「ref」の検索結果

Use this skill any time a spreadsheet file is the primary input or output. This means any task where the user wants to: open, read, edit, or fix an existing .xlsx, .xlsm, .csv, or .tsv file (e.g., adding columns, computing formulas, formatting, charting, cleaning messy data); create a new spreadsheet from scratch or from other data sources; or convert between tabular file formats. Trigger especially when the user references a spreadsheet file by name or path — even casually (like "the xlsx in my downloads") — and wants something done to it or produced from it. Also trigger for cleaning or restructuring messy tabular data files (malformed rows, misplaced headers, junk data) into proper spreadsheets. The deliverable must be a spreadsheet file. Do NOT trigger when the primary deliverable is a Word document, HTML report, standalone Python script, database pipeline, or Google Sheets API integration, even if tabular data is involved.

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill any time a .pptx file is involved in any way — as input, output, or both. This includes: creating slide decks, pitch decks, or presentations; reading, parsing, or extracting text from any .pptx file (even if the extracted content will be used elsewhere, like in an email or summary); editing, modifying, or updating existing presentations; combining or splitting slide files; working with templates, layouts, speaker notes, or comments. Trigger whenever the user mentions "deck," "slides," "presentation," or references a .pptx filename, regardless of what they plan to do with the content afterward. If a .pptx file needs to be opened, created, or touched, use this skill.

日本語の概要は準備中です。原文の説明を表示しています。

Tailor a resume to a job description with ATS keyword optimization, gap analysis, and rewritten bullets — zero fabrication. Use when the user wants /tailor for a single role, /batch for multiple JDs, career pivot reframing, or interview prep questions from a tailored application.

日本語の概要は準備中です。原文の説明を表示しています。

Use when creating or drafting DLS (Lumen team) Jira tickets: a bug, a task, or an epic broken down from a tab of the Lumen scope spreadsheet. Holds the DLS project conventions (title prefix, issue types, epics, labels) and the ticket templates. Also the source of truth for finding the current sprint's tickets.

日本語の概要は準備中です。原文の説明を表示しています。

Procedure for controlled, human-gated outbound README badge provisioning PRs (Issue #1817). Preflights upstream repositories, ensures single-badge placement with deep links, and records campaign outcomes without automated retries or multi-badge noise.

日本語の概要は準備中です。原文の説明を表示しています。

Write or refresh evidence-grounded editorial summaries for stablecoin detail pages, including draining the AI-summary candidate queue after scoring changes.

日本語の概要は準備中です。原文の説明を表示しています。

Review the retained annotation candidate queue and curate per-coin editorial history. Use weekly during active event periods, monthly otherwise, or on queue-health warnings; this does not restore the retired live chart overlay.

日本語の概要は準備中です。原文の説明を表示しています。

Drain the Pharos Dependency Map coverage-audit queues into evidence-refreshed edges, reviewed target dispositions, or documented deferrals. Use monthly after weekly production dependency audits, after dependency coverage drops, or when reviewing adapter gaps, material unlinked slices, symbol leads, duplicate/split groups, or unverifiable published edges.

日本語の概要は準備中です。原文の説明を表示しています。

Use when curating, refreshing, expiring, calibrating, or equivalence-testing evidence and publication inputs for the active Safety Score model. Not for unrelated scoring models or copy-only changes.

日本語の概要は準備中です。原文の説明を表示しています。

Refresh tracked pre-launch stablecoin milestones, dates, launch phases, featured content, and promotion evidence. Use for the recurring upcoming-assets review.

日本語の概要は準備中です。原文の説明を表示しています。

Use when designing or changing a component's public API, its composition, or its state model in libs/ui-react or libs/ui-rnative — layering (core vs internal vs primitives), BaseProps/Props splits, converting a component to compound / changing its composition with createSafeContext, controlled/uncontrolled state, prop-naming conventions, and cross-platform API parity. Load this before shaping a new component, changing its props, or refactoring its composition.

日本語の概要は準備中です。原文の説明を表示しています。

Server-Side Template Injection (SSTI) occurs when user input is embedded directly into a template engine (Jinja2, Twig, Freemarker, Pebble, Velocity, Smarty, Mako) and evaluated, enabling remote code execution. Detect via math expressions `{{7*7}}` returning `49`, or `${7*7}`, `<%= 7*7 %>`. Leads to full RCE via template sandbox escape, Python `__class__.__mro__` traversal, and Java reflection chains. Tools: tplmap, Burp Suite.

日本語の概要は準備中です。原文の説明を表示しています。

Use when hunting Pwn Request vulnerabilities where pull_request_target workflows checkout attacker-controlled PR code and execute it in a privileged context with access to repository secrets. Trigger on: "pwn request", "pull_request_target", "checkout PR head", "npm install in CI", "lifecycle scripts in CI", "preinstall script", "postinstall script", "package.json scripts CI", "npm ci ignore-scripts false", "actions/checkout ref pull request head sha", privileged workflow running PR code, "Gato-X", supply chain via PR lifecycle scripts.

日本語の概要は準備中です。原文の説明を表示しています。

Post-exploitation workflow. Covers privilege escalation (Linux SUID/sudo/kernel, Windows UAC/service/token), persistence assessment, local enumeration, credential harvesting, and pivot preparation. Structured workflows for Linux and Windows targets using impacket, netexec, john, linpeas/winpeas, and standard Kali tools. Includes kernel exploit reference tables, GTFOBins exploitation chains, Potato attack selection, Docker/container escapes, DLL hijacking, SSH key harvesting, credential recovery from memory, and Windows token manipulation. Chains from /pentester or /credential-audit when access is obtained.

日本語の概要は準備中です。原文の説明を表示しています。

Extract sensitive training data (PII, API keys, intellectual property, or code) directly from a deployed Large Language Model (LLM). This AI Red Teaming skill focuses on forcing models to regurgitate memorized, unredacted data from their massive internet-scraped datasets through repetition attacks, prefix continuation, and context window manipulation.

日本語の概要は準備中です。原文の説明を表示しています。

Execute an IPv6 DNS Spoofing attack using `mitm6` on an IPv4-only corporate network. Exploit default Windows behavior (preferring IPv6 DHCP/DNS) to intercept NTLMv2 hashes, force WPAD rogue proxy settings, and relay credentials to Active Directory services.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit modern Windows environments that prefer IPv6 by using mitm6 to intercept and spoof DHCPv6 and DNS traffic. This skill covers how to poison DNS resolution for the local network, forcing NTLM authentication to a rogue server for credential capture or relay.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit Document Object Model (DOM) Based Cross-Site Scripting (XSS) vulnerabilities. Unlike Reflected or Stored XSS, the attack payload is executed purely on the client-side as a result of modifying the DOM environment, often without the payload ever reaching the backend server.

日本語の概要は準備中です。原文の説明を表示しています。

Identify and exploit Insecure Direct Object Reference (IDOR) or Broken Object Level Authorization (BOLA) vulnerabilities specifically within GraphQL APIs. This skill focuses on manipulating node IDs, changing variables, and utilizing aliases to access unauthorized data.

日本語の概要は準備中です。原文の説明を表示しています。

Use when hunting GitHub Actions cache poisoning vulnerabilities where an attacker can inject malicious content into the CI/CD cache and have it restored by a privileged downstream workflow. Trigger on: "cache poisoning", "actions/cache", "actions/setup-node", "node_modules cache", "GitHub Actions cache", "pnpm cache", "LRU eviction", "10GB limit", "Cacheract", "poisoned cache", "workflow cache attack", supply chain via CI cache, "ng-renovate", "cache stuffing", scheduled workflow cache restore, shared cache key, "hashFiles package.json", cross-workflow cache, PR workflow release workflow same key, "npm install prefer-offline", Cacheract, Gato-X, supply chain npm token.

日本語の概要は準備中です。原文の説明を表示しています。

Identify and exploit Cross-Site Request Forgery (CSRF) vulnerabilities by bypassing weak or flawed anti-CSRF token implementations, SameSite cookie attributes, and Origin/Referer headers. Use this skill when testing state-changing web application endpoints for session riding attacks. Covers token removal, token fixation, multipart manipulation, and chaining with XSS for complete bypass.

日本語の概要は準備中です。原文の説明を表示しています。

CORS misconfiguration allows attacker-controlled origins to read sensitive cross-origin responses when servers echo the `Origin` header in `Access-Control-Allow-Origin` or set it to `*` with `Access-Control-Allow-Credentials: true`. Detect via `Origin: https://attacker.com` reflection in `Access-Control-Allow-Origin` response header, wildcard `*` on credentialed endpoints, and null origin acceptance. Tools: OWASP ZAP, Burp Suite, manual `fetch()` with `credentials: include`.

日本語の概要は準備中です。原文の説明を表示しています。

Audit and attack session cookies via missing Secure/HttpOnly/SameSite attributes, overly broad Domain/Path scope, non-expiring persistent cookies, absent __Host- and __Secure- prefixes, browser cache leakage (Cache-Control: no-store missing), session token predictability via Burp Sequencer analysis, server-side session not invalidated on logout, and SSO single-logout bypass. Tools: Burp Suite Repeater/Sequencer, OWASP ZAP, EditThisCookie, Tamper Data, Cookiebro.

日本語の概要は準備中です。原文の説明を表示しています。

Full ASVS 5.0 compliance assessment against a codebase and/or architecture diagrams. Reads all 346 controls from the companion CSV, performs targeted code analysis per control, and produces a complete matrix marked COMPLIANT / NON_COMPLIANT / NOT_RELEVANT — with per-control reasoning and evidence (code snippets, file:line references, diagram observations). Outputs a reviewed CSV matrix and a self-contained HTML evidence report.

日本語の概要は準備中です。原文の説明を表示しています。