4,345 件 ・ 関連度順
概要と使いどころ
A two-phase repair skill that analyzes errors and suggests fixes before executing repairs. Phase one: user describes error, agent analyzes and proposes solution. Phase two: upon approval, executes the repair action.
日本語の概要は準備中です。原文の説明を表示しています。
Generates structured cyber threat intelligence reports at strategic, operational, and tactical levels tailored to specific audiences including executives, security operations teams, and technical analysts. Use when producing finished intelligence products from raw collection data, creating sector threat briefings, or delivering post-incident intelligence assessments. Activates for requests involving CTI report writing, threat briefings, intelligence products, finished intelligence, or executive security reporting.
日本語の概要は準備中です。原文の説明を表示しています。
Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for attack path analysis, Mimikatz for credential extraction, and Impacket for protocol-level attacks including Kerberoasting, AS-REP Roasting, and delegation abuse. Activates for requests involving Active Directory pentest, AD attack simulation, domain compromise testing, or Kerberos attack assessment.
日本語の概要は準備中です。原文の説明を表示しています。
Consolidated Galyarder Framework Executive intelligence bundle.
日本語の概要は準備中です。原文の説明を表示しています。
Use when you have a written implementation plan to execute in a separate session with review checkpoints
日本語の概要は準備中です。原文の説明を表示しています。
Executes authorized phishing simulation campaigns to assess an organization's susceptibility to email-based social engineering attacks. The tester designs realistic phishing scenarios, builds credential harvesting infrastructure, sends targeted phishing emails, and tracks open rates, click-through rates, and credential submission rates to measure human security awareness. Activates for requests involving phishing simulation, social engineering assessment, email security testing, or security awareness measurement.
日本語の概要は準備中です。原文の説明を表示しています。
"Optimize SQL query performance using EXPLAIN analysis, indexing strategies, and common anti-pattern fixes. Use this skill when the user needs to speed up slow queries, design indexes, fix N+1 problems, or optimize database performance — even if they say 'this query is slow', 'optimize our database', 'which indexes do we need', or 'our dashboard takes 30 seconds to load'.".
日本語の概要は準備中です。原文の説明を表示しています。
Zero-ceremony atomic task execution. Use for tiny fixes or enhancements (minutes, not hours) that don't warrant SDLC ceremony. Flags: --discuss (disambiguate first), --full (delegate to /pre-commit after execution), --issue N (link commit to GitHub issue).
日本語の概要は準備中です。原文の説明を表示しています。
Orchestrates the full law interpretation pipeline: MvT research, machine_readable generation with validation/BDD testing, and reverse validation. Invokes /law-mvt-research, /law-generate, and /law-reverse-validate sequentially. Use this skill proactively when: user wants to make a law executable, add machine_readable sections, or mentions "interpret" in the context of a Dutch law YAML file. Activate automatically when user opens a corpus YAML file without machine_readable sections and wants to make it executable.
日本語の概要は準備中です。原文の説明を表示しています。
Implement a settled request or current execution strategy through connected slices, feed observations into the same task record, and revise affected work when evidence changes.
日本語の概要は準備中です。原文の説明を表示しています。
Facilitate monthly S&OP or integrated business planning cycles by aligning demand, supply, inventory, capacity, and executive decisions with a standard meeting rhythm and decision log. Use when operations teams need a demand review, supply review, pre-S&OP reconciliation, or executive S&OP pack. Do not use for single-SKU replenishment math only.
日本語の概要は準備中です。原文の説明を表示しています。
Prepare customer or executive business reviews with outcome tracking, adoption health, ROI narrative, risks, commitments, and next-quarter plan using customer success and CX frameworks. Use when teams need QBRs, success plans, churn-risk conversations, or executive account reviews. Do not use for generic slide beautification or cold outreach prospecting.
日本語の概要は準備中です。原文の説明を表示しています。
Turn ambiguous requests into an executable implementation plan with assumptions, sequence, acceptance checks, and rollback thinking.
日本語の概要は準備中です。原文の説明を表示しています。
Write one-page executive briefs and decision memos that turn messy inputs into a concise recommendation, options, risks, decision ask, and next steps. Use when leaders need a fast read before approving budget, policy, vendor, headcount, or strategy changes. Do not use for long-form reports, slide design, or generic summarization without a decision.
日本語の概要は準備中です。原文の説明を表示しています。
Execute advanced Man-in-the-Middle (MITM) NTLM Relay attacks specifically targeting environments where SMB Signing is purportedly enabled but improperly configured (e.g., exclusively required on Domain Controllers but NOT enforced universally on standard Workstations or File Servers). Utilize powerful tools like Responder and Impacket's NTLMRelayX to coercively capture NTLMv2 authentications (via LLMNR, WPAD, or Coercion methods like PetitPotam) and seamlessly relay them across the network identically yielding immediate Local Administrator command execution.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit Prototype Pollution vulnerabilities in JavaScript applications to achieve client-side Cross-Site Scripting (XSS), bypass authentication, or execute Remote Code Execution (RCE) on Node.js servers by manipulating the core Object prototype.
日本語の概要は準備中です。原文の説明を表示しています。
Execute Indirect Prompt Injection attacks against Large Language Models (LLMs) by subtly embedding malicious instructions within external data sources (e.g., websites, documents, databases) that the LLM autonomously ingests. This forces the model to execute attacker-controlled commands under the guise of processing legitimate user requests.
日本語の概要は準備中です。原文の説明を表示しています。
Supply-chain testing via package-manager dependency confusion: when internal package names resolve to attacker-controlled public registries, leading to malicious install and script execution. Use for npm/pip/gem/Maven/Composer/Docker manifest review and authorized red-team supply-chain exercises.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit CVE-2023-36884, a critical Remote Code Execution vulnerability in Windows and Office associated with the Storm-0978 APT. This skill covers the weaponization of malicious Word documents to achieve code execution upon opening, bypassing Mark-of-the-Web (MotW) defenses.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit DOM-based Cross-Site Scripting (XSS) vulnerabilities where malicious payloads are executed entirely within the victim's browser via insecure JavaScript execution, often bypassing server-side WAFs completely.
日本語の概要は準備中です。原文の説明を表示しています。
Utilize the native Windows binary `certutil.exe` to download malicious payloads and optionally decode Base64 encoded files as a Living-off-the-Land (LotL) technique. This skill details how attackers bypass application whitelisting and fetch stage-2 implants.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit OS Command Injection vulnerabilities where web applications insecurely pass user input into system shell commands. Use this skill when applications feature ping utilities, file conversions, network diagnostics, or PDF generators to execute arbitrary system commands and achieve Remote Code Execution (RCE).
日本語の概要は準備中です。原文の説明を表示しています。
Execute a complete Active Directory penetration test from initial enumeration to domain dominance. Use this skill for AD security assessments including LDAP enumeration, Kerberos attacks (Kerberoasting, AS-REP roasting), BloodHound attack path analysis, credential dumping with Mimikatz, lateral movement via PsExec/WMI/DCOM, DCSync for NTDS extraction, and Golden/Silver ticket forging. Covers the full kill chain from domain user to domain admin.
日本語の概要は準備中です。原文の説明を表示しています。
Execute a DCSync attack mimicking the behavior of a legitimate Active Directory Domain Controller (DC). Leverage Directory Replication Service Remote Protocol (DRSR) permissions to silently request and extract the password hashes (NTLM/Kerberos) of any or all users in the domain without executing code on the target Domain Controller.
日本語の概要は準備中です。原文の説明を表示しています。