8,556 件 ・ 関連度順
概要と使いどころ
Linux security mechanism bypass playbook. Use when facing restricted bash/rbash, read-only or noexec filesystems, AppArmor, SELinux, seccomp filters, or audit logging that must be evaded during post-exploitation.
日本語の概要は準備中です。原文の説明を表示しています。
Email infrastructure security audit. Tests SPF, DKIM, DMARC configuration, open relay, email spoofing resilience, S/MIME, MTA-STS, TLS-RPT, and SMTP security. Uses swaks, dnsrecon, nmap SMTP scripts, smtp-user-enum, and dig. Pure skill markdown — no new infrastructure needed.
日本語の概要は準備中です。原文の説明を表示しています。
Cloud security posture assessment for AWS, Azure, and GCP. Tests IAM privilege escalation paths, public storage exposure, serverless attack surface, database exposure, logging gaps, container registry security, and cloud-specific attacks. Both authenticated (with cloud credentials) and unauthenticated (external) modes. Uses nuclei cloud templates, Prowler, ScoutSuite, manual IMDS/metadata probing, and deep AWS/Azure/GCP CLI enumeration. Produces: cloud architecture diagram, attack path map, findings per category, compliance mapping (SOC 2, PCI DSS 4.0, HIPAA, CIS), PoCs for confirmed exploits. Chains into /gh-export for issue filing.
日本語の概要は準備中です。原文の説明を表示しています。
AI/ML security playbook. Use when assessing model supply chain attacks (pickle RCE, poisoned weights), adversarial examples, model poisoning, model stealing, data privacy attacks (membership inference, model inversion), and autonomous agent security risks.
日本語の概要は準備中です。原文の説明を表示しています。
Sales enablement, technical presales and deal acceleration for B2B SaaS revenue teams. Use this skill when planning outbound campaigns, running discovery calls, building deal strategy, creating battle cards, writing proposals, responding to RFPs, preparing a product demo, scoping a proof of concept or pilot, answering a security questionnaire or the AI annex buyers now attach to it, executing sales sequences, coaching qualification, or deciding what the website's AI chat agent is allowed to say. Also triggers on: outbound, cold outreach, reply handling, reply classification, out-of-office replies, auto-replies counted as replies, our reply rate is inflated, prospect replied remove me, opt-out by reply, is this list ready to send, launch readiness, CRM segment outbound, we emailed a current customer, outbound hit an open opportunity, ownerless leads, prospects engaging our competitors, competitor connections, displacement list, is this personalization creepy, can we mention they visited our site, signal freshness, deal strategy, pipeline, battle card, objection handling, common objections, why do we keep hearing this objection, mine call transcripts for objections, objection register, proposal, RFP, discovery call, MEDDPICC, sales sequence, qualification, sales engineer, solutions engineer, presales, demo plan, demo script, POC, proof of concept, pilot success criteria, technical evaluation, technical win, security questionnaire, vendor security review, SOC 2 questionnaire, AI security questionnaire, AI annex, AI vendor due diligence, the buyer is asking if we train on their data, do you train on customer data, which model do you use, model provider sub-processor, AI subprocessor disclosure, where does inference run, can the customer turn the AI feature off, AI-CAIQ, CSA AI Controls Matrix, ISO 42001, ISO/IEC 42001, NIST AI RMF, EU AI Act Article 50, are we a provider or a deployer, AI feature disclosure, our model vendor changed and nobody told the buyer, technical objection, mutual action plan, MAP, close plan, mutual close plan, buyer enablement, the deal is stalled, deal stalled after the demo, how do I get this deal to close, close date keeps slipping, JOLT, buyer indecision, no-decision loss, website chatbot, chat widget, AI chat agent, AI SDR, inbound AI SDR, conversational marketing, live chat, what should our chatbot be allowed to say, our chatbot quoted the wrong price, the bot promised a discount, do we have to disclose it is AI, EU AI Act chatbot disclosure, chatbot handoff to sales, chat transcript review, prompt injection on our chatbot, Drift, Qualified, Intercom.
日本語の概要は準備中です。原文の説明を表示しています。
Use when reviewing frontend security risks such as XSS, CSRF, sensitive data exposure, unsafe DOM APIs, untrusted user input, authentication/token handling, payment flows, file upload, CSP, dependency risk, or third-party scripts; Chinese triggers include security review, security check.
日本語の概要は準備中です。原文の説明を表示しています。
Use when a task needs the judgment of an Application Security Engineer — checking whether an endpoint verifies object-level authorization (not just authentication), running threat modeling at design time rather than deferring security review to the end, triaging a dependency vulnerability by actual reachability rather than CVSS score alone, combining SAST/DAST/SCA tooling to cover their distinct blind spots, or applying context-specific output encoding to untrusted input. Distinct from an information security analyst — this role works inside the SDLC to prevent vulnerabilities before they ship, not detect and respond to intrusions in production.
日本語の概要は準備中です。原文の説明を表示しています。
Security audit of a codebase — web apps, APIs, services, CLI tools, libraries, daemons, and more. Use when asked to find security bugs, do a security review, audit for vulnerabilities, or pen-test the code. Focuses on exploitable issues with real impact, not theoretical concerns or industry-standard behavior.
日本語の概要は準備中です。原文の説明を表示しています。
Analyzes code diffs and files to identify bugs, security vulnerabilities (SQL injection, XSS, insecure deserialization), code smells, N+1 queries, naming issues, and architectural concerns, then produces a structured review report with prioritized, actionable feedback. Use when reviewing pull requests, conducting code quality audits, identifying refactoring opportunities, or checking for security issues. Invoke for PR reviews, code quality checks, refactoring suggestions, review code, code quality. Complements specialized skills (security-reviewer, test-master) by providing broad-scope review across correctness, performance, maintainability, and test coverage in a single pass.
日本語の概要は準備中です。原文の説明を表示しています。
Guidance for working with Pulumi ESC (Environments, Secrets, and Configuration). Use when users ask about managing secrets, configuration, environments, short-term credentials, configuring OIDC for AWS, Azure, GCP, integrating with secret stores (AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, 1Password), or using ESC with Pulumi stacks.
日本語の概要は準備中です。原文の説明を表示しています。
Scan files, content, or recent changes for secrets such as API keys, passwords, tokens, and credentials using the GitHub MCP Server's run_secret_scanning tool.
日本語の概要は準備中です。原文の説明を表示しています。
Build and ship features with security baked in — runs OWASP Top 10 pre-scan, builds and ships with /ship, validates with post-build security review, then penetration tests the result. Use when shipping auth flows, payment logic, API endpoints, admin panels, or any security-sensitive code.
日本語の概要は準備中です。原文の説明を表示しています。
Write a vulnerability report. Use when the user says "vulnerability report", "vuln report", "security finding", "write up this finding", "pentest finding", "bug bounty report", "security disclosure", "CVE writeup", "document this vulnerability", "how to report a security issue", or needs to formally document a security vulnerability with evidence, impact, and remediation guidance - even if they don't explicitly say "report".
日本語の概要は準備中です。原文の説明を表示しています。
Router for the 49 SfSkills `security` skill packages. Platform security and compliance: org hardening, encryption, session policy, MFA, monitoring, incident response, and TROUBLESHOOTING a specific record-access denial. Designing the sharing model itself (OWD, role hierarchy, sharing rules) is salesforce-admin. Use when the request mentions security, org hardening, Shield, platform encryption, field audit trail, MFA, SSO, SAML, session policy, guest user, event monitoring, GDPR, XSS, injection, why can this one user see this record, Apex managed sharing, sharing recalculation. Finds and opens the exact skill package to read; it does not contain the guidance itself.
日本語の概要は準備中です。原文の説明を表示しています。
Refine academic writing for computer science research papers targeting top-tier venues (NeurIPS, ICLR, ICML, AAAI, IJCAI, ACL, EMNLP, NAACL, CVPR, WWW, KDD, SIGIR, CIKM, and similar). Use this skill whenever a user asks to improve, polish, refine, edit, or proofread academic or research writing — including paper drafts, abstracts, introductions, related work sections, methodology descriptions, experiment write-ups, or conclusion sections. Also trigger when users paste LaTeX content and ask for writing help, mention "camera-ready", "rebuttal", "paper revision", or reference any academic venue or conference. This skill handles both full paper refinement and section-by-section editing.
日本語の概要は準備中です。原文の説明を表示しています。
Securely inject secrets from 1Password into agent workflows. Uses service accounts with op run/.env.tpl as the primary pattern, op read as fallback. Includes hardened security rules, input validation, and troubleshooting for auth/permission failures. Use when accessing API keys, credentials, or any 1Password secret.
日本語の概要は準備中です。原文の説明を表示しています。
Scan projects for credential leaks, secrets in code, insecure patterns, LLM API key exposure, PII leakage to external AI services, and .env/.gitignore misconfigurations. Especially useful for data and API integrations, regardless of implementation language.
日本語の概要は準備中です。原文の説明を表示しています。
Design, implement, or review security-sensitive dygo behavior across auth, sessions, Permissions, secrets, APIs, database writes, files, Jobs, and Studio. Use when security boundaries are a primary concern.
日本語の概要は準備中です。原文の説明を表示しています。
OWASP ASVS v5.0 security verification skill with Drupal 11 mappings. Use when performing security code reviews, implementing security requirements, or verifying security compliance in Drupal projects.
日本語の概要は準備中です。原文の説明を表示しています。
Produces a practitioner-grade Blue Sky compliance memorandum and execution plan for U.S. securities offerings. Analyzes NSMIA covered securities preemption, classifies offerings under Regulation D/Rule 506 or alternative federal exemptions, maps state jurisdictional nexus distinguishing offers from sales, and generates a state-by-state filing plan with Form D/EFD workflow, fee schedules, amendment triggers, and renewal calendars. Use this skill when advising on private placement Blue Sky compliance, Reg D notice filings, multi-state offering coordination, state securities registration exemptions, Form D filings, EFD submissions, or state fee budgeting. Also trigger when the user mentions covered securities preemption, NSMIA analysis, or asks about state notice filing requirements. Even if the user just says "Blue Sky" or "state filings for our raise," use this skill.
日本語の概要は準備中です。原文の説明を表示しています。
Designs the first screen visitors see — the hero section. Layout patterns (split, centered, asymmetric, full-bleed), navbar design, headline typography, CTAs, background treatments (gradients, video, particles, 3D), scroll cues, and above-the-fold conversion strategy. Activate on 'hero section', 'landing page hero', 'above the fold', 'first impression', 'homepage header', 'navbar design', 'hero layout', 'landing page design'. NOT for full multi-page site architecture (use web-design-expert), not for SEO content strategy (use seo-visibility-expert).
日本語の概要は準備中です。原文の説明を表示しています。
Recommends against using fludrocortisone for mineralocorticoid replacement in patients with secondary adrenal insufficiency. Trigger phrases include: considering mineralocorticoid replacement for secondary adrenal insufficiency and secondary adrenal insufficiency patient needing mineralocorticoid replacement.
日本語の概要は準備中です。原文の説明を表示しています。
Automate AWS secrets rotation for RDS, API keys, and credentials
日本語の概要は準備中です。原文の説明を表示しています。
Review application and infrastructure changes for exploitable security risks by tracing assets, trust boundaries, attacker-controlled input, authorization, sensitive data, and dangerous sinks. Use for security reviews, threat-focused PR reviews, authentication or authorization changes, input handling, secrets, dependencies, and infrastructure permissions; do not use to exploit live systems or modify code unless separately requested.
日本語の概要は準備中です。原文の説明を表示しています。