5,958 件 ・ 関連度順
概要と使いどころ
This skill teaches security teams how to detect and respond to unauthorized cryptocurrency mining operations in cloud environments. It covers identifying cryptomining indicators through compute usage anomalies, network traffic patterns to mining pools, GuardDuty CryptoCurrency findings, and runtime process monitoring on EC2, ECS, EKS, and Azure Automation workloads.
日本語の概要は準備中です。原文の説明を表示しています。
Deploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processes, open ports, installed software, and system configuration. Use when building visibility into endpoint state, threat hunting across fleet, or implementing compliance monitoring. Activates for requests involving osquery deployment, endpoint visibility, fleet management, or SQL-based endpoint querying.
日本語の概要は準備中です。原文の説明を表示しています。
Performs statistical analysis of Zeek conn.log connection intervals to detect C2 beaconing patterns. Uses the ZAT library to load Zeek logs into Pandas DataFrames, calculates inter-arrival time standard deviation, and flags periodic connections with low jitter. Use when hunting for command-and-control callbacks in network data.
日本語の概要は準備中です。原文の説明を表示しています。
Correlates disparate security incidents, IOCs, and adversary behaviors across time and organizations to identify unified threat campaigns, attribute them to common threat actors, and extract shared indicators for improved detection. Use when multiple incidents exhibit overlapping indicators, when sector-wide attack campaigns require cross-organizational analysis, or when building campaign-level intelligence products. Activates for requests involving campaign analysis, incident clustering, cross-organizational IOC correlation, or MISP correlation engine.
日本語の概要は準備中です。原文の説明を表示しています。
Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for real-time network traffic inspection, threat detection, and integration with SIEM platforms for centralized security monitoring.
日本語の概要は準備中です。原文の説明を表示しています。
Conducts penetration testing of iOS and Android mobile applications following the OWASP Mobile Application Security Testing Guide (MASTG) to identify vulnerabilities in data storage, network communication, authentication, cryptography, and platform-specific security controls. The tester performs static analysis of application binaries, dynamic analysis at runtime, and API security testing to evaluate the complete mobile attack surface. Activates for requests involving mobile app pentest, iOS security assessment, Android security testing, or OWASP MASTG assessment.
日本語の概要は準備中です。原文の説明を表示しています。
Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and standardize enrichment outputs. Use when building automated enrichment workflows integrated with SIEM alerts, email submission pipelines, or bulk IOC processing from threat feeds. Activates for requests involving SOAR enrichment, Cortex XSOAR, Splunk SOAR, TheHive, Python enrichment pipelines, or automated IOC processing.
日本語の概要は準備中です。原文の説明を表示しています。
Implement a vulnerability aging dashboard and SLA tracking system to measure remediation performance against severity-based timelines and drive accountability.
日本語の概要は準備中です。原文の説明を表示しています。
Builds automated threat intelligence feed integration pipelines connecting STIX/TAXII feeds, open-source threat intel, and commercial TI platforms into SIEM and security tools for real-time IOC matching and alerting. Use when SOC teams need to operationalize threat intelligence by automating feed ingestion, normalization, scoring, and distribution to detection systems.
日本語の概要は準備中です。原文の説明を表示しています。
Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.
日本語の概要は準備中です。原文の説明を表示しています。
Executes malware samples in Cuckoo Sandbox to observe runtime behavior including process creation, file system modifications, registry changes, network communications, and API calls. Generates comprehensive behavioral reports for malware classification and IOC extraction. Activates for requests involving dynamic malware analysis, sandbox detonation, behavioral analysis, or automated malware execution.
日本語の概要は準備中です。原文の説明を表示しています。
Analyze the threat landscape using MISP (Malware Information Sharing Platform) by querying event statistics, attribute distributions, threat actor galaxy clusters, and tag trends over time. Uses PyMISP to pull event data, compute IOC type breakdowns, identify top threat actors and malware families, and generate threat landscape reports with temporal trends.
日本語の概要は準備中です。原文の説明を表示しています。
Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection. Covers Windows event logs, firewall logs, proxy logs, and authentication data analysis. Activates for requests involving Splunk investigation, SPL queries, SIEM log analysis, security event correlation, or log-based incident investigation.
日本語の概要は準備中です。原文の説明を表示しています。
Detect abnormal access patterns in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics. Identifies after-hours bulk downloads, access from new IP addresses, unusual API calls (GetObject spikes), and potential data exfiltration using statistical baselines and time-series anomaly detection.
日本語の概要は準備中です。原文の説明を表示しています。
ADHD-friendly output shaping for subagent responses. Lead with the next action, number multi-step tasks, end with one concrete next step, suppress tangents, restate state across turns, give specific time estimates, make wins visible, matter-of-fact errors, cap visible lists to 5, no preamble or closers. Loaded by genin, jonin, anbu, tokubetsu-jonin, and chunin when shaping final responses.
日本語の概要は準備中です。原文の説明を表示しています。
Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and build investigation timelines.
日本語の概要は準備中です。原文の説明を表示しています。
Uses the Linux Audit framework (auditd) with ausearch and aureport utilities to detect intrusion attempts, unauthorized access, privilege escalation, and suspicious system activity. Covers audit rule configuration, log querying, timeline reconstruction, and integration with SIEM platforms. Activates for requests involving auditd analysis, Linux audit log investigation, ausearch queries, aureport summaries, or host-based intrusion detection on Linux.
日本語の概要は準備中です。原文の説明を表示しています。
Create a feature branch with sequential or timestamp numbering
日本語の概要は準備中です。原文の説明を表示しています。
Run a live investigation as an operator-driven query loop: the operator runs each query on the live system and pastes the result back, and you guide the investigation one labelled query at a time. Use alongside support-assist (which covers what to investigate) whenever someone is pasting query or command output back from a deployment, especially during an incident. Covers labelling, pacing, making each query decide the next step, version-grounding, and keeping queries cheap and correctly classified.
日本語の概要は準備中です。原文の説明を表示しています。
Scrapes pump.fun/board using Chrome browser automation to extract the top 100 trending Solana tokens and writes structured markdown for a trading agent to consume. Use this skill any time you need to: scan pump.fun for new tokens, refresh the pump.md token list, run the scheduled board scrape, collect Solana meme token data, or build/update a trading watchlist from pump.fun. Even if the user says something casual like "check pump" or "update the token list" or "what's trending on pump", use this skill. The output file path and format are configurable but default to /Users/8bit/solanaos/pump.md.
日本語の概要は準備中です。原文の説明を表示しています。
Delegate coding tasks to Codex, Claude Code, or Pi agents via background process. Use when: (1) building/creating new features or apps, (2) reviewing PRs (spawn in temp dir), (3) refactoring large codebases, (4) iterative coding that needs file exploration. NOT for: simple one-liner fixes (just edit), reading code (use read tool), thread-bound ACP harness requests in chat (for example spawn/run Codex or Claude Code in a Discord thread; use sessions_spawn with runtime:"acp"), or any work in ~/clawd workspace (never spawn agents here). Claude Code: use --print --permission-mode bypassPermissions (no PTY). Codex/Pi/OpenCode: pty:true required.
日本語の概要は準備中です。原文の説明を表示しています。
Coach German writing and conversation with minimal corrections, persistent root-cause mistake tracking (FehlerDNA), mistake-based spaced repetition with a new sentence every time, roleplay whose words return in spaced reviews, continuing preparation for real-life goals across sessions, and an honest progress profile. Use for German correction, personalized review, vocabulary, progress, roleplay, or preparation for an interview, presentation, appointment, or other concrete event; do not use for translation-only requests without learning or feedback.
日本語の概要は準備中です。原文の説明を表示しています。
Comprehensive Cline SDK skill for building AI agents. Covers the direct Agent runtime, ClineCore sessions, custom tools, plugins, events, LLM providers, scheduling, multi-agent teams, and production deployment. Use for any task involving @cline/sdk or its sub-packages.
日本語の概要は準備中です。原文の説明を表示しています。
使用有界本地报告诊断 Codex Flight Control 的安装、runtime、文档、持久状态、Wave、Guidance、Private Skill、角色策略、托管工作区、Evidence、Completion Gate 和恢复状态。用户询问飞控状态、健康、支持信息、恢复分析或阻断原因时使用；禁止上传数据或执行破坏性修复。
日本語の概要は準備中です。原文の説明を表示しています。