「text」の検索結果

Turn raw Lumen release content (a dump of the LedgerHQ/lumen GitHub Releases page) into one minimalist Slack announcement, drafted to #lumen-releases. Use whenever the user pastes one or more `@ledgerhq/lumen-*` package releases, a chunk of the Releases page, or asks to "announce", "format", "post", or "write release notes / a Slack message" for new Lumen versions. Trigger it even when the user just drops the raw release text with no instructions, or says things like "new Lumen release", "format these lumen versions for Slack", or "lumen changelog for the channel".

日本語の概要は準備中です。原文の説明を表示しています。

Identify and exploit Server-Side Template Injection (SSTI) vulnerabilities within web applications. Use this skill when testing web applications that render dynamic content using template engines like Jinja2 (Python), Twig (PHP), Freemarker (Java), or Pug (Node.js). Covers identification via mathematical evaluation, context mapping, escaping sandboxes, and achieving Remote Code Execution (RCE).

日本語の概要は準備中です。原文の説明を表示しています。

Use when hunting Pwn Request vulnerabilities where pull_request_target workflows checkout attacker-controlled PR code and execute it in a privileged context with access to repository secrets. Trigger on: "pwn request", "pull_request_target", "checkout PR head", "npm install in CI", "lifecycle scripts in CI", "preinstall script", "postinstall script", "package.json scripts CI", "npm ci ignore-scripts false", "actions/checkout ref pull request head sha", privileged workflow running PR code, "Gato-X", supply chain via PR lifecycle scripts.

日本語の概要は準備中です。原文の説明を表示しています。

Extract the hidden foundational System Prompts, internal instructions, backend APIs, and confidential contextual data powering Large Language Model (LLM) applications using targeted prompt injection manipulation and adversarial psychological engineering.

日本語の概要は準備中です。原文の説明を表示しています。

Test Retrieval-Augmented Generation (RAG) systems for data poisoning, prompt injection via retrieved documents, and data exfiltration through manipulated context windows. Use this skill when assessing RAG-based chatbots, knowledge bases, enterprise AI assistants, or any system that augments LLM responses with external document retrieval. Covers document injection, embedding manipulation, knowledge base poisoning, and cross-document inference attacks.

日本語の概要は準備中です。原文の説明を表示しています。

RSA attack playbook for CTF and real-world cryptanalysis. Use when given RSA parameters (n, e, c) and need to recover plaintext by exploiting weak keys, small exponents, shared factors, or padding oracles.

日本語の概要は準備中です。原文の説明を表示しています。

Detects authentication and biometric bypass vulnerabilities in mobile apps (Android/iOS). Trigger on: BiometricPrompt, LocalAuthentication, LAContext, evaluatePolicy, CryptoObject, Android Keystore, Secure Enclave, kSecAccessControlBiometryCurrentSet, userAuthenticationValidityDurationSeconds, confirmCredentials, biometric fallback, PIN bypass, passive authentication, enrolled biometrics detection, Frida hook auth, jailbreak bypass, TouchID, FaceID, fingerprint. Covers MASVS-AUTH-1/2/3.

日本語の概要は準備中です。原文の説明を表示しています。

Test Model Context Protocol (MCP) servers and tool-calling systems for security vulnerabilities including tool injection, parameter manipulation, privilege escalation, and data exfiltration through AI agent tool interfaces. Use this skill when assessing MCP server implementations, AI agent tool integrations, or any system that exposes tools to language models. Covers tool confusion attacks, cross-tool exploitation, and MCP server hardening assessment.

日本語の概要は準備中です。原文の説明を表示しています。

Extract sensitive training data (PII, API keys, intellectual property, or code) directly from a deployed Large Language Model (LLM). This AI Red Teaming skill focuses on forcing models to regurgitate memorized, unredacted data from their massive internet-scraped datasets through repetition attacks, prefix continuation, and context window manipulation.

日本語の概要は準備中です。原文の説明を表示しています。

Detects sensitive data stored insecurely on mobile devices (Android/iOS). Trigger on: SharedPreferences, NSUserDefaults, SQLite, Room DB, DataStore, Core Data, Keychain misconfiguration, external storage, backup exposure, plaintext files, unencrypted databases, adb backup, iCloud backup, NSFileProtection, EncryptedSharedPreferences, SQLCipher, allowBackup, FLAG_SECURE, keyboard cache, sensitive logs. Covers MASVS-STORAGE-1 (local storage) and MASVS-STORAGE-2 (exposure to unauthorized actors).

日本語の概要は準備中です。原文の説明を表示しています。

Execute lateral movement within Active Directory environments using credential material (NTLM hashes and Kerberos tickets) instead of plaintext passwords. Use this skill when engaging in red team operations or internal network penetration tests to expand access, bypass authentication portals, and achieve Domain Dominance without relying on crackable passwords.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit weak password reset and change flows via CSRF on reset forms, cross-user password modification by swapping username parameters, token predictability in reset links, reset displaying old password in plaintext (revealing weak storage), missing current-password verification on change forms, and session hijacker lockout via passwordless change. Test with Burp Suite, OWASP ZAP following OWASP Forgot Password Cheat Sheet.

日本語の概要は準備中です。原文の説明を表示しています。

Use the H1 Brain MCP Server to pull HackerOne program policies, scope definitions, and disclosed vulnerability reports directly into Claude's context. Based on Critical Thinking Bug Bounty Podcast Episode 166.

日本語の概要は準備中です。原文の説明を表示しています。

Test Large Language Models for direct prompt injection vulnerabilities where user input overrides system instructions, extracts system prompts, bypasses safety filters, or causes unauthorized actions. Use this skill when assessing chatbots, AI assistants, LLM-powered tools, or any application that processes natural language input through an LLM. Covers role-playing attacks, instruction hierarchy exploitation, multi-turn manipulation, and context window abuse for comprehensive AI security testing.

日本語の概要は準備中です。原文の説明を表示しています。

JNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code path reaching InitialContext.lookup().

日本語の概要は準備中です。原文の説明を表示しています。

Execute a Kerberoasting attack to extract Service Principal Name (SPN) ticket hashes from Active Directory and crack them offline. This allows an attacker with any valid domain credentials to escalate privileges by obtaining the plaintext password of highly-privileged service accounts.

日本語の概要は準備中です。原文の説明を表示しています。

Test for indirect prompt injection vulnerabilities where malicious instructions are injected through external data sources (websites, emails, documents, database records) that the LLM processes. Use this skill when assessing LLM-integrated applications that process user-generated content, retrieve web pages, parse emails, or read documents. Covers injection via web content, email bodies, user profiles, and database records that are fed to LLM context.

日本語の概要は準備中です。原文の説明を表示しています。

Cross-Site Request Forgery (CSRF) tricks authenticated users into submitting forged requests to a target application by exploiting browser automatic cookie attachment. Detect via missing or predictable CSRF tokens in state-changing requests (POST/PUT/DELETE), absent `SameSite` cookie attributes, and JSON endpoints accepting `text/plain` Content-Type. Test using HTML auto-submitting forms, XHR requests, and CORS-enabled fetch. Tools: Burp Suite (Generate CSRF PoC), OWASP ZAP.

日本語の概要は準備中です。原文の説明を表示しています。

DNS rebinding attack playbook. Use when testing applications that trust DNS resolution for origin checks, interact with internal services from browser context, or when SSRF is not possible server-side but the target has client-side fetch/XHR to attacker-controlled domains.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit Active Directory environments using AS-REP Roasting. This skill details how to identify user accounts with the 'Do not require Kerberos preauthentication' (DONT_REQ_PREAUTH) attribute set, request their AS-REP tickes without a password, and crack the encrypted component offline to recover plaintext credentials.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit Active Directory environments using Pass-the-Hash (PtH). This skill details how to authenticate to remote systems using the NTLM hash of a user's password instead of the plaintext password, enabling lateral movement and privilege escalation without cracking hashes.

日本語の概要は準備中です。原文の説明を表示しています。

Systematically extract hidden system prompts, core directives, and invisible context intentionally concealed within Large Language Model (LLM) applications. This skill utilizes targeted linguistic engineering and boundary manipulation to bypass prompt opacity.

日本語の概要は準備中です。原文の説明を表示しています。

This repo is indexed by graft/. For ANY task here, whether understanding how something works, finding where code lives, tracing what calls a symbol or what a change breaks, or scoping an edit, get your context from graft before grepping or reading source files.

日本語の概要は準備中です。原文の説明を表示しています。

Firecrawl gives AI agents and apps fast, reliable web context with strong search, scraping, and interaction tools. One install command sets up three skill segments: live CLI tools, app-integration build skills, and outcome-focused workflow skills. Route the reader to the right usage path after install.

日本語の概要は準備中です。原文の説明を表示しています。