8,152 件 ・ 関連度順
概要と使いどころ
Maintain this repository's Mintlify documentation from uploaded Markdown files. Use when asked to add, update, or organize docs pages in `docs/`, place new content under `get_started`, `core`, `core/models`, or `troubleshooting`, and keep `docs/docs.json` navigation in sync with new pages.
日本語の概要は準備中です。原文の説明を表示しています。
Toolkit for styling artifacts with a theme. These artifacts can be slides, docs, reportings, HTML landing pages, etc. There are 10 pre-set themes with colors/fonts that you can apply to any artifact that has been creating, or can generate a new theme on-the-fly.
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill any time a spreadsheet file is the primary input or output. This means any task where the user wants to: open, read, edit, or fix an existing .xlsx, .xlsm, .csv, or .tsv file (e.g., adding columns, computing formulas, formatting, charting, cleaning messy data); create a new spreadsheet from scratch or from other data sources; or convert between tabular file formats. Trigger especially when the user references a spreadsheet file by name or path — even casually (like "the xlsx in my downloads") — and wants something done to it or produced from it. Also trigger for cleaning or restructuring messy tabular data files (malformed rows, misplaced headers, junk data) into proper spreadsheets. The deliverable must be a spreadsheet file. Do NOT trigger when the primary deliverable is a Word document, HTML report, standalone Python script, database pipeline, or Google Sheets API integration, even if tabular data is involved.
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files). Triggers include: any mention of 'Word doc', 'word document', '.docx', or requests to produce professional documents with formatting like tables of contents, headings, page numbers, or letterheads. Also use when extracting or reorganizing content from .docx files, inserting or replacing images in documents, performing find-and-replace in Word files, working with tracked changes or comments, or converting content into a polished Word document. If the user asks for a 'report', 'memo', 'letter', 'template', or similar deliverable as a Word or .docx file, use this skill. Do NOT use for PDFs, spreadsheets, Google Docs, or general coding tasks unrelated to document generation.
日本語の概要は準備中です。原文の説明を表示しています。
Procedure for controlled, human-gated outbound README badge provisioning PRs (Issue #1817). Preflights upstream repositories, ensures single-badge placement with deep links, and records campaign outcomes without automated retries or multi-badge noise.
日本語の概要は準備中です。原文の説明を表示しています。
Broad, pre-curation evidence reconnaissance for a declared Gaia skill, intake batch, upstream repository, or proposed generic capability. Run before choosing a discovery strategy or mapping topology, to give the curator independent research leads and counterevidence. Context only: never scores, grades, ratifies, ingests, or mutates the registry. Later ev-discovery and ev-pipeline phases validate/promote any selected leads.
日本語の概要は準備中です。原文の説明を表示しています。
Re-read pinned on-chain facts and watch documentary source fingerprints behind failure scenarios monthly, reporting drift without approving or changing scenario records automatically.
日本語の概要は準備中です。原文の説明を表示しています。
Review a PR or the current branch for a Lumen design-system change — routes each changed file to React (web/Tailwind) or React Native (useStyleSheet) guidelines, checks the Nx version plan, and reports a flat, severity-scored finding list. Use when the user asks to review a PR, review code changes, check a branch, do a local code review, or provides a GitHub PR URL.
日本語の概要は準備中です。原文の説明を表示しています。
Generates CVE request packages from pentest findings. Reads cve-candidates.json (auto-generated at pentest completion) or findings.json directly, then produces for each qualifying vulnerability: MITRE CVE form data, GitHub Security Advisory draft, full disclosure report, and vendor notification email. Invoke manually after a pentest engagement when you have true-positive findings that warrant CVE IDs.
日本語の概要は準備中です。原文の説明を表示しています。
SQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execution paths.
日本語の概要は準備中です。原文の説明を表示しています。
Server-Side Request Forgery (SSRF) occurs when user-controlled input is used to construct URLs that the server fetches, enabling access to internal services, cloud metadata endpoints (169.254.169.254), and local files via `file://` scheme. Detect via parameters accepting URLs or hostnames, PDF/report generators rendering `<iframe>/<img>/<script>`, and blind SSRF via out-of-band DNS callbacks. Bypass filters using IP decimal/octal/hex encoding, URL-userinfo tricks, and URL fragments. Tools: Burp Collaborator, curl.
日本語の概要は準備中です。原文の説明を表示しています。
Use when hunting Pwn Request vulnerabilities where pull_request_target workflows checkout attacker-controlled PR code and execute it in a privileged context with access to repository secrets. Trigger on: "pwn request", "pull_request_target", "checkout PR head", "npm install in CI", "lifecycle scripts in CI", "preinstall script", "postinstall script", "package.json scripts CI", "npm ci ignore-scripts false", "actions/checkout ref pull request head sha", privileged workflow running PR code, "Gato-X", supply chain via PR lifecycle scripts.
日本語の概要は準備中です。原文の説明を表示しています。
Identify Open Redirect vulnerabilities where applications route users to arbitrary external URLs based on unvalidated input. Prove maximum impact by chaining Open Redirects with OAuth token theft, SSRF, or Phishing, graduating this typically low-risk finding into a high-severity report.
日本語の概要は準備中です。原文の説明を表示しています。
Full penetration test using MCP tools — recon, scanning, exploitation, and reporting. Tailored for OpenCode (BYO LLM). Supports network/web targets and local codebases. Chains into analyze-cve, threat-modeling, and remediate skills automatically.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit vulnerabilities in the AI Supply Chain by injecting malicious models, datasets, or dependencies. Use this skill to simulate advanced persistent threats (APTs) compromising Hugging Face repositories, manipulating pre-trained weights (Model Poisoning), and exploiting insecure deserialization during model loading (e.g., Pickle files).
日本語の概要は準備中です。原文の説明を表示しています。
CSV/spreadsheet formula injection (DDE, Excel/LibreOffice, Google Sheets IMPORT*). Use when exports, imports, or user fields feed spreadsheets or reporting tools.
日本語の概要は準備中です。原文の説明を表示しています。
Formats all confirmed pentest findings from findings.json into copy-pasteable GitHub issue markdown blocks, following the AppSec reporting guide template.
日本語の概要は準備中です。原文の説明を表示しています。
Full ASVS 5.0 compliance assessment against a codebase and/or architecture diagrams. Reads all 346 controls from the companion CSV, performs targeted code analysis per control, and produces a complete matrix marked COMPLIANT / NON_COMPLIANT / NOT_RELEVANT — with per-control reasoning and evidence (code snippets, file:line references, diagram observations). Outputs a reviewed CSV matrix and a self-contained HTML evidence report.
日本語の概要は準備中です。原文の説明を表示しています。
Triages an Aikido security findings CSV against a local codebase. For each finding, reads the flagged file, traces the code path, and verdicts it as KEEP OPEN or CLOSE with a specific reason. Outputs a reviewed CSV and a self-contained HTML evidence report. Run this at the end of a pentest when an Aikido CSV is available.
日本語の概要は準備中です。原文の説明を表示しています。
Toggle the badges-page Honesty Mode build-time flag on or off. ON makes the README badge generator emit direct /badges/_assets/<handle>/<file>.svg URLs (no Cloudflare Worker, no ?repo= validation). OFF restores worker-validated URLs. Use when the user says "/honesty-mode on", "/honesty-mode off", "turn honesty mode on/off", or asks for the current honesty-mode state.
日本語の概要は準備中です。原文の説明を表示しています。
Publish a new post (announcement, link, or LaTeX-style meta report) to the Gaia site. Use when you want to add any update to the registry's public feed and landing page.
日本語の概要は準備中です。原文の説明を表示しています。
Chart a too-big effort as a shared map of decision tickets on the Gaia headquarters issue tracker, then resolve them one at a time until the way to the destination is clear. Use when someone says: "this is too big for one session", "chart a map", "wayfinder map", "plan this effort", "what do we need to decide first", "open a wayfinder", "work the map", "what's on the frontier", or /wayfinder. Covers any gaia-research org repo — gaia-skill-tree, gaia-research, gaia-skill-heaven and beyond — but every map and every ticket lives on ONE tracker: gaia-research/gaia-skill-tree. This is cartography (planning an effort as decisions), NOT triage of an existing backlog — for that use /gaia-triage.
日本語の概要は準備中です。原文の説明を表示しています。
Dry-run Trust Magnitude for proposed named skills or suites before curation. Use when deciding whether a proposed suite deserves A/S treatment, when checking Fusion Score structural inputs, when comparing repo stars vs suite component counts, or when asked to appraise a candidate before adding it to the registry.
日本語の概要は準備中です。原文の説明を表示しています。
Consult this skill BEFORE proposing a fix to any CLI gap or schema gap that touches evidence, trust magnitude, evidence types, evidence grades, the TM formula, or star-level promotion gates. Also read it whenever an issue mentions citations, stars, commits, contributors, views, reviewers, percentile, arxiv, github-stars-own, repo-own, social-signal, benchmark-result, peer-review, self-attestation, fusion-recipe, verifier-attestation, or proxy-containment — those are the 10 canonical evidence types and the raw inputs that feed their formulas. Also read it when asked whether a skill qualifies for a given star level (0★–6★): the Star Bar and promotion gates live in `META.md`, not in the TM methodology page. Reading both prevents proposing a calibration that satisfies the TM grade threshold but violates a Star Bar installability or link requirement.
日本語の概要は準備中です。原文の説明を表示しています。