed-critical workloads.

日本語の概要は準備中です。原文の説明を表示しています。

Design and operate CI/CD pipelines: fast feedback, deployment strategies, environments, and pipeline reliability. Use when building, fixing, or scaling build and deploy pipelines.

日本語の概要は準備中です。原文の説明を表示しています。

Use OpenAI models on Azure — enterprise deployment with private networking, compliance, and managed scaling.

日本語の概要は準備中です。原文の説明を表示しています。

Deploy ML models to production with Baseten — high-performance inference with autoscaling and custom runtimes.

日本語の概要は準備中です。原文の説明を表示しています。

Capacity planning — forecasting demand, sizing infrastructure, and avoiding both outages and waste — use when scaling systems.

日本語の概要は準備中です。原文の説明を表示しています。