「paths」の検索結果

Find realistic link prospects with SERP and backlink evidence, discover contact paths via web tools, and draft personalized outreach — with targets saved to .seo/backlink-targets.json for off-page-seo campaigns. Use this skill when the user has a linkable asset (study, tool, guide, template, product page) and wants backlinks, resource-page inclusions, or comparison mentions. Triggers: "link prospecting", "find backlink opportunities", "resource page outreach", "get backlinks for", "link building outreach".

日本語の概要は準備中です。原文の説明を表示しています。

Structured marketing brainstorming when direction is unclear. Use when the agent doesn't know which skill to run, the user is vague about what they need, there are multiple valid marketing paths, or someone says 'I don't know where to start', 'what should we market', 'explore approaches', 'help me think through this', 'marketing ideas', 'what campaign should I run', 'where do I start with marketing', 'what's our marketing plan', or 'I have no idea how to promote this'. Explores 2-3 approaches and recommends the best path forward with a specific next-skill handoff. Even vague frustration like 'nobody knows about my product' or 'how do I get users' should trigger this when no specific channel or tactic is mentioned.

日本語の概要は準備中です。原文の説明を表示しています。

TypeScript and JavaScript performance and code-quality rules, usable in any framework. Use when writing, reviewing, or refactoring hot paths, data-structure choices, async flows, or bundle-size-sensitive code. Triggers include "optimize this function", "too slow", "reduce allocations", "bundle size", "lazy load", "speed up imports", or general code review of utilities and services.

日本語の概要は準備中です。原文の説明を表示しています。

Design and review autonomous or semi-autonomous agent loops — systems where an agent prompts itself, runs on a schedule or event, and iterates toward a goal without a human at the keyboard. Use this whenever the user wants to build, design, harden, or audit any kind of self-running agent, agentic workflow, control loop, background worker, cron/heartbeat/webhook-driven agent, "Ralph loop", auto-PR-fixer, monitoring agent, or any long-running task that should keep going on its own until done. Trigger this even when the user says "agentic workflow", "automation that runs itself", "an agent that keeps trying until X", or "make my agent stop running away / burning tokens" without using the word "loop". Also use it to review an existing loop's stopping conditions, guardrails, verification, and escalation paths.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you have a spec or requirements for a multi-step task, before touching code or producing output. Turns a design into bite-sized, copy-pasteable tasks with exact paths and complete code.

日本語の概要は準備中です。原文の説明を表示しています。

REQUIRED before declaring a task done when the diff touches user input, SQL, shell, auth, credentials, file paths, serialization, crypto, network endpoints, data deletion, or dependency surface. Judge by that surface, not the task label — research/experimental/local-only code with none of it can skip this. Walks OWASP/ASVS/MITRE questions the compiler and the test suite won't catch. Pair with `rafter run` on the same diff. When the diff has that surface, marking it complete without both has been under-delivered — do not claim done.

日本語の概要は準備中です。原文の説明を表示しています。

Entry point for rafter. Invoke when a sub-skill is unclear, or when the task needs `rafter run` (remote SAST+SCA), `rafter secrets` (local secrets-only), `rafter audit`, policy checks, or command-risk evaluation. Scope by security surface, not task label: engage when the diff touches auth, credentials/secrets/tokens, untrusted input, SQL, shell/exec, file paths, deserialization, crypto, network endpoints, data deletion, or dependencies; for research/experimental/local-only code with none of that, a quick surface check is enough. When such surface IS present and no rafter skill or CLI call has been made, invoke this before handing the task off — an un-evaluated "done" on genuine security surface is not done.

日本語の概要は準備中です。原文の説明を表示しています。

Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for attack path analysis, Mimikatz for credential extraction, and Impacket for protocol-level attacks including Kerberoasting, AS-REP Roasting, and delegation abuse. Activates for requests involving Active Directory pentest, AD attack simulation, domain compromise testing, or Kerberos attack assessment.

日本語の概要は準備中です。原文の説明を表示しています。

Use when assessing cloud infrastructure for security misconfigurations, IAM privilege escalation paths, S3 public exposure, open security group rules, or IaC security gaps. Covers AWS, Azure, and GCP posture assessment with MITRE ATT&CK mapping.

日本語の概要は準備中です。原文の説明を表示しています。

"Apply Structural Equation Modeling (SEM) to test hypothesized causal structures by combining measurement models (CFA) and structural models (path analysis). Use this skill when the user needs to validate latent constructs, test mediation or moderation paths, assess model fit with CFI/TLI/RMSEA/SRMR, or when they ask 'do these variables form a causal chain', 'how do I test my theoretical model', or 'is my measurement model valid'.".

日本語の概要は準備中です。原文の説明を表示しています。

Simplify working code while preserving behavior—remove dead paths, flatten nesting, clarify names, reduce duplication. Use after features work but code feels over-engineered.

日本語の概要は準備中です。原文の説明を表示しています。

SQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execution paths.

日本語の概要は準備中です。原文の説明を表示しています。

Path traversal and LFI playbook. Use when file paths, download endpoints, include operations, archive extraction, or wrapper behavior may expose filesystem control.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit path traversal and local/remote file inclusion (LFI/RFI) via URL parameters, cookies, and hidden fields using ../ sequences, URL encoding (%2e%2e%2f), double encoding (%252e%252e%255c), Unicode bypasses (..%c0%af), and Windows UNC paths. PHP include/require with $_GET/$_POST/$_COOKIE pattern. Target /etc/passwd, boot.ini, web.config. Tools: DotDotPwn, WFuzz, Burp Suite, ZAP.

日本語の概要は準備中です。原文の説明を表示しています。

Source control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidden dirs, or backup/config leaks during authorized testing.

日本語の概要は準備中です。原文の説明を表示しています。

Entry P1 category router for file access and upload workflows. Use when testing download endpoints, file paths, local file inclusion, upload flows, preview pipelines, archive extraction, or storage and sharing boundaries.

日本語の概要は準備中です。原文の説明を表示しています。

Identify and exploit default or weak credentials on web application login forms, admin panels, CMS backends (WordPress wp-admin, Joomla, Drupal), and embedded device management interfaces. Signals include framework fingerprinting (WhatWeb, Wappalyzer, Nikto), exposed admin paths from robots.txt/dirbusting, and weak password policy acceptance of "Password1" or "123456". Tools: Burp Suite Intruder, Hydra, Medusa, OWASP ZAP.

日本語の概要は準備中です。原文の説明を表示しています。

Penetration test AWS cloud environments for misconfigurations, privilege escalation, data exposure, and lateral movement. Use this skill when assessing AWS accounts for security weaknesses including S3 bucket misconfigurations, IAM policy flaws, EC2 metadata exploitation, Lambda function abuse, and cross-account attack paths. Covers both external and authenticated AWS pentesting.

日本語の概要は準備中です。原文の説明を表示しています。

Cloud security posture assessment for AWS, Azure, and GCP. Tests IAM privilege escalation paths, public storage exposure, serverless attack surface, database exposure, logging gaps, container registry security, and cloud-specific attacks. Both authenticated (with cloud credentials) and unauthenticated (external) modes. Uses nuclei cloud templates, Prowler, ScoutSuite, manual IMDS/metadata probing, and deep AWS/Azure/GCP CLI enumeration. Produces: cloud architecture diagram, attack path map, findings per category, compliance mapping (SOC 2, PCI DSS 4.0, HIPAA, CIS), PoCs for confirmed exploits. Chains into /gh-export for issue filing.

日本語の概要は準備中です。原文の説明を表示しています。

401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.

日本語の概要は準備中です。原文の説明を表示しています。

Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.

日本語の概要は準備中です。原文の説明を表示しています。

Active Directory security audit using the MITRE ATT&CK framework. Full domain enumeration, trust mapping, GPO analysis, ACL abuse paths, ADCS attacks (ESC1-ESC8), delegation abuse (constrained/unconstrained/RBCD), fine-grained password policies, LAPS deployment, service account security, and Kerberos configuration. Uses enum4linux-ng, netexec, impacket, ldapsearch, certipy-ad, bloodhound-python, and rpcclient. Produces attack path diagrams, prioritized risk register, and PoCs. Chains into /gh-export for issue filing.

日本語の概要は準備中です。原文の説明を表示しています。

Use when writing or reviewing code that parses user input, builds SQL/shell commands, handles secrets/credentials, hashes passwords, changes auth checks, deserializes untrusted data, or constructs paths/URLs from input

日本語の概要は準備中です。原文の説明を表示しています。

Use when implementing or updating a component from a Figma link — how to turn the Figma design variables into code tokens, on both platforms: Tailwind classnames for libs/ui-react and themeJS (`t.*`) paths for libs/ui-rnative. For the full token catalogues and styling mechanics, see component-styling.

日本語の概要は準備中です。原文の説明を表示しています。