5,609 件 ・ 関連度順
Phase 1 of the Forge pipeline. Gather real context from the codebase, answer everything the code can answer through exploration, then grill the user one question at a time (with a recommended answer) for only what code cannot answer, and write a research document. Use when starting /forge-research or the research step of /forgemaster, or when the user wants a research-first investigation before planning a feature.
日本語の概要は準備中です。原文の説明を表示しています。
Edit and improve article drafts by confirming a heading-based section plan, dependency order, then rewriting section by section with short paragraphs. Use when the user wants to revise or improve an article draft.
日本語の概要は準備中です。原文の説明を表示しています。
Expert security auditor specializing in DevSecOps, comprehensive cybersecurity, and compliance frameworks. Masters vulnerability assessment, threat modeling, secure authentication (OAuth2/OIDC), OWASP standards, cloud security, and security automation. Handles DevSecOps integration, compliance (GDPR/HIPAA/SOC2), and incident response. Use PROACTIVELY for security audits, DevSecOps, or compliance implementation.
日本語の概要は準備中です。原文の説明を表示しています。
Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.
日本語の概要は準備中です。原文の説明を表示しています。
Queries Uno MCP server. Tool detection, search-then-fetch workflow, init rules, fallback.
日本語の概要は準備中です。原文の説明を表示しています。
Create or update active planning documents under `planning/active`, then define the execution slices, validations, specialist handoff, and closeout expectations. Use when the task is non-trivial, multi-step, or explicitly asks for planning.
日本語の概要は準備中です。原文の説明を表示しています。
Use FIRST when someone asks for a new feature or a change to an existing one — before any schema, code or test. Works out what is actually being asked for, whether to build it or integrate a third party (Trustpilot, Stripe, Calendly and the like), where the data lives, who may do what, and what happens when the vendor is down. Produces a decision, then hands to feature-schema.
日本語の概要は準備中です。原文の説明を表示しています。
Use after building a feature — explore it in a real browser to find what nobody predicted, then turn each finding into a deterministic test that guards it forever. Covers the agentic pass, what to generate vs hand-write, and how to skip honestly when a capability is missing.
日本語の概要は準備中です。原文の説明を表示しています。
Use when reading or changing example.com content, settings, products or pricing through the MCP API at /api/mcp — the 27 JSON-RPC tools, how to authenticate, which changes need a redeploy and which are live immediately, and the commercial scope rule that the product tools enforce.
日本語の概要は準備中です。原文の説明を表示しています。
Identifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests using manual techniques and automated tools like sqlmap. The tester detects injection points through error-based, union-based, blind boolean, and time-based blind techniques across all major database engines (MySQL, PostgreSQL, MSSQL, Oracle) to demonstrate data extraction, authentication bypass, and potential remote code execution. Activates for requests involving SQL injection testing, SQLi exploitation, database security assessment, or injection vulnerability verification.
日本語の概要は準備中です。原文の説明を表示しています。
Testing WebSocket implementations for authentication bypass, cross-site hijacking, injection attacks, and insecure message handling during authorized security assessments.
日本語の概要は準備中です。原文の説明を表示しています。
Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.
日本語の概要は準備中です。原文の説明を表示しています。
Identifies and exploits SMB protocol vulnerabilities using Metasploit Framework during authorized penetration tests to demonstrate risks from unpatched Windows systems, misconfigured shares, and weak authentication in enterprise networks.
日本語の概要は準備中です。原文の説明を表示しています。
Tests APIs for Broken Function Level Authorization (BFLA) vulnerabilities where regular users can invoke administrative functions or access privileged API endpoints by directly calling them. The tester identifies admin and privileged endpoints, then attempts to access them with regular user credentials by manipulating HTTP methods, URL paths, and request parameters. Maps to OWASP API5:2023 Broken Function Level Authorization. Activates for requests involving BFLA testing, admin endpoint bypass, function-level access control testing, or API privilege escalation.
日本語の概要は準備中です。原文の説明を表示しています。
Detect and exploit JavaScript prototype pollution vulnerabilities on both client-side and server-side applications to achieve XSS, RCE, and authentication bypass through property injection.
日本語の概要は準備中です。原文の説明を表示しています。
Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows, SMB traffic, and RDP sessions using Zeek, Velociraptor, and SIEM correlation rules to detect attackers moving between systems.
日本語の概要は準備中です。原文の説明を表示しています。
Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.
日本語の概要は準備中です。原文の説明を表示しています。
Detect RDP brute force attacks by analyzing Windows Security Event Logs for failed authentication patterns (Event ID 4625), successful logons after failures (Event ID 4624), NLA failures, and source IP frequency analysis.
日本語の概要は準備中です。原文の説明を表示しています。
Detects AI-generated deepfake audio used in voice phishing (vishing) attacks by extracting spectral features (MFCC, spectral centroid, spectral contrast, zero-crossing rate) and classifying samples with machine learning models. Supports batch analysis of audio files, generates confidence scores, and produces forensic reports. Activates for requests involving deepfake voice detection, vishing investigation, AI-generated speech analysis, voice cloning detection, or audio authenticity verification.
日本語の概要は準備中です。原文の説明を表示しています。
Detect Pass-the-Hash attacks by analyzing NTLM authentication patterns, identifying Type 3 logons with NTLM where Kerberos is expected, and correlating with credential dumping.
日本語の概要は準備中です。原文の説明を表示しています。
Configure secure OAuth 2.0 authorization flows including Authorization Code with PKCE, Client Credentials, and Device Authorization Grant. This skill covers flow selection, PKCE implementation, token
日本語の概要は準備中です。原文の説明を表示しています。
Conducts penetration testing of iOS and Android mobile applications following the OWASP Mobile Application Security Testing Guide (MASTG) to identify vulnerabilities in data storage, network communication, authentication, cryptography, and platform-specific security controls. The tester performs static analysis of application binaries, dynamic analysis at runtime, and API security testing to evaluate the complete mobile attack surface. Activates for requests involving mobile app pentest, iOS security assessment, Android security testing, or OWASP MASTG assessment.
日本語の概要は準備中です。原文の説明を表示しています。
Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Activates for requests involving API security testing, REST API pentest, GraphQL security assessment, or API vulnerability testing.
日本語の概要は準備中です。原文の説明を表示しています。
Pass-the-Ticket (PtT) is a lateral movement technique that uses stolen Kerberos tickets (TGT or TGS) to authenticate to services without knowing the user's password. By extracting Kerberos tickets fro
日本語の概要は準備中です。原文の説明を表示しています。