8,315 件 ・ 関連度順
概要と使いどころ
Entry P0 primary router for HackSkills. Use when the task involves web application testing, API security assessment, recon, vulnerability triage, exploit path planning, or choosing the right next category skill before any deep topic skill.
日本語の概要は準備中です。原文の説明を表示しています。
Use when the user wants to extract reusable offensive security knowledge from any source and generate a SKILL.md file. Trigger on: "distill this", "extract skill from", "turn this into a skill", "generate skill from", "convert this report/blog/book/walkthrough into a skill", or when the user pastes raw security content (bug report, pentest report, CTF writeup, blog post, ezine, book chapter) and wants it transformed into structured hunting methodology.
日本語の概要は準備中です。原文の説明を表示しています。
Writes professional bug bounty reports for HackerOne, Bugcrowd, and Intigriti with CVSS 4.0 scoring, business impact, working exploits, and remediation. Runs 5-check Pre-Report Verification first: hallucination detection, AI writing patterns, PoC reproducibility, duplicate detection, and impact plausibility. Use when user describes a vulnerability, shares HTTP logs, HAR files, recon output, or screenshots; says 'write a bug report', 'format my finding', 'draft a vuln report', 'is this valid', 'rate my vulnerability', 'verify my report', or any variant. Trigger for partial or messy input — raw notes, one-liners, or full writeups all work. Do not wait for perfect input.
日本語の概要は準備中です。原文の説明を表示しています。
Execute a DCSync attack mimicking the behavior of a legitimate Active Directory Domain Controller (DC). Leverage Directory Replication Service Remote Protocol (DRSR) permissions to silently request and extract the password hashes (NTLM/Kerberos) of any or all users in the domain without executing code on the target Domain Controller.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit flaws in API rate limiting enforcement. Use this skill when encountering HTTP 429 Too Many Requests errors during password brute-forcing, OTP validation, credential stuffing, or enumeration attacks. These bypasses leverage IP spoofing, parameter manipulation, and edge-case application logic.
日本語の概要は準備中です。原文の説明を表示しています。
Bug bounty findings secretary, tracker, and workspace initializer for the bb-huge portal. Use this skill for web security research, vulnerability hunting, and hunt workspace setup. Triggers on: "log finding", "save finding", "add to bb-huge", "record vulnerability", "update finding", "show findings", "bb-huge stats", "mark as confirmed", "mark as rewarded", "setup workspace", "pull evidence", "continue working on finding", "dump attachments", "list my skills", "what skills do I have", "/bb-huge init", "init hunt workspace", "new bug bounty program", "start hunting", "mobile bug bounty", "binary analysis", "source code review", "white-box audit", "h1-brain", "hack program", "hack()", "search disclosed", "fetch rewarded". Also auto-activates whenever a vulnerability is discovered during any recon, fuzzing, or manual testing session — do not wait to be asked.
日本語の概要は準備中です。原文の説明を表示しています。
Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.
日本語の概要は準備中です。原文の説明を表示しています。
Entry P1 category router for authentication and authorization. Use when testing login flows, sessions, object authorization, JWT, OAuth, CORS, CSRF, and enterprise SSO weaknesses before any deeper auth topic skill.
日本語の概要は準備中です。原文の説明を表示しています。
Chart a too-big effort as a shared map of decision tickets on the Gaia headquarters issue tracker, then resolve them one at a time until the way to the destination is clear. Use when someone says: "this is too big for one session", "chart a map", "wayfinder map", "plan this effort", "what do we need to decide first", "open a wayfinder", "work the map", "what's on the frontier", or /wayfinder. Covers any gaia-research org repo — gaia-skill-tree, gaia-research, gaia-skill-heaven and beyond — but every map and every ticket lives on ONE tracker: gaia-research/gaia-skill-tree. This is cartography (planning an effort as decisions), NOT triage of an existing backlog — for that use /gaia-triage.
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill when the user wants to turn code graph analysis into tracked GitHub issues — "audit the architecture", "find god nodes", "triage architectural debt", "run graphify and log issues", "what's over-coupled in this codebase", "create issues from graphify findings", "check for structural problems", "scan for architectural smells", or any request that combines codebase topology analysis with issue tracking. This skill runs graphify to build a dependency graph, parses GRAPH_REPORT.md for god nodes and structural patterns, converts findings into GitHub issue payloads, and optionally pushes them to the repo. It bridges static analysis and project management in a single automated pass. Requires graphify and gh CLI.
日本語の概要は準備中です。原文の説明を表示しています。
Consult this skill BEFORE proposing a fix to any CLI gap or schema gap that touches evidence, trust magnitude, evidence types, evidence grades, the TM formula, or star-level promotion gates. Also read it whenever an issue mentions citations, stars, commits, contributors, views, reviewers, percentile, arxiv, github-stars-own, repo-own, social-signal, benchmark-result, peer-review, self-attestation, fusion-recipe, verifier-attestation, or proxy-containment — those are the 10 canonical evidence types and the raw inputs that feed their formulas. Also read it when asked whether a skill qualifies for a given star level (0★–6★): the Star Bar and promotion gates live in `META.md`, not in the TM methodology page. Reading both prevents proposing a calibration that satisfies the TM grade threshold but violates a Star Bar installability or link requirement.
日本語の概要は準備中です。原文の説明を表示しています。
Interview the user relentlessly about a plan or design. Use when the user wants to stress-test a plan before building, or uses any 'grill' trigger phrases.
日本語の概要は準備中です。原文の説明を表示しています。
This repo is indexed by graft/. For ANY task here, whether understanding how something works, finding where code lives, tracing what calls a symbol or what a change breaks, or scoping an edit, get your context from graft before grepping or reading source files.
日本語の概要は準備中です。原文の説明を表示しています。
Publish a new post (announcement, link, or LaTeX-style meta report) to the Gaia site. Use when you want to add any update to the registry's public feed and landing page.
日本語の概要は準備中です。原文の説明を表示しています。
Founder orchestrator persona for Marcus Tiongson's gaia-skill-tree sessions. Activates the planner-and-delegator role defined in founder/ORCHESTRATOR.md — thinking partner, session steward, subagent spawner. Use at the start of any founder-mode work session on this repo.
日本語の概要は準備中です。原文の説明を表示しています。
Reference guide for the full manual Gaia curation pipeline. Invoke at any phase when unsure what command to type next: gaia-curate, L4 review, gaia push, ev-pipeline (Phases 0–4), gaia-ingest, or close. Trigger phrases: "/gaia-consult", "what's the command for", "remind me how to", "I'm lost in the pipeline", "what do I do next", "consult the pipeline doc", "pipeline reference".
日本語の概要は準備中です。原文の説明を表示しています。
Orchestrate a whole-registry sweep of Gaia — fan out 13 parallel audit agents across every skill, run adversarial verification, surface Semantic Fusion candidates, propose new generic skill references, and synthesize a publish-ready HTML report under docs/meta/reports/. Use this skill for broad, systemic analysis across many skills at once: "run a meta sweep", "sweep the meta", "full meta audit", "audit the whole registry against META.md", "widespread nomenclature issues", "find all skills missing a GitHub link", "produce a meta report", "check for evidence type mismatches across the registry", "find skills that document a third-party tool with no attribution", or explicitly types /gaia-meta-sweep. This is the registry-wide macro companion to /gaia-meta-audit (a prioritized queue, single-pass) and /gaia-audit (fixes one skill). Use it when you need the full surface — 13 audit dimensions, adversarial verification, fusion proposals, and a durable findings artifact — not just a queue.
日本語の概要は準備中です。原文の説明を表示しています。
Canonical entry point for the full Gaia evidence verification pipeline. Invoke as /evidence-verification-pipeline or /ev-pipeline — both names trigger this skill. Use whenever you need to run the evidence phases end-to-end: collecting raw evidence from the data lake, verifying live GitHub star counts, running Phase 2B benchmark-source verification, running adversarial auditing for noise and URL errors, and checking link health via Firecrawl. Also use when someone says "run the evidence pipeline", "verify the evidence lake", "audit evidence", "run ev-pipeline", "full evidence check", "pipeline run", "prepare evidence for ingestion", or "refresh the data lake". This is the pre-ingestion step — run it before importing any evidence into the registry.
日本語の概要は準備中です。原文の説明を表示しています。
Generate a prioritized review queue of registry skills and catalog items that need attention. Use this skill whenever someone asks: "what needs review?", "what's overdue for audit?", "where are the weak spots in the registry?", "what should I audit next?", "run a health check on the registry", "show me flagged skills", "find problems in the registry", "what skills need fixing?", or "triage the registry". This is the triage layer — it surfaces candidates ranked P0–P4 so that focused work (via /gaia-audit) targets the right things first. Run this before any audit pass. Also invoke proactively when a PR changes registry/named/ at scale, or before a release, to catch regressions early.
日本語の概要は準備中です。原文の説明を表示しています。
End-to-end plan → implement → review pipeline that takes one triaged Gaia issue to a merged-ready PR, with Kill Criteria on the issue and zero follow-up debt. Use when someone says: "resolve this issue", "take #N end-to-end", "work the P0 queue", "fix and ship this issue", "run the resolver", "close out this issue properly", or /gaia-issue-resolver. Works any gaia-research org repo — gaia-skill-tree, gaia-research, gaia-skill-heaven — while the issue itself lives on the headquarters tracker, gaia-research/gaia-skill-tree. Assumes the issue is already triaged and carries a P0–P4 label; if it does not, run /gaia-triage first.
日本語の概要は準備中です。原文の説明を表示しています。
Audit and repair Gaia user-tree timelines so every skill's current rank is explained by a chain of Hero's Journey events. Trigger this skill when: a contributor's profile chart shows a stale rank (e.g. still shows 3★ after a demotion to 1★); someone asks to "trace what happened" to a skill's rank; `validate_timelines.py` is failing in CI; you need to backfill missing `demote` or `rank_up` events before cutting a release; a skill was reclassified or Star-Bar-reset and the user tree was never updated; or any time the registry node and user tree disagree on a skill's current level. Uses `scripts/trace_timeline.py` (dry-run + apply) and `scripts/validate_timelines.py` (CI gate). Do NOT hand-edit `timeline[]` arrays — the script synthesises properly labelled events with `previousValue`/`newValue` so the rank chart plots correctly.
日本語の概要は準備中です。原文の説明を表示しています。
Pick up one bounded Gaia Steward maintenance dispatch, do exactly it, and hand the result back for independent verification. Use when the user says "check the steward lane", "pick up maintenance work", "is there anything for me to fix", "run the steward lane", "/gaia-steward-lane", or when a scheduled routine wakes you with no other instruction. Also use before starting speculative repository cleanup: if Steward has not found the work, the work probably does not exist.
日本語の概要は準備中です。原文の説明を表示しています。
Run this skill for Phase 3 of the evidence verification pipeline — the adversarial audit step. Use when you need to check the evidence data lake for bad data before ingestion: dead links, wrong URL formats (tree/ vs blob/), subjective wording ("elite", "high-quality"), stale migration notes, benchmark catalog misuse/vendor-claim leakage, or skills whose star evidence conflicts with classified evidence level. Triggers on phrases like: "audit the data lake", "adversarial check", "ev-adversarial-audit", "check for noise in evidence", "flag bad evidence", "run the audit phase", "quality check the by-type files", or any reference to Phase 3 of the pipeline.
日本語の概要は準備中です。原文の説明を表示しています。
Post-review intake closing skill. After an intake is resolved (whether accepted via review/meta PR merge or rejected/deferred at triage/evidence review), run this skill to post standardized, personalized closing comments on the PR (if any) and each intake issue. Comments include: evidence pipeline findings with /trust-appraise TM output, per-row artifact scores, decisions rationale, path-to-promotion/acceptance guidance, and a mandatory badge status note including the universal Powered by Gaia badge. Use after curation completes, before or immediately after merge for accepted intakes, or immediately upon rejection.
日本語の概要は準備中です。原文の説明を表示しています。