「audit」の検索結果

Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation ...

日本語の概要は準備中です。原文の説明を表示しています。

Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need to resolve where tools, wordlists, and clones are installed on the local machine (jhaddix, SecLists, trufflehog, ffuf, dalfox, ghauri); for pure orchestration/routing use the bug-bounty skill. Workflow it covers — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass...

日本語の概要は準備中です。原文の説明を表示しています。

Kubernetes cluster attack techniques covering the full attack lifecycle from initial foothold in a pod to cluster-wide compromise. Covers service account token theft and impersonation, RBAC misconfiguration exploitation including wildcard permissions and privilege escalation via role binding, direct etcd access for secret extraction, kubelet API abuse on port 10250 and read-only port 10255, pod escape via hostPID hostNetwork and hostPath volume mounts, Kubernetes secrets enumeration and decoding, admission controller bypass techniques, network policy bypass and lateral movement, cloud metadata service access from pods for credential theft on AWS EKS GCP GKE and Azure AKS, CRD and operator abuse for persistence, and node compromise via DaemonSet deployment. Tools include kubectl, kube-hunter, peirates, kubeaudit, kdigger, kubeletctl. Maps to MITRE ATT&CK T1609 Container Administration Command, T1610 Deploy Container, T1613 Container and Resource Discovery. Use this skill when assessing Kubernetes clusters,...

日本語の概要は準備中です。原文の説明を表示しています。

iOS HealthKit data sync CLI commands and patterns. Use when working with healthsync CLI, fetching Apple Health data (steps, heart rate, sleep, workouts), pairing iOS devices over local network, or understanding the iOS Health Sync project architecture including mTLS certificate pinning, Keychain storage, and audit logging.

日本語の概要は準備中です。原文の説明を表示しています。

別駭我！基本安全檢測 — Security self-check for Clawdbot/Moltbot. Run a quick audit of your clawdbot.json to catch dangerous misconfigurations — exposed gateway, missing auth, open DM policy, weak tokens, loose file permissions. Auto-fix included. Invoke: "run a security check" or "幫我做安全檢查".

日本語の概要は準備中です。原文の説明を表示しています。

This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud environments", or "audit cloud infrastructure". It provides comprehensive techniques for security assessment across major cloud platforms.

日本語の概要は準備中です。原文の説明を表示しています。

Build autonomous AI agents with Claude Agent SDK. Structured outputs guarantee JSON schema validation, with plugins system and hooks for event-driven workflows. Prevents 14 documented errors. Use when: building coding agents, SRE systems, security auditors, or troubleshooting CLI not found, structured output validation, session forking errors, MCP config issues, subagent cleanup.

日本語の概要は準備中です。原文の説明を表示しています。

When the user wants to set up, improve, or audit analytics tracking and measurement. Also use when the user mentions "set up tracking," "GA4," "Google Analytics," "conversion tracking," "event tracking," "UTM parameters," "tag manager," "GTM," "analytics implementation," or "tracking plan." For A/B test measurement, see ab-test-setup.

日本語の概要は準備中です。原文の説明を表示しています。

Complete observability & reliability engineering system. Use when designing monitoring, implementing structured logging, setting up distributed tracing, building alerting systems, creating SLO/SLI frameworks, running incident response, conducting post-mortems, or auditing system reliability. Covers all three pillars (logs/metrics/traces), alert design, dashboard architecture, on-call operations, chaos engineering, and cost optimization.

日本語の概要は準備中です。原文の説明を表示しています。

Complete cybersecurity assessment, threat modeling, and hardening system. Use when conducting security audits, threat modeling, penetration testing, incident response, or building security programs from scratch. Works with any stack — zero external dependencies.

日本語の概要は準備中です。原文の説明を表示しています。

Scan AI agent skills for security vulnerabilities — detects code injection, prompt injection, credential exfiltration, supply chain attacks, and 69+ threat patterns. Use when installing new skills, auditing existing ones, reviewing untrusted code, or validating packages before publishing.

日本語の概要は準備中です。原文の説明を表示しています。

Automated security auditing for OpenClaw projects. Scans for hardcoded secrets (API keys, tokens) and container vulnerabilities (CVEs) using Trivy. Provides structured reports to help maintain a clean and secure codebase.

日本語の概要は準備中です。原文の説明を表示しています。

Store, verify, and manage AI data on the Ethereum blockchain (Base network) using the ERCData standard. Use when an agent needs to store data fingerprints on-chain, verify data integrity, create audit trails, manage access control for private data, or interact with the ERCData smart contract. Supports public and private storage, EIP-712 verification, snapshots, and batch operations.

日本語の概要は準備中です。原文の説明を表示しています。

GoPlus AgentGuard — AI agent security guard. Automatically blocks dangerous commands, prevents data leaks, and protects secrets. Use when reviewing third-party code, auditing skills, checking for vulnerabilities, evaluating action safety, or viewing security logs.

日本語の概要は準備中です。原文の説明を表示しています。

Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".

日本語の概要は準備中です。原文の説明を表示しています。

Takes raw leads and enriches them to outreach-ready status. Chains company-researcher, cro-auditor, decision-maker-finder, apollo-lead-finder, email-validator, and personalization-enricher.

日本語の概要は準備中です。原文の説明を表示しています。

Builds a hyperpersonalization packet for each lead by chaining company-researcher, cro-auditor, and person-researcher. The packet feeds into message-generator for Tier 3 personalized outreach.

日本語の概要は準備中です。原文の説明を表示しています。

Post-deal new client onboarding workflow. Creates client profile, runs baseline technical audit, generates project plan, sets up communication templates, and updates CRM.

日本語の概要は準備中です。原文の説明を表示しています。

Audit whether a "current product focus receipt" (Decision/Now/Why-now/Evidence/Not-now/Cut-suspend/First-visible-proof/ Acceptance-gate/Kill-revisit-trigger/Owner/Review-date) and the work order it gates state a real, testable decision and a real agent launch — not planning-placeholder prose that sounds like an assignment but can't be proven. Use when deciding whether to launch an agent chain against a milestone or a stated "focus," when a work order lacks explicit input/output/owner/proof-gate, or when an acceptance gate would only prove a cached UI state instead of daemon truth. NOT for distinguishing roadmap items from energy-driven sidequests (legible-roadmap-with-sidequests), reviewing a PRD/prototype for product-completeness gaps like cold start or pricing (product-reality-reviewer), or accepting already-finished work against a personal acceptance bar (port-daddy-user-surrogate-pm-review).

日本語の概要は準備中です。原文の説明を表示しています。

Designs, reconciles, and reviews an end-to-end Drydock program for safely staging agent runtimes: immutable worktree provenance, disposable VM containment, typed effect brokerage, global body accounting, resurrection, subscription-capacity economics, context compaction, operator control, evidence, and promotion. Use when several Drydock contracts must compose into one architecture, implementation hypertree, diagram set, or release plan. NOT for launching Port Daddy, running an untrusted subject, replacing focused containment/resurrection/capacity audits, or treating a design packet as runtime authority.

日本語の概要は準備中です。原文の説明を表示しています。

Refute-before-prove research discipline: automated counterexample sweeps before any formalization, meter-integrity audits for information-bound experiments, mutation-tested model checkers, pre-registered commit-or-cut gates for speculative directions, wrong-turn reporting, and numeric-claim provenance. Use when validating any new theorem, bound, equilibrium, or security claim; when building or trusting a checker, simulator, or experiment; or when deciding whether a speculative research direction lives or dies. NOT for exploratory brainstorming, product prioritization, writing style, or literature review.

日本語の概要は準備中です。原文の説明を表示しています。

Cloudflare Pages and Workers deployment checklist for wrangler deploys, secret audits, D1 migrations, Worker-compatible SDK checks, and browser-auth verification. Use when shipping Cloudflare changes to production. NOT for general CI/CD architecture, non-Cloudflare deployments, or post-launch UX QA.

日本語の概要は準備中です。原文の説明を表示しています。

Guides the practical path from 'we have no design system' or 'we have a mess' to a real, functional design system. Component inventory, design token extraction, headless UI adoption (Radix, React Aria, Headless UI), migration order of operations, and the assessment-to-rollout pipeline. Activate on 'design system from scratch', 'bootstrap design system', 'no design system', 'design system migration', 'headless UI adoption', 'component audit', 'design token extraction', 'design system strategy'. NOT for building specific components once a system exists (use design-system-creator), not for generating token files/configs (use design-system-generator).

日本語の概要は準備中です。原文の説明を表示しています。

Analyze design trends and recommend appropriate styles, color palettes, and typography systems for your project based on current design movements. NOT for accessibility auditing or full design system creation.

日本語の概要は準備中です。原文の説明を表示しています。