「ref」の検索結果

Deep OAuth 2.0 / OpenID Connect security assessment. Covers the full attack surface: redirect_uri validation bypass (path traversal, open redirect chains, subdomain confusion, URL parsing tricks, parameter pollution, response mode switching), missing/broken state parameter CSRF, PKCE downgrade and absent-challenge attacks, implicit grant token leakage (Referer, browser history, XSS fragment theft), authorization code injection, scope escalation, client confusion attacks, mutable-claims account takeover (iss+sub confusion, email-keyed identity merging), pre-account takeover via unverified registration, OpenID Connect dynamic client registration SSRF (logo_uri, jwks_uri, sector_identifier_uri, request_uri), nonce replay, ID token validation failures, Device Code phishing flow, mobile custom URI scheme hijacking, refresh token persistence, token introspection enumeration, consent screen clickjacking, host header injection, and cross-IdP mix-up attacks. Uses KOAuth, jwt_tool, nuclei oauth templates, and manual http(action="request", ...) payloads. Every technique includes actual request payloads and verification logic. Chains from /pentester or /api-security when OAuth endpoints are discovered. Chains into /web-exploit for open redirect, XSS, and SSRF chaining. Chains into /post-exploit when full account takeover is achieved. Chains into /credential-audit when access tokens or refresh tokens are recovered.

日本語の概要は準備中です。原文の説明を表示しています。

DOM-based XSS occurs when JavaScript reads attacker-controlled sources (`location.hash`, `document.referrer`, `window.name`, `location.search`) and passes them to dangerous sinks (`document.write`, `innerHTML`, `eval`, `location.href`, `setTimeout`, `jQuery.html()`) without sanitization. Unlike reflected/stored XSS, payloads never reach the server. Detect by auditing JavaScript for tainted data flow from DOM sources to sinks. Tools: Burp Suite DOM Invader, Chrome DevTools, DOMPurify (fix).

日本語の概要は準備中です。原文の説明を表示しています。

Use when hunting Broken Object Level Authorization (BOLA) or Insecure Direct Object Reference (IDOR) vulnerabilities in APIs or web applications. Trigger on: "BOLA", "IDOR", "broken object level", "access other users", "object reference", numeric or UUID IDs in URLs or request bodies, user-scoped resources, horizontal privilege escalation, "change the ID in the request", second-order IDOR, blind IDOR, indirect reference, encoded ID, deprecated API version, JSON globbing.

日本語の概要は準備中です。原文の説明を表示しています。

UI design and implementation for real product surfaces with taste-first critique, reference routing, project-specific design briefs, variation comparison, and implementation verification. Use when Codex should redesign, build, polish, or critique frontend UI by reading project context, exploring taste, routing through `references/catalog.md`, synthesizing `PROJECT_DESIGN.md` or `design.md`, using investment gates to avoid wrong taste/reference/scope, implementing in the existing stack, and evaluating whether the result is actually better. Best for app screens, dashboards, landing pages, query tools, product surfaces, and design explorations; not for backend-only work or tiny cosmetic edits.

日本語の概要は準備中です。原文の説明を表示しています。

安全重构代码技能。当用户明确提到"重构"、"代码异味"或需要在TDD循环的Refactor阶段改进代码内部结构时使用。 **仅在以下场景触发**： - 用户明确说"重构这段代码" - 提到"代码异味"并要求改进 - TDD循环中的Refactor阶段 - 代码审查中需要改进内部结构但不改变功能 **注意**：如果用户只是说"优化"、"改进"或"提升性能"，不应该触发此技能，除非明确提到"重构"。

日本語の概要は準備中です。原文の説明を表示しています。

This skill provides expert-level guidance for refactoring VS Code extension code. Use when extracting classes or functions, reducing code duplication, improving type safety, reorganizing module structure, applying design patterns, or optimizing performance. Covers systematic refactoring workflows, code smell detection, safe transformation techniques, and VS Code-specific patterns.

日本語の概要は準備中です。原文の説明を表示しています。

Product marketing and go-to-market strategy for B2B SaaS launches and positioning. Use this skill when planning a product launch, developing positioning and messaging, analyzing competitive landscape, building customer advocacy programs, designing a customer referral program (who may accept the reward, how the introduction is made), designing a win/loss interview program, working out why we lose deals, designing GTM strategy, creating category positioning, planning analyst briefings, or deciding which country to expand into and how far to localize. Also use it for an early-stage startup where the founder is still doing the selling — running founder-led sales, setting up a design-partner program, judging whether you have product-market fit, deciding what not to do yet, deciding when to hire the first AE or first marketer, and moving upmarket to larger buyers. Also use it when your company has just acquired another (or is about to), to plan the marketing integration: what you may and may not do between signing and close, the first letter to the acquired customers, whether to keep, endorse, fold in or retire the acquired brand, merging the two marketing databases without mailing people who opted out, when to start cross-selling, and announcing a product sunset. Also use it to design a demand-generation campaign and the channel plan it runs on: one campaign with one job, the offer for buyers who are and are not in market, what each channel is for, the kill and scale rules set before launch, the follow-up sales agrees to, the yearly calendar of always-on programs and tentpole campaigns, and which channels to keep, test or stop. Also use it for brand marketing and demand creation — how much to spend on brand versus performance, what to measure when a brand campaign produces no conversion event, and how to answer "we cannot attribute it". Also triggers on: founder-led sales, founder-led GTM, design partners, design partner agreement, first customers, first 10 customers, do we have product-market fit, PMF, Sean Ellis test, very disappointed survey, pre-seed, seed stage, when to hire our first AE, first sales hire, first marketing hire, moving upmarket, going upmarket, enterprise readiness, first enterprise deal, what do enterprise buyers need before they sign, positioning, product launch, beta program, early access program, design partners, private preview, public preview, general availability, GA launch, when can we call it GA, can sales sell a beta feature, selling the roadmap, launch tier, competitive intelligence, messaging, customer advocacy, win/loss analysis, win/loss interviews, why we lose deals, closed-lost analysis, loss reason, close-reason field, competitive displacement, displace an incumbent, rip and replace, competitive takeout, switch from a competitor, win deals from a competitor, incumbent contract, renewal window, auto-renewal notice period, switching costs, EU Data Act, cloud switching rights, why do we lose to no decision, GTM, category design, ideal customer profile, ICP, what is our real ICP, who actually buys from us, refresh our ICP from closed-won deals, ICP refresh before planning, analyst briefing, G2 review, international expansion, market entry, expand into Europe, which country should we launch in next, localization, translate our site, in-country go-to-market, regional GTM, is cold email legal in Germany, brand marketing, brand awareness, brand vs performance, brand versus demand gen, demand creation, demand capture, 95-5 rule, out of market buyers, category entry points, distinctive brand assets, mental availability, brand tracking, brand health, brand lift, share of search, how do we measure brand, justify brand spend, brand budget. Also triggers on public-sector marketing: sell to government, government marketing, public sector go-to-market, federal marketing, state and local government, SLED, FedRAMP, FedRAMP marketing claims, can we say FedRAMP ready, GovRAMP, StateRAMP, VPAT, accessibility confor

日本語の概要は準備中です。原文の説明を表示しています。

Convert between LaTeX and Microsoft Word for academic manuscripts in either direction, and assemble .tex from mixed sources. Fires on: converting .tex/LaTeX to Word/.docx ("tex to docx", "latex to word", "tex2docx", "convert to word", "pandoc convert"); converting .docx manuscripts to LaTeX for editing and back ("convert to latex", "manuscript", "footnotes", "reference doc", the docx-to-tex-to-docx round-trip / academic paper editing pipeline); high-fidelity delivery where plain pandoc loses tables, mangles cross-references, or fails on custom macros — booktabs/regression tables, OMML equations, cleveref, \estauto, \@@input, \thanks, TikZ, native Word tables, longtable, siunitx; and building .tex from mixed PDF/docx/LLM-generated sources. Replaces and reroutes the retired skills manuscript-editing-template-latex, latex-to-docx-fidelity, tex2docx, and latex-from-mixed-sources.

日本語の概要は準備中です。原文の説明を表示しています。

Instantiates prefab in the current active scene. Use 'assets-find' tool to find prefab assets in the project.

日本語の概要は準備中です。原文の説明を表示しています。

Create a prefab from a GameObject in the current active scene. The prefab will be saved in the project assets at the specified path. Use 'gameobject-find' tool to find the target GameObject first.

日本語の概要は準備中です。原文の説明を表示しています。

Use when behavior-preserving frontend refactoring focuses on variable meaning, field naming, derived state, or reference/value identity, and the selected technique needs family-specific mechanics, risks, and JavaScript/TypeScript/React/Vue adaptation.

日本語の概要は準備中です。原文の説明を表示しています。

Detect drift in .arkhe/roadmap/ context files and regenerate them from the current codebase state. Scaffolds context directory if missing. Use when user runs /roadmap:refresh, mentions "refresh context", "update context", "init roadmap", "stale context", or "scaffold roadmap".

日本語の概要は準備中です。原文の説明を表示しています。

Check Spring Boot skill content freshness against latest research and flag skills needing updates. Use when running /spring-refresh, or when user mentions "refresh spring skills", "spring boot update check", "skill freshness", "stale spring content", "update spring boot skills".

日本語の概要は準備中です。原文の説明を表示しています。

Detect documentation drift, stale references, and cross-document inconsistencies in any project. Scans for code-doc drift (API/function changes not reflected in docs), cross-doc drift (conflicting information across documents), and stale references (broken links, deleted files, outdated versions). Use when checking "doc freshness", "stale docs", "documentation drift", "broken links", "outdated documentation", "doc accuracy", "docs out of date", "doc audit", "doc health", or "verify documentation".

日本語の概要は準備中です。原文の説明を表示しています。

Sync official Anthropic documentation and analyze impact on project components. Runs docs/reference/update-claude-docs.sh, computes diffs, and reports impacts on the skill validator, plugins, and project documentation. Use when user mentions "sync docs", "update reference docs", "refresh docs", or "check doc changes".

日本語の概要は準備中です。原文の説明を表示しています。

Comprehensive SEO analysis for any website or business type. Orchestrates 52 sub-skills (52 active): full site audits, technical SEO (CWV/INP), schema, E-E-A-T content quality, images, sitemaps, GEO for AI Overviews, llms.txt generation, AI crawler audit, plus live GSC and Ahrefs MCP data. GSC: overview, drops, opportunities, brand-vs-nonbrand, cannibalization, compare, content-decay, index-issues, new-keywords. Ahrefs: overview, backlinks, keywords, competitors, content-gap, broken-links, new-links, anchor-analysis, dr-history, top-pages. Cross-MCP: serp, content-brief, brand-radar, site-audit-pro, report. Local: log-analysis, ai-content-check, internal-links, local, migration-check, obsidian-kb. AI Readability: llms-txt, robots-ai. Performance: lighthouse-audit, core-web-vitals, page-experience. Quality & AI Search: rich-results, ai-optimization, eeat-audit, helpful-content. Triggers on: "SEO", "audit", "schema", "Core Web Vitals", "sitemap", "E-E-A-T", "AI Overviews", "GEO", "technical SEO", "content quality", "structured data", "GSC", "Ahrefs", "backlinks", "keywords", "search console", "domain rating", "local SEO", "migration", "lighthouse", "pagespeed", "LCP", "INP", "CLS", "page experience", "interstitials", "mobile friendly", "rich results", "rich snippets", "schema eligibility", "AI optimization", "AI search readiness", "EEAT", "trust signals", "helpful content", "people-first", "content quality gate".

日本語の概要は準備中です。原文の説明を表示しています。

Get a domain's top organic keyword rankings from Ahrefs: keyword, position, search volume, CPC, estimated traffic, and traffic share. Use when user says "Ahrefs keywords", "organic keywords", "keyword rankings", "what keywords rank", or "ranking keywords".

日本語の概要は準備中です。原文の説明を表示しています。

Discover a domain's top organic competitors from Ahrefs: competing domains, keyword overlap count, shared keywords, and unique competitor keywords. Use when user says "Ahrefs competitors", "organic competitors", "competing domains", "keyword overlap", or "who competes with".

日本語の概要は準備中です。原文の説明を表示しています。

UI/UX design agent for crafting user experiences, visual designs, and game interfaces. Auto-detects the designer role (UX Designer, UI Designer, Game UI Designer) and spawns a role-scoped sub-agent with only the relevant reference files. Triggers on phrases like "user flow", "wireframe", "design system", "design tokens", "accessibility", "WCAG", "UI pattern", "HUD", "game menu", "inventory UI", "minimap". Full per-role triggers in references/roles/.

日本語の概要は準備中です。原文の説明を表示しています。

Sync the yaah marketing website (website/index.html) with the current project state — features, CLI commands, skills, agents, hooks, and installation instructions. Use this skill whenever the user adds, removes, or changes a feature, CLI command, hook, skill, agent, MCP server, or LSP provider AND the website should reflect that change. Also use when the user explicitly asks to update, sync, or refresh the website, or says things like 'update the site', 'keep the website current', 'reflect this on the website', or 'the website is out of date'.

日本語の概要は準備中です。原文の説明を表示しています。

Refresh Claude Ads platform, API, policy, regulation, benchmark, issue, pull-request, fork, and repository evidence. Use for ads research refresh, expired refresh_due dates, stale API or platform claims, reverify-or-demote decisions, release-current claim validation, ecosystem review, current platform changes, or updating paid-media knowledge. When tools or sources are unavailable, still demote the stale claim for the current run and block dependent release-current assertions before requesting access.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when designing, generating an MVP blueprint for, auditing, troubleshooting, refactoring, or explaining an agentic harness for any domain. Covers provider-neutral agent architecture for OpenAI, Anthropic, and OpenAI-compatible APIs: agent loops, tool design, record provenance, interactive presentation, user-memory lifecycles, environment-adaptive tools, speculative tool execution, late-bound capabilities, permissions, system prompts, planning, goals, always-on agents and durable runtime, adaptive agent teams, context compaction, memory, skills, MCP/external connectors, public-board communications, realtime voice agents, hardware agents and board deployment, self-refining recursive harnesses, programmable context, continual refinement, observability, evals, prompt caching, agent-legible environments, feedback loops, and safety.

日本語の概要は準備中です。原文の説明を表示しています。

Implement and debug OAuth 2.0 DPoP (RFC 9449) refresh token sender-constraining for WebCrypto, Node.js ES6, and browser runtimes integrating with Google's OAuth platform. Use when configuring non-extractable asymmetric key pairs (P-256), generating DPoP Proof JWTs for authorization code exchange and token refresh, or handling 400 use_dpop_nonce challenge retry loops at oauth2.googleapis.com/token. Don't use for unconstrained OAuth 2.0 flows (where refresh tokens are not bound to a client key pair), or for Google Cloud IAM / service account authentication.

日本語の概要は準備中です。原文の説明を表示しています。

Rename Pharo methods safely through Genie's `rename_method` MCP refactoring tool. Use when a selector should be renamed while preserving behavior, updating senders and symbol references across the live image, including as one step in larger refactorings such as clarify API names, split responsibilities, or move behavior behind better messages.

日本語の概要は準備中です。原文の説明を表示しています。