2,974 件 ・ 関連度順
概要と使いどころ
Investigate a GitHub issue by fetching details, analyzing the codebase, researching documentation, and presenting an actionable implementation plan with test guidance. Use when asked to investigate, analyze, triage, or plan work for a GitHub issue. Invoked with /investigate-issue <ISSUE_ID> or /investigate-issue (prompts for ID).
日本語の概要は準備中です。原文の説明を表示しています。
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.
日本語の概要は準備中です。原文の説明を表示しています。
Triages a repository's open GitHub issues and pull requests via the gh CLI. Optionally reviews and merges ready PRs — incrementally merging passing automated/bot PRs and maintainer-approved ones, and spawning review subagents for never-reviewed ones — then closes already-resolved issues with comments citing the resolving PR or commit, cross-links issues with their pending fix PRs, and assigns local-only priority and change-size estimates for everything outstanding. Use when triaging, grooming, or reviewing a repository's open issues and PRs.
日本語の概要は準備中です。原文の説明を表示しています。
Comprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script console remote code execution, Java remoting deserialization, credential store dumping, shared library injection), GitLab CI exploitation (YAML anchor injection, runner registration token abuse, CI variable extraction, protected branch bypass via merge request pipelines), and Azure DevOps pipeline agent compromise with service connection theft. Includes artifact poisoning techniques across all platforms, tooling guidance for gato and jenkins-attack-framework, and maps to MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Covers enumeration of pipeline configurations, privilege escalation from contributor to code execution, lateral movement through pipeline trust boundaries, and persistence via modified workflow definitions. Each technique section provides working exploitation code, detection indicators, and defensive countermeasures.
日本語の概要は準備中です。原文の説明を表示しています。
Track validated Codex Security findings in Linear, Jira, GitHub issues, or draft GitHub security advisories. Supports issue batches, duplicate checks, and reviewed writes. Do not use for scans or fixes.
日本語の概要は準備中です。原文の説明を表示しています。
Use when preparing iPolloWork local changes for GitHub: stash or preserve local edits, sync the current personal branch with remote main, re-apply local work, diagnose conflicts, commit in English, push to the current remote branch, and open a PR to main without creating extra branches.
日本語の概要は準備中です。原文の説明を表示しています。
Inspect unresolved GitHub pull request review threads, group actionable feedback, implement selected fixes locally, and only reply or resolve threads after explicit user intent.
日本語の概要は準備中です。原文の説明を表示しています。
Publish intentional local changes by confirming scope, creating a branch when needed, staging selected files, committing, pushing, and creating a Draft Pull Request through the connected GitHub service.
日本語の概要は準備中です。原文の説明を表示しています。
Diagnose failing GitHub Actions runs from bounded run, job, and step evidence, propose a focused fix, and modify the local checkout only when the requested task includes implementation.
日本語の概要は準備中です。原文の説明を表示しています。
Use the connected iPolloWork GitHub service to inspect repositories, pull requests, issues, reviews, and Actions, then route focused work to the review, CI, or publish skill.
日本語の概要は準備中です。原文の説明を表示しています。
管理 GitHub Pull Request 和 Issue。包括创建/更新/合并 PR、添加评论、管理 Issue 等。注意：文件读写、分支操作、代码提交等请使用 git-delegation 技能。
日本語の概要は準備中です。原文の説明を表示しています。
Execute and verify Apache OpenDAL release-manager work, including weekly ATR candidates, RC tagging, required GitHub Actions checks, ASF SVN dist uploads, Nexus staging close/release, vote discussions, language package readiness, GitHub release, announcements, and release postmortems.
日本語の概要は準備中です。原文の説明を表示しています。
Safely manage multiple GitHub identities (EMU + personal) in agent workflows
日本語の概要は準備中です。原文の説明を表示しています。
Cuts GitHub API calls by separating lightweight list scanning from full hydration
日本語の概要は準備中です。原文の説明を表示しています。
Capture Playwright screenshots and embed them in GitHub PR descriptions
日本語の概要は準備中です。原文の説明を表示しています。
Write clear GitHub Actions step summaries with progressive disclosure.
日本語の概要は準備中です。原文の説明を表示しています。
Define and validate GitHub custom agent files, prompts, and examples.
日本語の概要は準備中です。原文の説明を表示しています。
Author, validate, and debug canvas extensions that the agent can open in the GitHub Copilot app's side panel. Use when creating, reviewing, or troubleshooting a canvas extension — including its actions, inputs, rendered content, and the surrounding extension wiring (tools, hooks, lifecycle).
日本語の概要は準備中です。原文の説明を表示しています。
Practical tips for reviewing and improving Copilot agent PRs.
日本語の概要は準備中です。原文の説明を表示しています。
Design and verify a deterministic operational-value grader for any GitHub Agentic Workflow. Use when reasoning from workflow goals to measurable downstream outcomes, defining repository evidence, choosing outcome metrics, or creating an operational-value evaluator. Usage: /operational-value-designer OWNER/REPO WORKFLOW-NAME.
日本語の概要は準備中です。原文の説明を表示しています。
Prepare an open pull request for merge from a GitHub Copilot cloud agent. Drives Reviews, local validation, and Mergeable to a ready state. Does not merge, and cannot trigger CI.
日本語の概要は準備中です。原文の説明を表示しています。
Analyze PR review comments from a GitHub PR URL. Fetch review comments, verify each finding against the actual codebase, assess validity (correct/incorrect/partial), present a structured summary with recommended actions, and optionally reply to each comment on GitHub. Use when given a PR review URL or when asked to check/analyze PR feedback.
日本語の概要は準備中です。原文の説明を表示しています。
CI/CD pipeline security hunting — GitHub Actions workflow injection, secret exfiltration, self-hosted runner poisoning, dependency confusion, OIDC token theft, and supply chain attacks. Covers sisakulint scanning, manual workflow analysis, and chaining CI/CD bugs into critical findings. Use when a target has public repos, GitHub Actions, CircleCI, Jenkins, or GitLab CI.
日本語の概要は準備中です。原文の説明を表示しています。
External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions injection openings, container image registry exposure, SBOM mining, internal-package-name leakage, and CI/CD configuration exposure. Reconnaissance and identification ONLY — actual package publishing / typosquat attacks are EXTERNAL-OFFENSIVE and require explicit written sign-off because they can affect the entire npm/PyPI ecosystem. Use when the target has a public GitHub org, when their build artifacts/SBOMs are reachable, when their docker images are on Docker Hub/GHCR, or when you find internal package names in their JS bundles.
日本語の概要は準備中です。原文の説明を表示しています。