「secret」の検索結果

ASP.NET Core web framework conventions: Minimal API vs MVC controllers, Program.cs composition, DI lifetimes (Scoped/Singleton/Transient), Options pattern with IOptions<T>, middleware ordering (HTTPS redirect → routing → authentication → authorization), model binding and validation (FluentValidation / DataAnnotations), ProblemDetails error handling, structured logging with ILogger<T>, configuration layering (appsettings.json + environment variables + User Secrets), and health checks. Works alongside csharp-foundation:csharp-conventions and aspnet-core-plugin:efcore-patterns. Use this skill to: - Compose Program.cs correctly — register services, configure middleware in the right order, map endpoints. - Apply the Options pattern to avoid passing raw IConfiguration into services. - Write Minimal API endpoint groups with typed results and authorization. - Handle cross-cutting errors uniformly with ProblemDetails. - Configure structured logging and health checks for production readiness. Do NOT use this skill for: - EF Core entity configuration and migrations — see aspnet-core-plugin:efcore-patterns. - C# language idioms — see csharp-foundation:csharp-conventions. - Testing — see csharp-foundation:dotnet-testing.

日本語の概要は準備中です。原文の説明を表示しています。

Security audit checklist based on OWASP Top 10 and best practices. Covers authentication, injection, XSS, CSRF, secrets management, and more. Use when reviewing security, before deploy, asking "is this secure", "security check", "vulnerability".

日本語の概要は準備中です。原文の説明を表示しています。

Connect to and query ClickHouse (a local server or a ClickHouse Cloud service) from the terminal. For ClickHouse Cloud analytics, use the configured direct ClickHouse Query API endpoint with per-user CH_API_KEY and CH_API_SECRET credentials; do not use clickhousectl cloud service query. For local or host/port servers, use clickhousectl local client. Use when the user wants to run SQL against ClickHouse, explore schemas and tables, inspect Cloud services, or authenticate. For building a local dev environment or deploying to Cloud, defer to the official ClickHouse skills (see Scope).

日本語の概要は準備中です。原文の説明を表示しています。

Security audit checklist based on OWASP Top 10 and best practices. Covers authentication, injection, XSS, CSRF, secrets management, and more. Use when reviewing security, before deploy, asking "is this secure", "security check", "vulnerability".

日本語の概要は準備中です。原文の説明を表示しています。

Set up and verify Google OAuth for NowStack Mobile web and Expo clients against the shared Better Auth and Convex backend. Use for Google sign-in buttons, Google Cloud OAuth clients, callback URLs, missing GOOGLE_CLIENT_ID or GOOGLE_CLIENT_SECRET, or production Google auth rotation.

日本語の概要は準備中です。原文の説明を表示しています。

Set up and verify Sign in with Apple for NowStack Mobile web and iOS against the shared Better Auth and Convex backend. Use for Apple Services IDs, return URLs, Sign in with Apple keys, APPLE_CLIENT_ID or APPLE_CLIENT_SECRET, expiring Apple JWTs, or production Apple auth rotation.

日本語の概要は準備中です。原文の説明を表示しています。

Audit and remediate NowStack Mobile security flaws. Use for auth/session abuse, Apple or Stripe payment bypass, Convex authorization, cross-user data leaks, unsafe deep links, R2 uploads, client secrets, SSRF, XSS, or pentest follow-up.

日本語の概要は準備中です。原文の説明を表示しています。

Provision a zero-config, no-signup, temporary Upstash Redis database for an AI agent with a single POST to https://upstash.com/start-redis, with no account, API key, or SDK setup required. Use when an agent needs scratch Redis right now and the user has not provided credentials, for short-term memory across tool calls, conversation history, a sub-agent work queue, ranked recall, or a quick prototype or demo. Covers idempotent creation and re-fetching credentials, calling the database through the body-style REST API or the official SDKs, and telling the user how to claim it. The database lives 3 days unless the user claims it; not for production data, PII, or secrets.

日本語の概要は準備中です。原文の説明を表示しています。

当用户想使用 HiAgent 观测(observe)能力（API Token、Trace Spans 查询）时，务必使用这个技能给出可直接执行的 cli-anything-hiagent observe 命令与排障步骤。尤其适用于用户提到 agent-harness、cli_anything、--json、workspace-id、custom-app-id、VOLC_ACCESSKEY/VOLC_SECRETKEY、observe token、observe trace，以及希望用命令行(cli-anything-hiagent / python -m cli_anything.hiagent_sdk)。trace-ai-process / trace-ai-history / alert-ai-process / RuleID / IsStream

日本語の概要は準備中です。原文の説明を表示しています。

Use this when setting up a GitHub repo to push its Nix builds to Juspay's shared OSS Attic cache (cache.nixos.asia/oss) — adds the substituter to flake.nix, a nix-cache.yml GitHub Actions workflow, and prompts for the ATTIC_TOKEN secret.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user explicitly asks for the Inngest REST API v2, raw HTTP, OpenAPI, API docs, API authentication, or an endpoint that the Inngest CLI does not expose. Covers api-docs.inngest.com, llms.txt, the OpenAPI v2 spec, Bearer authentication with API keys or signing keys, production and local base URLs, raw curl/fetch requests, request-shape discovery, pagination, secret redaction, and when to prefer the `inngest-api-cli` skill instead.

日本語の概要は準備中です。原文の説明を表示しています。

REQUIRED skill for any security-related request. Use this skill whenever the user wants to find anything dangerous, sensitive, or risky in their code, files, or repository. This includes but is not limited to: scanning for secrets/keys/tokens/credentials, checking dependencies for vulnerabilities, auditing destructive commands for missing safeguards, reviewing files for PII or internal data before open-sourcing, checking .env files or git history for leaked credentials, or any request where the concern is "is this safe/secure/exposed?" This skill provides a structured audit methodology and checklist you MUST follow — do not attempt security reviews without it. Skip this skill ONLY for pure feature work, refactoring, bug fixes, or non-security code review.

日本語の概要は準備中です。原文の説明を表示しています。

Use when you need to hunt in the organisation's own Microsoft Sentinel workspace — sweep the logs for IOC hits (IP, domain, hash, URL, account), hunt behavioural TTPs from MITRE ATT&CK techniques, run KQL against live data, or check which tables the workspace actually ingests. Discovers available tables first and only generates KQL for tables that verifiably exist, so hunts adapt to each environment's connectors. Commonly chained by the /*-investigation skills to answer "were we exposed?". Reads $SENTINEL_TENANT_ID, $SENTINEL_CLIENT_ID, $SENTINEL_CLIENT_SECRET, $SENTINEL_WORKSPACE_ID. Read-only.

日本語の概要は準備中です。原文の説明を表示しています。

Generate an interactive bash wizard that walks a human through steps only they can perform. Use when provisioning infrastructure, setting up credentials or CI secrets, walking an unfamiliar third-party dashboard, or running a one-off migration or cutover. Don't invoke this for steps the agent can perform itself.

日本語の概要は準備中です。原文の説明を表示しています。

Scan codebase for security vulnerabilities including secrets, insecure dependencies, and unsafe code patterns. Use when performing automated security scans.

日本語の概要は準備中です。原文の説明を表示しています。

Use when hunting Pwn Request vulnerabilities where pull_request_target workflows checkout attacker-controlled PR code and execute it in a privileged context with access to repository secrets. Trigger on: "pwn request", "pull_request_target", "checkout PR head", "npm install in CI", "lifecycle scripts in CI", "preinstall script", "postinstall script", "package.json scripts CI", "npm ci ignore-scripts false", "actions/checkout ref pull request head sha", privileged workflow running PR code, "Gato-X", supply chain via PR lifecycle scripts.

日本語の概要は準備中です。原文の説明を表示しています。

Identify and exploit Algorithm Confusion vulnerabilities in JSON Web Tokens (JWT). This skill details how to bypass signature verification by changing the signing algorithm from asymmetric (RS256) to symmetric (HS256) and using the public key as the symmetric secret.

日本語の概要は準備中です。原文の説明を表示しています。

Kubernetes penetration testing playbook. Use when targeting Kubernetes clusters via API server, RBAC enumeration, service account abuse, etcd access, Kubelet API, pod escape, cloud-specific metadata, admission webhook bypass, and registry secrets.

日本語の概要は準備中です。原文の説明を表示しています。

Container and Kubernetes security assessment. Tests container escape vectors, Docker/containerd socket exposure, K8s RBAC misconfigurations, pod security violations, exposed API servers, etcd access, service account token abuse, image layer secrets, private registry attacks, SSRF to metadata services, cross-namespace network bypass, CIS benchmarks, crypto miner detection, resource exhaustion, and admission controller gaps. Both external and internal (compromised pod) perspectives. Uses trivy, kube-bench, kubectl, nuclei, dive, amicontained, and docker-bench-security. Covers OWASP Kubernetes Top 10 and all 22 Kubernetes Goat attack scenarios.

日本語の概要は準備中です。原文の説明を表示しています。

Bug bounty findings secretary, tracker, and workspace initializer for the bb-huge portal. Use this skill for web security research, vulnerability hunting, and hunt workspace setup. Triggers on: "log finding", "save finding", "add to bb-huge", "record vulnerability", "update finding", "show findings", "bb-huge stats", "mark as confirmed", "mark as rewarded", "setup workspace", "pull evidence", "continue working on finding", "dump attachments", "list my skills", "what skills do I have", "/bb-huge init", "init hunt workspace", "new bug bounty program", "start hunting", "mobile bug bounty", "binary analysis", "source code review", "white-box audit", "h1-brain", "hack program", "hack()", "search disclosed", "fetch rewarded". Also auto-activates whenever a vulnerability is discovered during any recon, fuzzing, or manual testing session — do not wait to be asked.

日本語の概要は準備中です。原文の説明を表示しています。

Decompile, analyze, and reverse engineer Android applications (APKs). Utilize tools like JADX, Apktool, and dex2jar to extract source code (Java/Kotlin), analyze manifest configurations (Intents, Activities), and identify hardcoded secrets or insecure API endpoints.

日本語の概要は準備中です。原文の説明を表示しています。

Customize a new project created from this Flutter template, including app identity, package name, platform cleanup, icons, splash screen, Firebase/secrets decisions, setup tool execution, code generation, and validation.

日本語の概要は準備中です。原文の説明を表示しています。

MANDATORY deploy after every code change. Typecheck → deploy → purge CDN → E2E on production → visual verify → fix-forward loop. Workers Builds native CI/CD, D1 Time Travel PIT recovery, D1→R2 long-term backups, wrangler rollback, wrangler secrets management, structured observability, cross-browser smoke tests, rollback procedures, and GitHub auto-configuration.

日本語の概要は準備中です。原文の説明を表示しています。

Use when writing or reviewing code that parses user input, builds SQL/shell commands, handles secrets/credentials, hashes passwords, changes auth checks, deserializes untrusted data, or constructs paths/URLs from input

日本語の概要は準備中です。原文の説明を表示しています。