643 件 ・ 関連度順
概要と使いどころ
Run a bounded red-green-refactor feedback loop only when the user explicitly requests TDD, accepts reproduction-first proof for a bug, or an accepted high-risk behavior specifically requires red/green evidence; do not trigger for every logic, bug, behavior, or implementation change.
日本語の概要は準備中です。原文の説明を表示しています。
Arithmetic probes ({{7*7}}→49) confirm the injection point but are not proof of impact. The real goal is OS command execution. Arithmetic detection also fails silently when the app echoes the input back (e.g. inside an HTML attribute like <input value='{{7*7}}'>), producing a false negative even when injection exists.
日本語の概要は準備中です。原文の説明を表示しています。
Deep-dive offensive methodology for dependency confusion and namespace attacks across all major package ecosystems. Covers npm scope confusion exploiting the gap between public and private scoped packages and .npmrc misconfigurations where registry mappings fail to pin internal scopes exclusively. Addresses PyPI namespace attacks through --extra-index-url resolution ordering, NuGet feed priority exploitation when multiple package sources are configured without clear directives, Maven and Gradle repository ordering where artifact resolution traverses repositories sequentially, Go module proxy abuse through GOPROXY misconfiguration, Ruby gems namespace squatting, and Docker image tag confusion with unqualified image references. Provides complete proof-of-concept methodology using safe callbacks including DNS canary via interactsh or Burp Collaborator and HTTP beacon with no destructive payload. Covers reconnaissance techniques for discovering internal package names through GitHub repository analysis, error ...
日本語の概要は準備中です。原文の説明を表示しています。
Hunt TLS/SSL and DNS misconfigurations — missing HSTS (downgrade attack), weak cipher suites, expired/invalid certificates, mTLS bypass, missing SPF/DKIM/DMARC (email spoofing), DNS Zone Transfer (AXFR), dangling CNAME subdomain takeover, CAA records. Most of these are Info/Low on their own — this skill is opinionated about which findings actually pay (spoofable DMARC with delivered-to-inbox proof, AXFR returning internal hosts, dangling-CNAME takeover) versus which get rejected as best-practice noise (missing CAA, missing HSTS with no MitM position). Use during recon to find infrastructure weaknesses, and to TRIAGE them honestly before reporting.
日本語の概要は準備中です。原文の説明を表示しています。
Guide for continuous improvement, error proofing, and standardization. Use this skill when the user wants to improve code quality, refactor, or discuss process improvements.
日本語の概要は準備中です。原文の説明を表示しています。
When the user wants to edit, review, or improve existing marketing copy. Also use when the user mentions 'edit this copy,' 'review my copy,' 'copy feedback,' 'proofread,' 'polish this,' 'make this better,' or 'copy sweep.' This skill provides a systematic approach to editing marketing copy through multiple focused passes.
日本語の概要は準備中です。原文の説明を表示しています。
Turns client wins into structured case studies in multiple formats. Gathers before/after metrics, structures as Problem-Solution-Results, and outputs landing page copy, one-pager, social snippets, and email insert.
日本語の概要は準備中です。原文の説明を表示しています。
Framework-based cold email composer with 3 personalization tiers. Generates subject line, body, and follow-up variants. Never uses templates -- builds from frameworks (PAS, BAB, AIDA, Signal-Proof-Ask).
日本語の概要は準備中です。原文の説明を表示しています。
Designs or reviews provenance-bound DAG attempt traces, coverage gaps, cancellation, and unknown-effect reconciliation. NOT for claiming execution completeness, deployment monitoring, or root-cause proof.
日本語の概要は準備中です。原文の説明を表示しています。
Validate finite-DAG order objectives and construct reachability-chain or direct-edge path partitions with explicit proof boundaries. NOT for equating reachability chains with direct-edge paths without checking the chosen objective.
日本語の概要は準備中です。原文の説明を表示しています。
Treat tokens as a coding swarm's cost-of-goods-sold and legibility engine while accounting for finite subscription allowance when per-call price is unknown. Covers provider windows, remaining-usage evidence, burn forecasts, preemptive checkpoint/model switching, per-agent budgets, compaction, shared digests, context degradation, and spend metering. Activate on: "token budget", "context budget", "compaction strategy", "briefing as compression", "context rot", "summarization collapse", "COGS for agents", "subscription usage remaining", "five-hour or weekly limit", "burn forecast", "model switch before limit", or "/context-economics-for-agent-swarms". NOT for: memory architecture (use always-on-agent-architecture), single-prompt wording (use prompt-engineer), mechanism-design proofs (use nisan-et-al-2007-algorithmic-game-theory), physical containment (use sandboxed-adversarial-test-harness), or production rebodiment and fencing (use agent-resurrection-and-body-continuity).
日本語の概要は準備中です。原文の説明を表示しています。
Own whether a multi-document product-architecture binder is internally consistent, complete against its stated customer/contingency/architecture coverage, and honest about which older product ambitions it has absorbed, superseded, deferred, contradicted, orphaned, or rejected. Use when running a binder Architect of Record pass, before an implementation chain cites a binder chapter as ready, when a proof-gate owner is missing, or when reconciling the binder against the older ambition corpus (website, plans, examples, ADRs). NOT for auditing a single Claude Skill bundle's structure or frontmatter (use skill-hygiene), rendering a single-PM accept/reject verdict on one finished deliverable (use port-daddy-user-surrogate-pm-review), or sequencing/stewarding a roadmap's sidequests once a gap or operator decision has been surfaced (use legible-roadmap-with-sidequests).
日本語の概要は準備中です。原文の説明を表示しています。
Design a bounded FIPA-style conversation and map it cautiously to JADE behavior APIs. NOT for treating a JADE API example as protocol delivery or application authorization proof.
日本語の概要は準備中です。原文の説明を表示しています。
Design a normalized, machine-readable "work receipt" that answers what changed, why, by whom, and with what validation, for any AI-coding-agent task regardless of backend (Claude Code, Codex, Cursor, Aider, CI, or homegrown). Use when defining a receipt schema, normalizing heterogeneous agent logs into one evidence shape, gating PR merges on artifact-backed proof, or designing an OSS maintainer's fast-reject/fast-merge workflow. NOT for validating a DAG node's output against its own schema (use output-contract-enforcer), continuous runtime monitoring of a live coordination daemon (use runtime-verification-for-agents), or general Port Daddy claims/notes/salvage mechanics (use port-daddy-agent-skill).
日本語の概要は準備中です。原文の説明を表示しています。
Designs and audits deterministic, authority-filtered partitions of trust-typed context for already admitted bodies or abstract continuation slots. Use when causal context, obligations, disclosure boundaries, vector-space identity, capacity, and omission proofs must survive partitioning. NOT for spawning or admitting agents, choosing worker count, retrieving arbitrary knowledge, writing successor prompts, or granting tools, leases, identity, or effect authority.
日本語の概要は準備中です。原文の説明を表示しています。
Research AI coding assistant products, audiences, user stories, social proof, hacks, and unmet needs for apps like Cursor, Claude Code, Codex, Warp Code, Devin, Windsurf, GitHub Copilot, Cline, Aider, and homegrown agent stacks. Use when designing or positioning agentic developer tools, Port Daddy Agent Harbor, swarm consoles, background coding agents, or competitive/product research for AI software engineering. NOT for implementing the coding agent runtime, generic market research, or UX mockups without developer workflow evidence.
日本語の概要は準備中です。原文の説明を表示しています。
Design low-friction UX, interaction patterns, and comeback loops for AI coding assistant apps, agent consoles, background coding agents, and Port Daddy swarm/operator surfaces. Use when creating flows like prompt-to-diff, context attach, plan/apply/review, checkpoint rollback, background-agent dashboards, visual proof, or multi-agent invocation. NOT for generic landing pages, static dashboards, or implementation-only changes without product flow.
日本語の概要は準備中です。原文の説明を表示しています。
Cryptographic security for agentic systems — zero-trust agent networking, signed message envelopes (JWS/JWE), capability-based security (ocaps), Merkle tree audit trails, WASM sandboxing, and formal verification. Covers CLI dev tool security, mTLS between agents, permission boundaries (least privilege for AI agents), and supply chain security for skills/plugins. Activate on: "agent security", "zero trust agents", "secure agent communication", "capability-based security", "ocap", "signed messages between agents", "agent audit trail", "sandbox agent execution", "agent permissions", "mTLS agents", "cryptographic verification", "agent supply chain", "OWASP agentic", "prove agent did X", "tamper-proof agent logs". NOT for: application-level SAST scanning (use security-auditor), network firewall rules (use infrastructure), SOC2/HIPAA compliance (organizational), or prompt injection defense (use prompt-engineer).
日本語の概要は準備中です。原文の説明を表示しています。
Design or audit an agent identity, credential, session, continuity, and reputation plan. Use when attributed outcomes must survive key rotation, restart, recovery, or review; when choosing Elo, TrueSkill, a contextual bandit, or an LLM judge; and when making Sybil, newcomer, calibration, collusion, and evidence limits explicit. Produces a supplied-plan consistency audit, never proof of observed delivery, cryptographic identity, or live enforcement. NOT for proving personhood, global Sybil resistance, or an unobserved delivery.
日本語の概要は準備中です。原文の説明を表示しています。