「leak」の検索結果

A deliberately leaky demo skill used to show what skill-sanitizer catches before you publish. Do not ship this.

日本語の概要は準備中です。原文の説明を表示しています。

Audit and harden Convex authorization: identity-from-arg impersonation, missing per-document ownership checks, PII-leaking public queries, and writes into containers the caller doesn't own. Deterministic scan + canonical requireIdentity/requireOwner fix + tsc verify. Use for 'secure my app' / 'audit auth' / 'who can access this data', not generic code review.

日本語の概要は準備中です。原文の説明を表示しています。

Audit and harden a Convex app's authorization: identity-from-arg impersonation, missing per-document ownership checks, public queries leaking data by a client-supplied id, and writes into a parent/container the caller doesn't own. Scans for the 4 shapes, applies requireIdentity/requireOwner, verifies with tsc. TRIGGER on 'secure my app', 'audit auth/authz', 'who can access this data'. SKIP when there is no convex/ directory.

日本語の概要は準備中です。原文の説明を表示しています。

Expert security auditor for AI Skills and Bundles. Performs non-intrusive static analysis to identify malicious patterns, data leaks, system stability risks, and obfuscated payloads across Windows, macOS, Linux/Unix, and Mobile (Android/iOS).

日本語の概要は準備中です。原文の説明を表示しています。

Detects and analyzes Bluetooth Low Energy (BLE) security attacks including sniffing, replay attacks, GATT enumeration abuse, and Man-in-the-Middle interception. Uses Ubertooth One and nRF52840 sniffers for packet capture, the bleak Python library for GATT service enumeration, and crackle for BLE encryption cracking. Use when assessing IoT device BLE security, monitoring for BLE-based attacks on wireless infrastructure, or performing authorized BLE penetration testing. Activates for requests involving BLE security assessment, Ubertooth sniffing, GATT enumeration, or BLE replay detection.

日本語の概要は準備中です。原文の説明を表示しています。

Deploy cloud-native deception across AWS, Azure, and GCP using decoy (honey) resources whose only purpose is to generate a high-fidelity alert the instant an attacker touches them: canary IAM access keys, permission-less decoy users/roles/service principals, honey object-storage buckets, and decoy secrets in Secrets Manager / Key Vault / Secret Manager. Wires detection through CloudTrail + EventBridge, Azure Sentinel honeytoken watchlists + Defender, and GCP Cloud Audit Logs, so any use of a decoy is routed to the SOC with near-zero false positives. Use when protecting cloud accounts and data stores, when an org has only on-prem honeypots and needs cloud coverage, when seeding fake AWS keys to catch credential theft and code-leak exposure, or when detecting cloud reconnaissance and lateral movement. Keywords: cloud deception, canary token AWS, honey S3 bucket, decoy IAM credentials, CloudTrail alert, GuardDuty, Sentinel honeytoken, decoy secret, honey service account, cloud honeypot, breach detection.

日本語の概要は準備中です。原文の説明を表示しています。

Test vector stores for embedding inversion, cross-tenant leakage, and poisoning.

日本語の概要は準備中です。原文の説明を表示しています。

Hardcoded-secret detection — AWS keys, GitHub PATs, Slack tokens, Stripe keys, generic high-entropy strings. Pre-commit (`--staged-only`), explicit paths, or full repo. Use when guarding `git commit`, auditing a repo for leaked credentials, validating no secrets entered the diff before push, or producing a rotation list for an exposed-secret incident.

日本語の概要は準備中です。原文の説明を表示しています。

Review changes for bugs, regressions, missing tests, safety gaps, public/private leaks, and architecture drift before stylistic comments.

日本語の概要は準備中です。原文の説明を表示しています。

Reviews one SKILL.md against the format rules and returns a findings table: strict YAML front matter with exactly name and description, name equal to the folder, description as the trigger, the eight-heading skeleton, capability-neutral wording, safety boundaries. Each finding carries severity, rule identifier, location, quoted evidence and replacement text; the verdict READY, REVISE or BLOCKED is an apparent state and the owner decides. Use when the user asks to "review this SKILL.md", "check my skill file before upload", "lint this skill description", "validate the front matter of this skill" or "score this skill folder". Do not use to write an agent's instructions field, use agent-instructions-drafter instead; for injection or leakage exposures use agent-instructions-red-team; for launch tests use agent-evaluation-plan. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

Designs a pre-launch evaluation plan for a declarative agent from its instructions text, skills, capabilities, knowledge sources and sample requests: a behaviour contract of testable statements quoted from the text, test prompts by scenario family and tier with setup, expected behaviour, pass and fail criteria and red flags, a red-flag catalogue, a blank scoring sheet, a coverage table and a go or no-go checklist the owner completes and decides. Use when the user asks to "write test cases for my agent", "how do I evaluate this agent before launch", "build a test plan for the agent", "what should I check before publishing this agent" or "give me a go no-go checklist". Do not use for finding injection or leakage exposures in the instructions, use agent-instructions-red-team instead; do not use for reviewing one SKILL.md, use skill-file-reviewer instead. Drafts for human review; never approves, authorises or signs off.

日本語の概要は準備中です。原文の説明を表示しています。

- Investigator OPSEC — threat-model who might notice you, control your attribution surface across IP, ASN, browser and TLS fingerprint, timing and logged-in accounts, separate research identity from… Use when setting up a research account, avoiding tipping off a subject, worrying about LinkedIn profile-view leakage, needing a burner phone or email, or hardening a research VM or browser profile

日本語の概要は準備中です。原文の説明を表示しています。

- Craft advanced search-engine queries and Google dorks to surface hidden files, documents and mentions. Use when building a Google dork, hunting a leaked document, or searching paste sites and document repositories for a name, email or selector

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks to "watch my list health over time", "flag decaying / unengaged subscribers on a schedule", "why is my open rate drifting down / bounces creeping up", or "build me a re-permission and prune worklist"; runs the scheduled SEND list-decay + suppression-drift watch — an engagement-recency cohort read (30/90/180/365-day), hard-bounce and spam-complaint trend vs benchmark, suppression-list growth/leakage check, and a segmented re-permission / sunset / prune worklist tied to SEND S (list hygiene) and E (engagement-decay) sub-items. Not for the one-time pre-send authentication pre-flight — use deliverability-qa; not for the consent/suppression record itself — use consent-registry; not for computing the EQS or enforcing vetoes — use email-quality-auditor. 邮件列表健康度监控/退订漂移/沉睡用户清理

日本語の概要は準備中です。原文の説明を表示しています。

Detects route data fetched in useEffect instead of loaders, server/client API leaks across loader boundaries, and missing HydrateFallback in React Router v7 framework mode.

日本語の概要は準備中です。原文の説明を表示しています。

Covers Flutter testing across all three layers: unit tests (business logic, ViewModels, repositories), widget tests (UI rendering, interactions, golden regression), and integration/E2E tests (full app flows, native OS interactions). Use this skill when writing any Flutter test, setting up mocking with mocktail or mockito, implementing golden file tests, debugging async failures (pumpAndSettle timeouts, Timer leaks, FakeAsync deadlocks), fixing cross-platform golden pixel diffs in CI/CD, testing state management (Riverpod/BLoC/Provider), handling permission dialogs or native system UI with Patrol, or troubleshooting MediaQuery/Theme missing errors in widget tests.

日本語の概要は準備中です。原文の説明を表示しています。

Integrates Google Mobile Ads (AdMob) into Flutter using google_mobile_ads v7.x with Banner, Interstitial, Rewarded, and Native ad formats. Use this skill whenever implementing app monetization, adding AdMob ads to Flutter, fixing ad loading or display errors, managing ad lifecycle (preload/dispose), preventing memory leaks from undisposed ads, handling GDPR/ATT consent flows, troubleshooting AdMob dashboard integration, or any time the words 'AdMob', 'google_mobile_ads', 'banner ad', 'interstitial', 'rewarded ad', 'native ad', or 'ad monetization' appear in the request. Supports Android (GMA SDK 24.9+) and iOS (GMA SDK 12.14+).

日本語の概要は準備中です。原文の説明を表示しています。

Senior Kotlin specialist code review — framework-agnostic. Use whenever the user asks to review, audit, critique, or get feedback on Kotlin code, a file, a class, a function, a module, a diff, a branch, a commit, or a pull request. Judges Kotlin language idioms, logic correctness, architecture and layering, concurrency (coroutines, Flow, structured concurrency, cancellation, race conditions), null safety, exception safety, testability, performance, and security. Detects force-unwraps, unchecked casts, GlobalScope, leaked mutability, broken structured concurrency, hidden side effects, weak abstractions, untestable seams, allocation hot spots, weak crypto, input-validation gaps, and PII logging. Outputs prioritized findings with file:line anchors and minimal-diff fixes. No assumptions about DI framework, UI framework, or build system.

日本語の概要は準備中です。原文の説明を表示しています。

LLM) can be manipulated through prompt injection, whether a retrieval pipeline leaks confidential da

日本語の概要は準備中です。原文の説明を表示しています。

Run a security sweep over one repo: secrets, dependencies and the diff, a security review and a silent-failure hunt, one deduped and ranked findings report, issues filed for blocking findings only after GO, each one handed to pb-bug-fix. Use for "security sweep", "audit this repo", "check for leaked secrets and vulnerable deps".

日本語の概要は準備中です。原文の説明を表示しています。

Debug iOS apps and profile performance using LLDB, Memory Graph Debugger, and Instruments. Use when diagnosing crashes, memory leaks, retain cycles, main thread hangs, slow rendering, build failures, or when profiling CPU, memory, energy, and network usage.

日本語の概要は準備中です。原文の説明を表示しています。

Performs comprehensive FiveM resource security, performance, and compatibility audits. Detects backdoors, RATs, SQL injection, event exploitation, NUI vulnerabilities, dupes, crash/DoS vectors, npm and build-chain supply chain attacks, and malware patterns across ESX, QBCore, QBox, ox_lib, and ND_Core frameworks, on both GTA V Legacy and Enhanced builds. Use whenever a FiveM/cfx resource is being reviewed — even if not explicitly asked — including: audit FiveM script, review FiveM security, optimize FiveM resource, check FiveM performance, FiveM code review, review Lua script security, audit ESX resource, audit QBCore resource, audit QBox resource, check for exploits, FiveM vulnerability scan, GTA V Enhanced migration check, resmon optimization, or asking whether a leaked, cracked, nulled or unknown-origin script is safe to run.

日本語の概要は準備中です。原文の説明を表示しています。

Expert security auditor for AI Skills and Bundles. Performs non-intrusive static analysis to identify malicious patterns, data leaks, system stability risks, and obfuscated payloads across Windows, macOS, Linux/Unix, and Mobile (Android/iOS).

日本語の概要は準備中です。原文の説明を表示しています。

Tests WebSocket API implementations for security vulnerabilities including missing authentication on WebSocket upgrade, Cross-Site WebSocket Hijacking (CSWSH), injection attacks through WebSocket messages, insufficient input validation, denial-of-service via message flooding, and information leakage through WebSocket frames. The tester intercepts WebSocket handshakes and messages using Burp Suite, crafts malicious payloads, and tests for authorization bypass on WebSocket channels. Activates f...

日本語の概要は準備中です。原文の説明を表示しています。