927 件 ・ 関連度順
概要と使いどころ
Exploit AI assistants equipped with web-browsing capabilities or internal API plugins to perform Server-Side Request Forgery (SSRF). This skill details injecting prompts that force the LLM to request sensitive internal endpoints, such as underlying cloud metadata services or internal networks.
日本語の概要は準備中です。原文の説明を表示しています。
401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.
日本語の概要は準備中です。原文の説明を表示しています。
Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every technique includes actual payloads, commands, and verification logic. Chains from /pentester or /codebase when API endpoints are discovered, chains into /web-exploit when classic injection points are found in API parameters, chains into /post-exploit when RCE is achieved, and chains into /ai-redteam when an LLM/AI endpoint is discovered (chat APIs, completion endpoints, RAG search, agentic tool-use, MCP servers).
日本語の概要は準備中です。原文の説明を表示しています。
AI integration review patterns. Use when reviewing model API calls, prompt construction, LLM output handling, RAG pipelines, and tool-calling code. Covers prompt-injection call-chain tracing, output validation, token budgets, retry/timeout handling, streaming, and key/PII exposure.
日本語の概要は準備中です。原文の説明を表示しています。
Backend code review patterns. Use when reviewing API routes, database operations, auth middleware, and server utilities. Covers injection, boundary validation, authorization coverage, secret/PII exposure, error leakage, and query patterns.
日本語の概要は準備中です。原文の説明を表示しています。
Analyzes a memory image with Volatility 3 to find malware: rogue processes, injected code, suspicious network connections, loaded modules, and persistence, then extracts artifacts for further analysis. Activates for requests to do memory forensics, analyze a RAM dump, or hunt malware in memory with Volatility.
日本語の概要は準備中です。原文の説明を表示しています。
Analyzes a PE file's import and export tables to infer capability: mapping imported APIs to behaviors (networking, crypto, injection, persistence), spotting dynamic-resolution stubs, and reading exports of malicious DLLs. Activates for requests to analyze PE imports, inspect the IAT/exports, or infer capability from API usage.
日本語の概要は準備中です。原文の説明を表示しています。
Analyzes banking trojan webinject configurations to extract targeted institutions, injected JavaScript/HTML, and data-theft hooks, mapping the fraud workflow. Activates for requests to analyze banking trojan webinjects, parse a webinject config, or map targeted banks and credential-theft injections.
日本語の概要は準備中です。原文の説明を表示しています。
Analyzes API call traces from a sandbox or API monitor (JSON) to group calls by category, reconstruct high-level behaviors (process injection, file drops, network, crypto), and flag suspicious call sequences. Activates for requests to analyze an API trace, interpret sandbox API logs, or identify behavior from Win32/Native API calls.
日本語の概要は準備中です。原文の説明を表示しています。
VContainer dependency injection patterns for Unity including lifecycle management, scoped registrations, and common pitfalls.
日本語の概要は準備中です。原文の説明を表示しています。
Sales enablement, technical presales and deal acceleration for B2B SaaS revenue teams. Use this skill when planning outbound campaigns, running discovery calls, building deal strategy, creating battle cards, writing proposals, responding to RFPs, preparing a product demo, scoping a proof of concept or pilot, answering a security questionnaire or the AI annex buyers now attach to it, executing sales sequences, coaching qualification, or deciding what the website's AI chat agent is allowed to say. Also triggers on: outbound, cold outreach, reply handling, reply classification, out-of-office replies, auto-replies counted as replies, our reply rate is inflated, prospect replied remove me, opt-out by reply, is this list ready to send, launch readiness, CRM segment outbound, we emailed a current customer, outbound hit an open opportunity, ownerless leads, prospects engaging our competitors, competitor connections, displacement list, is this personalization creepy, can we mention they visited our site, signal freshness, deal strategy, pipeline, battle card, objection handling, common objections, why do we keep hearing this objection, mine call transcripts for objections, objection register, proposal, RFP, discovery call, MEDDPICC, sales sequence, qualification, sales engineer, solutions engineer, presales, demo plan, demo script, POC, proof of concept, pilot success criteria, technical evaluation, technical win, security questionnaire, vendor security review, SOC 2 questionnaire, AI security questionnaire, AI annex, AI vendor due diligence, the buyer is asking if we train on their data, do you train on customer data, which model do you use, model provider sub-processor, AI subprocessor disclosure, where does inference run, can the customer turn the AI feature off, AI-CAIQ, CSA AI Controls Matrix, ISO 42001, ISO/IEC 42001, NIST AI RMF, EU AI Act Article 50, are we a provider or a deployer, AI feature disclosure, our model vendor changed and nobody told the buyer, technical objection, mutual action plan, MAP, close plan, mutual close plan, buyer enablement, the deal is stalled, deal stalled after the demo, how do I get this deal to close, close date keeps slipping, JOLT, buyer indecision, no-decision loss, website chatbot, chat widget, AI chat agent, AI SDR, inbound AI SDR, conversational marketing, live chat, what should our chatbot be allowed to say, our chatbot quoted the wrong price, the bot promised a discount, do we have to disclose it is AI, EU AI Act chatbot disclosure, chatbot handoff to sales, chat transcript review, prompt injection on our chatbot, Drift, Qualified, Intercom.
日本語の概要は準備中です。原文の説明を表示しています。
Marketing analytics and data-driven optimization for B2B SaaS campaigns. Use this skill when analyzing marketing performance, optimizing conversion rates, running A/B tests, conducting customer research, creating marketing dashboards, building attribution models, analyzing funnel metrics, or storytelling with data. Also triggers on: marketing ops, performance analytics, CRO, A/B testing, data storytelling, customer insights, tracking plan, event taxonomy, UTM taxonomy, GA4 audit, consent mode, instrumentation contract, sample size calculation, minimum detectable effect, test duration, not enough traffic to A/B test, statistical significance, Bayesian vs frequentist, sample ratio mismatch, experiment feasibility, martech stack, marketing tech stack audit, tool consolidation, build vs buy, vendor evaluation, shadow IT tools, ESP/CRM/platform migration, switching cost, cutover plan, suppression list migration, data portability, customer interviews, survey design, sampling frame, non-response bias, how many people should I interview, thematic saturation, voice of customer, jobs-to-be-done, buyer persona research, is this finding real, data enrichment, which enrichment provider should we buy, waterfall enrichment, contact data quality, match rate, our list data is bad, email verification, catch-all domain, accept-all, bounce rate from bad data, B2B data decay, how often should we re-verify contacts, ZoomInfo vs Apollo vs Clearbit evaluation, cost per usable record, where did this list come from, GDPR Article 14 notice, purchased list compliance, suppression screening, TAM list building, demand planning, marketing plan, how many leads do we need, what pipeline target should marketing carry, funnel model, top-down vs bottom-up plan, plan of record, annual marketing planning, quarterly planning, pipeline coverage we have to create, sales cycle lag, our leads cannot close this quarter, carry-in pipeline, scenario planning, conservative moderate aggressive forecast, stretch target, reforecast, re-forecast triggers, assumption register, capacity ceiling, addressable audience ceiling, marginal cost per lead, blended CPL is wrong, we missed plan and nobody knows why, AI policy for the marketing team, AI governance, AI acceptable use policy, which AI tools are we allowed to use, can I paste customer data into ChatGPT, shadow AI, AI use register, human review of AI output, when can we stop reviewing every AI draft, can the agent send on its own, the AI made a mistake now what, pull back AI autonomy, AI evals, our AI vendor changed the model, AI output went out wrong, prompt injection, can our AI read prospect replies safely, lethal trifecta, the AI leaked internal notes, turn off auto-generated ad assets, auto-applied recommendations, AI literacy training, EU AI Act Article 4, duplicate records in the CRM, dedupe before import, which value wins in a merge, CRM cleanup.
日本語の概要は準備中です。原文の説明を表示しています。
Guideline for designing, implementing, and verifying secure TypeScript and JavaScript applications following OWASP Top 10 best practices. Use when the user wants to: (1) review TypeScript or JavaScript code for security vulnerabilities, (2) design a secure Node.js, Deno, or browser application architecture, (3) implement security features (authentication, authorization, cryptography, input validation), (4) audit npm/yarn/pnpm dependencies for known vulnerabilities, (5) create security checklists or verification plans, (6) fix security bugs or harden existing TypeScript or JavaScript code, (7) set up security testing and static analysis (ESLint security plugins, Semgrep, Snyk), or (8) handle any TypeScript/JavaScript security concern including injection prevention, prototype pollution, XSS protection, SSRF prevention, secrets management, and secure deployment.
日本語の概要は準備中です。原文の説明を表示しています。
Guideline for designing, implementing, and verifying secure Python applications following OWASP Top 10 best practices. Use when the user wants to: (1) review Python code for security vulnerabilities, (2) design a secure Python application architecture, (3) implement security features (authentication, authorization, cryptography, input validation), (4) audit Python dependencies for known vulnerabilities, (5) create security checklists or verification plans, (6) fix security bugs or harden existing Python code, (7) set up security testing and static analysis (bandit, safety, semgrep), or (8) handle any Python security concern including injection prevention, secure deserialization, SSRF protection, secrets management, and secure deployment.
日本語の概要は準備中です。原文の説明を表示しています。
Use when building Python 3.11+ applications requiring type safety, async programming, or robust error handling. Generates type-annotated Python code, configures mypy in strict mode, writes pytest test suites with fixtures and mocking, and validates code with black and ruff. Invoke for type hints, async/await patterns, dataclasses, dependency injection, logging configuration, and structured error handling.
日本語の概要は準備中です。原文の説明を表示しています。
Analyzes code diffs and files to identify bugs, security vulnerabilities (SQL injection, XSS, insecure deserialization), code smells, N+1 queries, naming issues, and architectural concerns, then produces a structured review report with prioritized, actionable feedback. Use when reviewing pull requests, conducting code quality audits, identifying refactoring opportunities, or checking for security issues. Invoke for PR reviews, code quality checks, refactoring suggestions, review code, code quality. Complements specialized skills (security-reviewer, test-master) by providing broad-scope review across correctness, performance, maintainability, and test coverage in a single pass.
日本語の概要は準備中です。原文の説明を表示しています。
FastAPI guidance — typed endpoints, Pydantic validation, dependency injection, async patterns, and production deployment.
日本語の概要は準備中です。原文の説明を表示しています。
Chaos engineering — designing safe failure-injection experiments to build resilience — use when proactively testing system robustness.
日本語の概要は準備中です。原文の説明を表示しています。
One-command PR gate that runs four passes over exactly the changed surface — code review (correctness then simplification), security (injection, authz, secrets, dependency diff), tests (run the suite and flag untested changed lines).
日本語の概要は準備中です。原文の説明を表示しています。
Image optimization analysis for SEO and performance. Checks alt text, file sizes, formats, responsive images, lazy loading, CLS prevention, image SERP rankings (via DataForSEO), and image file optimization (WebP/AVIF conversion, IPTC/XMP metadata injection). Use when user says "image optimization", "alt text", "image SEO", "image size", "image audit", "optimize images", "image metadata", "image SERP", "convert to webp", or "image file optimize".
日本語の概要は準備中です。原文の説明を表示しています。
Semantic topic cluster planning and automated execution engine for claude-blog. Performs SERP-based keyword research, groups keywords by search intent and SERP overlap, builds a hub-and-spoke cluster architecture, generates an interactive SVG cluster map, and executes the full cluster by orchestrating blog-write calls with shared cluster context and automatic internal-link injection. Fills the strategy-to-execution gap: blog-strategy plans the blueprint, blog-cluster builds the house. Use when user says "blog cluster", "topic cluster", "content cluster", "cluster plan", "cluster execute", "pillar content", "hub and spoke", "content ecosystem", "cluster map".
日本語の概要は準備中です。原文の説明を表示しています。
Router for the 49 SfSkills `security` skill packages. Platform security and compliance: org hardening, encryption, session policy, MFA, monitoring, incident response, and TROUBLESHOOTING a specific record-access denial. Designing the sharing model itself (OWD, role hierarchy, sharing rules) is salesforce-admin. Use when the request mentions security, org hardening, Shield, platform encryption, field audit trail, MFA, SSO, SAML, session policy, guest user, event monitoring, GDPR, XSS, injection, why can this one user see this record, Apex managed sharing, sharing recalculation. Finds and opens the exact skill package to read; it does not contain the guidance itself.
日本語の概要は準備中です。原文の説明を表示しています。
Router for the 53 SfSkills `agentforce` skill packages. Agentforce and Einstein: agents, topics, actions, prompt templates, grounding, guardrails, evaluation and production readiness. Use when the request mentions Agentforce, agent topic, agent action, prompt builder, Einstein, Trust Layer, grounding, RAG, guardrails, agent evaluation, prompt injection. Finds and opens the exact skill package to read; it does not contain the guidance itself.
日本語の概要は準備中です。原文の説明を表示しています。
Scan code for security vulnerabilities, misconfigurations, and exposed secrets. Use when a user asks to audit security, find vulnerabilities, check for OWASP issues, scan for secrets, review dependencies for CVEs, detect SQL injection, find XSS vulnerabilities, or harden an application. Covers OWASP Top 10, dependency auditing, secrets detection, and generates fix recommendations with severity ratings.
日本語の概要は準備中です。原文の説明を表示しています。