「zat」の検索結果

Business logic vulnerability playbook. Use when reasoning about workflows, race conditions, price manipulation, coupon abuse, state machines, and multi-step authorization gaps.

日本語の概要は準備中です。原文の説明を表示しています。

Application-level business logic security testing for any domain. Takes an understanding-first approach: map the intended workflows before probing them. Covers: value/quantity logic abuse (negative, zero, overflow, rounding on any numeric field), workflow and state machine bypass (skipping required steps, forcing illegal state transitions, reusing one-time tokens), trust boundary violations (BOLA horizontal/vertical, BFLA, cross-tenant access, negative ownership attacks), idempotency and replay attacks (duplicate submissions, double-spend, same-reference reuse), multi-step flow integrity (checkout, registration, approval, verification), quota and rate limit bypass, time/date manipulation, and authorization code / reference number predictability. Domain-agnostic — applies to SaaS, e-commerce, banking, gaming, social platforms, APIs, or any multi-user application with stateful workflows. Chains from /pentester; chains into /param-fuzz when boundary violations or mass assignment are confirmed.

日本語の概要は準備中です。原文の説明を表示しています。

Implement the 5-stage Funnel workflow (Notes → Leads → Primitives → Findings → Reports) for structured bug bounty hunting. Based on Critical Thinking Bug Bounty Podcast Episode 166.

日本語の概要は準備中です。原文の説明を表示しています。

White-box source code security review structured around OWASP ASVS 5.0 (427 verification requirements across 16 chapters). Reads and understands application source code to build a security-aware knowledge base that enriches all downstream skills. Covers: tech stack identification, route/endpoint mapping, authentication and authorization architecture, dangerous function patterns, source-to-sink data flow tracing, IaC review, dependency analysis, ASVS compliance mapping, and LLM integration security (prompt injection, tool abuse, output handling, RAG poisoning, MCP server patterns). When LLM/AI framework usage is detected, automatically reviews OWASP LLM Top 10 patterns from source code and chains into /ai-redteam with white-box context for live endpoint testing. Chains into /pentester, /threat-modeling, /web-exploit, /api-security, /cloud-security, /analyze-cve, /credential-audit, and /ai-redteam — providing white-box context that transforms black-box testing into targeted, informed assessment.

日本語の概要は準備中です。原文の説明を表示しています。

Test horizontal and vertical authorization bypass via session ID swapping between accounts, IDOR through parameter manipulation (invoice=, user=, menuitem=, EventID=), and special header injection (X-Original-URL, X-Rewrite-URL, X-Forwarded-For, X-Remote-IP, X-Client-IP with 127.0.0.1/localhost/RFC1918 values). Tools: Burp Suite with Autorize/AuthMatrix extensions, OWASP ZAP Access Control Testing add-on.

日本語の概要は準備中です。原文の説明を表示しています。

Use when hunting Broken Object Level Authorization (BOLA) or Insecure Direct Object Reference (IDOR) vulnerabilities in APIs or web applications. Trigger on: "BOLA", "IDOR", "broken object level", "access other users", "object reference", numeric or UUID IDs in URLs or request bodies, user-scoped resources, horizontal privilege escalation, "change the ID in the request", second-order IDOR, blind IDOR, indirect reference, encoded ID, deprecated API version, JSON globbing.

日本語の概要は準備中です。原文の説明を表示しています。

Test APIs for authentication and authorization bypass vulnerabilities including JWT manipulation, OAuth2 flaws, API key leakage, broken authentication, and token forgery. Use this skill when assessing REST/GraphQL APIs for access control weaknesses, session management flaws, or credential handling issues. Covers JWT algorithm confusion, OAuth redirect manipulation, and rate limit bypass.

日本語の概要は準備中です。原文の説明を表示しています。

Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.

日本語の概要は準備中です。原文の説明を表示しています。

Triage the Gaia issue backlog and skill-batch intake queue. Use this skill when someone asks to: "triage issues", "clean up the issue tracker", "review the backlog", "close stale issues", "process the intake queue", "review skill-batches", "evaluate draft skill proposals", "approve or reject pending skills", "is this issue still valid?", "what's clogging the backlog?", "run a triage pass", or /gaia-triage. Covers two workstreams: (1) GitHub issue lifecycle — identifying resolved, stale, or need-more-info issues and acting on them via gh CLI; (2) skill-batch intake — evaluating draft proposals in registry-for-review/skill-batches/ and routing them toward promotion or rejection. This is the gatekeeping step before new skills enter the canonical registry; and (3) a cross-repo triage sweep — sizing, P0-P4 prioritization, umbrella/epic synthesis, and assignment across every gaia-research org repo, on the one headquarters tracker.

日本語の概要は準備中です。原文の説明を表示しています。

Designing psychology experiments — variables, controls, randomization, counterbalancing, and preregistration.

日本語の概要は準備中です。原文の説明を表示しています。

Design rigorous experiments — hypotheses, controls, randomization, power analysis, and preregistration. Use when planning any study where you need trustworthy causal conclusions.

日本語の概要は準備中です。原文の説明を表示しています。

Coach senior leaders on strategic thinking, stakeholder management, presence, and organizational impact.

日本語の概要は準備中です。原文の説明を表示しています。

Run email marketing end-to-end — list building, campaigns, automation flows, deliverability, and performance optimization.

日本語の概要は準備中です。原文の説明を表示しています。

Align language models with human preferences using Direct Preference Optimization — no reward model, no RL loop.

日本語の概要は準備中です。原文の説明を表示しています。

Build rich visualizations with Apache ECharts: option config, dataset transforms, large-data performance, and custom rendering. Use for complex dashboards and big datasets.

日本語の概要は準備中です。原文の説明を表示しています。

Audit organizational communications — channel effectiveness, message clarity, overload, and actionable improvement plans.

日本語の概要は準備中です。原文の説明を表示しています。

Build custom data visualizations with D3: selections, scales, axes, transitions, and reusable chart patterns. Use when off-the-shelf charts aren't enough.

日本語の概要は準備中です。原文の説明を表示しています。

Increase conversion rates — CRO audits, A/B testing, landing page optimization, and experimentation programs.

日本語の概要は準備中です。原文の説明を表示しています。

Relational schema design — normalization, keys, constraints, and evolution — use when modeling data or reviewing a schema.

日本語の概要は準備中です。原文の説明を表示しています。

Design clear, actionable dashboards with KPI hierarchy, data visualization best practices, and layout patterns.

日本語の概要は準備中です。原文の説明を表示しています。

Keep long conversations coherent — summarization checkpoints, entity tracking, topic stacks, and graceful context handoffs. Use when dialogues run long or span sessions and the agent keeps losing the thread.

日本語の概要は準備中です。原文の説明を表示しています。

Designing clinical trials — phases, randomization, endpoints, sample size, and CONSORT-compliant reporting.

日本語の概要は準備中です。原文の説明を表示しています。

Heterogeneous and homogeneous catalysis — mechanisms, kinetics, catalyst characterization, and deactivation analysis.

日本語の概要は準備中です。原文の説明を表示しています。

CircleCI guidance — config design, orbs, caching, workflows, contexts, and pipeline optimization.

日本語の概要は準備中です。原文の説明を表示しています。