1,085 件 ・ 関連度順
概要と使いどころ
Use when a user provides one baseline image and requests game animation frames, sprite sequences, attack/walk/idle/hit/death/casting motion, transparent PNG frames, a spritesheet, keyframe prompts, or consistent whole-character pose animation.
日本語の概要は準備中です。原文の説明を表示しています。
Standardize a 2D animation baseline image with `/img2mo-std xxx.png/pos`. Use when preparing a character, creature, prop, or weapon baseline before motion generation, especially if the source image is too large, tightly cropped, lacks transparent action margin, has a white background, or later walk/attack/idle frames show clipping, overlap, scale popping, or inconsistent character size.
日本語の概要は準備中です。原文の説明を表示しています。
Plan, execute, document, and retest authorized security assessments of AI agents and multi-agent workflows using safe adversarial cases, synthetic identities, canaries, and evidence-based findings. Use when defining red-team rules of engagement, assessing prompt injection or excessive agency, testing tool and identity boundaries, evaluating memory or cross-agent attacks, scoring a campaign, or verifying remediation in an approved environment.
日本語の概要は準備中です。原文の説明を表示しています。
Real-world Active Directory environment constraints that silently break attacks when ignored: NTLM disabled (Kerberos fallback), AES-only KDCs (RC4 blocked by GPO), LDAP signing and channel binding requiring LDAPS on 636, Kerberos clock skew (KRB_AP_ERR_SKEW), SPNs that must be FQDNs never short names or IPs (the misleading invalidCredentials), Protected Users / LAPS / gMSA / MachineAccountQuota, LDAP 1000-object paging, and VPN latency. Use this whenever a bind, TGT request, LDAP query, or SMB negotiation fails in a way that looks like bad credentials but is really hardening, or before running any AD tooling against a domain you have not fingerprinted. Standard-tooling knowledge (netexec, impacket, certipy, bloodyAD, kerbrute), no vendor-specific engine.
日本語の概要は準備中です。原文の説明を表示しています。
Active Directory Certificate Services (AD CS) escalation techniques ESC1 through ESC17, driven by hand with Certipy (ly4k). Use when the target runs a Certificate Authority and you want to find vulnerable certificate templates or CA misconfigurations, request a certificate that impersonates a privileged user, and know the exact certipy command, what each ESC actually checks, the Windows Event IDs that fire, and the remediation. ESC1 and ESC8 are the two you hit most in the field.
日本語の概要は準備中です。原文の説明を表示しています。
A high-level conceptual mapping from Active Directory attack techniques to the compliance controls they touch. Kerberoasting relates to authentication and logging, so it brushes ENS op.acc.5 / op.exp.8, NIS2 Art.21(2)(h), DORA RTS Art.9 / Art.21. Use this when a reader wants to understand which regulatory control an AD finding relates to, or to add an orientation note to a technical finding. This is a conceptual, orientative mapping only; it is NOT an auditor-defensible, curated, ID-by-ID control matrix. Covers ENS (op.acc.*, op.exp.*), NIS2 (Directive 2022/2555 Art.21), and DORA (RTS 2024/1774).
日本語の概要は準備中です。原文の説明を表示しています。
Security forensics for git repos, AI skills, and MCP servers. Audits dependencies, detects prompt injection, credential theft, runtime dynamism, manifest drift, known CVEs, CISA KEV (actively exploited) vulns, and 2026 attack patterns. Not for fixing vulnerabilities or pentesting.
日本語の概要は準備中です。原文の説明を表示しています。
Test application security against OWASP Top 10 (2025) with automated CI tooling: OWASP ZAP (DAST), dependency/supply-chain scanning (OSV-Scanner, SBOM, provenance), Semgrep SAST, auth/session tests (JWT, OAuth, RBAC), and XSS/CSRF/SQLi/SSRF Playwright patterns. Use when: "security test," "OWASP," "vulnerability," "ZAP," "XSS," "SSRF," "dependency scan," "auth testing," "OWASP LLM Top 10." Scope is automated scanning + negative-path security tests in CI, not manual penetration testing. Not for: mapping security controls to regulations (SOC 2, HIPAA, PCI, GDPR) — use compliance-testing; pipeline stage wiring and deploy gating mechanics — use ci-cd-integration; purely functional API auth/input tests with no attacker model — see api-testing; testing your product's own LLM features or defending the agent itself (prompt-injection detector, indirect injection, jailbreak red-teaming) — use ai-system-testing. Related: ci-cd-integration, compliance-testing, api-testing, shift-left-testing, ai-system-testing.
日本語の概要は準備中です。原文の説明を表示しています。
Detects attacks from server logs and blocks malicious IPs with CrowdSec, an open-source, crowd-sourced alternative to fail2ban. Use when a user asks to block brute force attempts, protect SSH or a web server, set up a community blocklist firewall, add a WAF, or install CrowdSec with Docker.
日本語の概要は準備中です。原文の説明を表示しています。
Finds the cause of a hard bug by running several read-only subagents in parallel, each attacking it from a different angle (change history, code path, data and state, environment, reproduction), then checking their evidence, ranking the hypotheses and naming the one experiment that would confirm the leader. It diagnoses and does not fix. Use when someone says "hunt this bug with multiple agents", "swarm on this regression", "investigate in parallel", "find the root cause", or when a failure is intermittent, crosses components, or has resisted a first look.
日本語の概要は準備中です。原文の説明を表示しています。
Censys search engine for internet-connected hosts, TLS certificates, and web properties. Use when: certificate transparency monitoring, finding hosts by certificate fingerprint, alternative to Shodan for TLS/SSL analysis, discovering hosts running specific services, or tracking infrastructure changes via cert issuance.
日本語の概要は準備中です。原文の説明を表示しています。
Expert guidance for Arcjet, the developer-first security platform that provides rate limiting, bot protection, email validation, and attack detection as a code-first SDK. Helps developers add security layers to Next.js, Node.js, and other JavaScript/TypeScript applications without managing infrastructure.
日本語の概要は準備中です。原文の説明を表示しています。
Implement safety guardrails for AI systems — content filtering, prompt injection detection, output validation, bias mitigation, and responsible AI practices. Use when tasks involve adding safety layers to LLM applications, detecting prompt injection attacks, filtering harmful content, implementing rate limiting for AI APIs, validating LLM outputs against schemas, building moderation pipelines, or ensuring AI systems comply with safety policies.
日本語の概要は準備中です。原文の説明を表示しています。
Synthesize the single strongest EVIDENCE-BOUND reviewer case to reject a paper, built ONLY from the evidence ledger (claims.json) + the other auditors' confirmed findings — never free-floating LLM critique. Two fresh cross-model codex threads: an attack writes the ~200-word rejection paragraph (every accusation tagged to an existing claim_id/finding_id), a defense decomposes it and rules each point against the anchored evidence. MEMO-ONLY: emits adversarial-case-builder.memo.md (fed to the adjudicator via --memo) and carries NO verdict weight — tools/adjudicate_findings.py lists it in ZERO_WEIGHT_SKILLS and caps it at info. Honest-null allowed (the paper may survive). Run LAST. Detect-only. Adapted from ARIS kill-argument. Triggers: "adversarial case", "strongest objection", "rejection memo", "kill argument", "最强拒稿点".
日本語の概要は準備中です。原文の説明を表示しています。
API Fuzzing for Bug Bounty workflow skill. Use this skill when the user needs Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.
日本語の概要は準備中です。原文の説明を表示しています。
API Fuzzing for Bug Bounty workflow skill. Use this skill when the user needs Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.
日本語の概要は準備中です。原文の説明を表示しています。
GitHub 解封 — 账号封禁/限制/恢复的领域操作系统。覆盖：(a) GitHub 官方政策体系 (TOS / 可接受使用政策 / Trust & Safety 执行模式 / 公开申诉路径 / 受制裁地区解读)；(b) 封号原因诊断学 (spam / abuse / 制裁误标 / 2FA 丢失 / ToS 违规 / 账号劫持误判 / ban evasion 等子类型 + 症状→原因映射 + 自我分诊压测)；(c) 申诉实操 craft (写一封能让 T&S 快速判误伤的英文申诉信 + 升级阶梯 + 法务介入边界 + Don'ts)；(d) 制裁与合规硬边界 (OFAC SDN 名单 / 哪些国家或地区真不可达 / VPN 误判路径 / 中国大陆不是美国制裁地区的反复重申)；(e) 中国大陆开发者特别处境 (sanctioned region 误标 + SMS 验证不支持 +86/+852 + Gitee/GitLab/Codeberg/JihuLab 备用迁移 + 私有自托管 Gitea/Forgejo)；(f) 真实案例库 (~30+ 公开案例分类拆解：误伤 / 真违规 / 制裁误标三类各自赔率与申诉成功路径)。伦理锚绝不软化：不教 ban evasion / 不教撒谎式申诉 / 真违规承认改进 / 丢 2FA 无恢复因子则诚实告知 / 中国制裁误标靠申诉不靠换 VPN / 申诉 6 个月窗口必算清 / 约 3% (业内估) 真违规恢复 vs 约 79% (业内估) 误伤申诉成功率分层标。 (GitHub Account Reinstatement — the domain operating system for GitHub (and analogous platform) account suspension, restriction, appeal, and recovery. Covers: (a) GitHub official policy architecture (TOS / Acceptable Use Policies / Trust & Safety enforcement patterns / public appeals pathways / sanctioned-region interpretation); (b) suspension-cause diagnostics (spam / abuse / sanctions mis-flag / 2FA loss / ToS violation / account hijack false-positive / ban evasion taxonomy + symptom→cause mapping + self-triage pressure test); (c) appeal craft (writing an English appeal letter that gets T&S to fast-track a false-positive ruling + escalation ladder + legal-engagement boundary + Don'ts); (d) sanctions and compliance hard boundaries (OFAC SDN list / which countries/regions are truly unreachable / VPN false-positive paths / China is NOT a US-sanctioned region — repeated emphasis); (e) mainland China developer special circumstances (sanctioned-region mis-flag + SMS verification does not support +86/+852 + Gitee/GitLab/Codeberg/JihuLab fallback migration + self-hosted Gitea/Forgejo); (f) real-case library (~30+ public cases with categorized analysis: false-positive / genuine violation / sanctions mis-flag, each with win-rate and appeal success path). Ethical anchors absolutely not softened: do NOT teach ban evasion (creating new accounts turns a temp ban into a permanent one — the single biggest mistake); do NOT teach social engineering or lying in appeals (misuse + actually confirms violation); genuine violations: admit + improve beats denial; lost 2FA + no recovery factor → do not pretend recovery is possible; China sanctioned-region mis-flag → fix via appeal, not repeated VPN switching; appeal form 6-month window must be counted carefully; historical 约 3% (业内估) genuine-violation recovery vs 约 79% (业内估) false-positive appeal success rate stratification must be honestly labeled. Anti-samples (explicitly describe harm, never endorse): developer permabanned for ban evasion / open-source team org-banned for personal attacks in public issues / cases where repeated VPN switching escalated risk-control severity.) Master OS — automated mastery of GitHub Account Reinstatement — the domain operating system for GitHub (and analogous platform) account suspension, restriction, appeal, and recovery. Covers: (a) GitHub official policy architecture (TOS / Acceptable Use Policies / Trust & Safety enforcement patterns / public appeals pathways / sanctioned-region interpretation); (b) suspension-cause diagnostics (spam / abuse / sanctions mis-flag / 2FA loss / ToS violation / account hijack false-positive / ban evasion taxonomy + symptom→cause mapping + self-triage pressure test); (c) appeal craft (writing an English appeal letter that gets T&S to fast-track a false-positive ruling + escalation ladder + legal-engagement boundary + Don'ts); (d) sanctions and compliance hard boundaries (OFAC SDN list / which countries/regions are truly unreachable / VPN false-positive paths / China is NOT a US-sanctioned region — repeated emphasis); (e) mainland China developer special circumstances (sanctioned-region mis-flag + SMS verification does not support +86/+852 + Gitee/GitLab/Codeberg/JihuLab fallback migration + self-hosted Gitea/Forgejo); (f) real-case library (~30+ public cases with categorized analysis: fa
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill when reasoning about generative AI, adversarial machine learning, neural network security, algorithmic fairness, or deep learning fundamentals. This skill channels the thinking of Ian Goodfellow, inventor of Generative Adversarial Networks (GANs). Trigger this skill when the user asks about model robustness, mitigating bias, evaluating AI guardrails, designing generative models, or defending against adversarial attacks. Apply his frameworks of minimax games, adversarial feature learning, and worst-case robustness analysis to shift the user's perspective from average-case optimization to adversarial resilience.
日本語の概要は準備中です。原文の説明を表示しています。
Use when the diff builds a query, a shell command or argv, a subprocess environment, a template, an XML parse, an eval or a deserialization from data that may be attacker-controlled - SQL/NoSQL, OS command, argument, env-var, template and code injection, XXE, unsafe deserialization
日本語の概要は準備中です。原文の説明を表示しています。
Use when you have a candidate security finding and before it goes in a comment - restate it, prove reachability, impact and a concrete exploit, apply triage dismissals, then the self-refute pass naming attacker and victim
日本語の概要は準備中です。原文の説明を表示しています。
Designing red team attack scenarios, threat models, MITRE ATT&CK/OWASP application, Purple Team exercises, and AI/LLM red teaming. Use when adversarial security validation is needed.
日本語の概要は準備中です。原文の説明を表示しています。
DeFi Protocol Architect: Mechanism design for AMMs, lending, vaults and derivatives: oracles, liquidations, attack surfaces.
日本語の概要は準備中です。原文の説明を表示しています。
SecLists path map, hashcat rules, CeWL usage, and custom wordlist generation for all attack categories
日本語の概要は準備中です。原文の説明を表示しています。
MITRE ATT&CK framework reference — tactics, techniques, and tool-to-TTP mappings for pentest documentation and detection rule writing
日本語の概要は準備中です。原文の説明を表示しています。