「cti」の検索結果

Comprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script console remote code execution, Java remoting deserialization, credential store dumping, shared library injection), GitLab CI exploitation (YAML anchor injection, runner registration token abuse, CI variable extraction, protected branch bypass via merge request pipelines), and Azure DevOps pipeline agent compromise with service connection theft. Includes artifact poisoning techniques across all platforms, tooling guidance for gato and jenkins-attack-framework, and maps to MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Covers enumeration of pipeline configurations, privilege escalation from contributor to code execution, lateral movement through pipeline trust boundaries, and persistence via modified workflow definitions. Each technique section provides working exploitation code, detection indicators, and defensive countermeasures.

日本語の概要は準備中です。原文の説明を表示しています。

Author and review GitHub Actions workflow YAML safely so syntactically-valid YAML can't ship a workflow that GitHub Actions refuses to run. USE FOR: editing, adding, or reviewing any file under .github/workflows/, writing run-name/name/if/env/run values that contain ${{ }} expressions, diagnosing a run that fails with 'This run likely failed because of a workflow file issue' and no jobs starting, deciding when a workflow scalar must be quoted, validating workflows with actionlint. DO NOT USE FOR: authoring application YAML unrelated to GitHub Actions, Azure Pipelines, GitLab CI, or non-workflow YAML. SCOPE: this skill covers *syntactic/structural* correctness of workflow YAML (quoting, parsing, actionlint); for *semantic and functional* workflow design (what a workflow should do, agentic-workflow behavior), see .github/agents/agentic-workflows.agent.md — the two are complementary. INVOKES: actionlint (downloaded pinned binary) plus git/grep for inspection.

日本語の概要は準備中です。原文の説明を表示しています。

Walk the user through four directional axes (tone register, aesthetic philosophy, audience relationship, sensory ambition) and produce a structured aesthetic brief that downstream content, copy, design, and art-direction skills consume as required input. The aesthetic depth layer, distinct from `creative-brief` (operational kickoff: scope, audience, deliverables, constraints). Use when a project needs aesthetic coherence across many small decisions and the user has only a vague feeling, or when multiple downstream aesthetic-producing skills need a shared brief. Triggers on creative direction, aesthetic direction, set the aesthetic, define the visual direction, what's the vibe, what's the tone, the four axes. Does NOT fire for a general kickoff brief (use `creative-brief`), tactical single-piece work, already-documented direction, purely functional output, or locked production-stage work.

日本語の概要は準備中です。原文の説明を表示しています。

Author and review GitHub Actions workflow YAML safely so syntactically-valid YAML can't ship a workflow that GitHub Actions refuses to run. USE FOR: editing, adding, or reviewing any file under .github/workflows/, writing run-name/name/if/env/run values that contain ${{ }} expressions, diagnosing a run that fails with 'This run likely failed because of a workflow file issue' and no jobs starting, deciding when a workflow scalar must be quoted, validating workflows with actionlint. DO NOT USE FOR: authoring application YAML unrelated to GitHub Actions, Azure Pipelines, GitLab CI, or non-workflow YAML. SCOPE: this skill covers *syntactic/structural* correctness of workflow YAML (quoting, parsing, actionlint); for *semantic and functional* workflow design (what a workflow should do, agentic-workflow behavior), see .github/agents/agentic-workflows.agent.md — the two are complementary. INVOKES: actionlint (downloaded pinned binary) plus git/grep for inspection.

日本語の概要は準備中です。原文の説明を表示しています。

Implements technical breach detection capabilities including SIEM integration, DLP alert configuration, anomaly detection rules, and insider threat monitoring. Provides a breach classification taxonomy across confidentiality, integrity, and availability dimensions. Covers detection tool selection, alert tuning, and integration with privacy incident response workflows. Keywords: breach detection, SIEM, DLP, anomaly detection, insider threat, classification.

日本語の概要は準備中です。原文の説明を表示しています。

Expert patterns for Azure Functions development including isolated worker model, Durable Functions orchestration, cold start optimization, and production patterns. Covers .NET, Python, and Node.js programming models. Use when "azure function, azure functions, durable functions, azure serverless, function app, azure, serverless, functions, durable-functions, cloud" mentioned.

日本語の概要は準備中です。原文の説明を表示しています。

Sentence-level and section-level craft for instructions Claude will actually follow, in any container — project instructions, a standalone prompt, or skill body text. Use when the text exists or is being drafted and the question is quality: "why is Claude ignoring this instruction", "rewrite this prompt so it works", "improve my project instructions", "make this instruction stick", "is this too prescriptive", "how much structure does Sonnet need versus Opus". Covers imperative construction, positive framing, strategic-versus-procedural calibration per model, extended thinking, complexity scaling, and a quality checklist. For deciding WHICH container the instruction belongs in, use crafting-instructions. For building, testing and packaging a whole skill directory, use creating-skill.

日本語の概要は準備中です。原文の説明を表示しています。

Build and maintain a library collection through acquisitions, weeding (deaccessioning), collection assessment, reader advisory, and interlibrary loan coordination. Covers selection criteria, collection development policies, the CREW/MUSTIE method for weeding, usage analysis, and responsive collection management. Use when building a new collection with a defined scope and budget, assessing an existing collection for gaps or outdated materials, when shelves are overcrowded and systematic weeding is needed, or when establishing a formal collection development policy.

日本語の概要は準備中です。原文の説明を表示しています。

Expert in temporal event detection, spatio-temporal clustering (ST-DBSCAN), and photo context understanding. Use for detecting photo events, clustering by time/location, shareability prediction, place recognition, event significance scoring, and life event detection. Activate on 'event detection', 'temporal clustering', 'ST-DBSCAN', 'spatio-temporal', 'shareability prediction', 'place recognition', 'life events', 'photo events', 'temporal diversity'. NOT for individual photo aesthetic quality (use photo-composition-critic), color palette analysis (use color-theory-palette-harmony-expert), face recognition implementation (use photo-content-recognition-curation-expert), or basic EXIF timestamp extraction.

日本語の概要は準備中です。原文の説明を表示しています。

Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.

日本語の概要は準備中です。原文の説明を表示しています。

インシデント発生後の振り返りと根本原因分析を体系的に実施するスキル。 ログファイル解析や技術デバッグが必要な場合は log-debugger を使用すること。 本スキルはインシデント管理プロセス（タイムライン構築、影響評価、 是正措置計画、再発防止策）に特化する。ログデータの分析ではなく、 組織的な振り返りプロセスと是正措置の策定が主目的である。 Use when conducting post-incident reviews without log analysis, creating corrective action plans, or performing organizational root cause analysis focused on process improvement. NOT for log file debugging. Triggers: "post-incident review", "corrective action plan", "incident report作成", "再発防止策", "RCAレポート", "是正措置", "インシデント振り返り"

Configures the JetFormBuilder action events system — the named events (DEFAULT.PROCESS, DEFAULT.REQUIRED, GATEWAY.SUCCESS, GATEWAY.FAILED, BAD.REQUEST, ON.DYNAMIC_STATE, never) that decide WHEN a Form Action runs. Covers declaring supported / unsupported / required events on a custom action, the validation precedence inside Base_Event::is_valid_action(), the multi-event subscription model the action editor exposes, and how to register a brand-new event type via the 'jet-form-builder/event-types' filter using Base_Event, Base_Action_Event, or Base_Gateway_Event. Use when an action needs to run only on payment callbacks, only on validation failure, only on a specific conditional state, after another action's hidden flow, or when the plugin needs to define its own event class (e.g. for inbound webhooks). Triggers on mentions of "JFB events", "action events", "GATEWAY.SUCCESS", "DEFAULT.PROCESS", "supported_events", "unsupported_events", "get_required_events", "Base_Event", "Base_Gatewa...

日本語の概要は準備中です。原文の説明を表示しています。

Surfaces user-facing custom messages from a JetFormBuilder custom Form Action — both the idiomatic path (register message types via 'jet-form-builder/form-messages/register' so they appear in the form's Messages panel and can be overridden globally per form) and the action-local path (custom message fields inside the action editor, dispatched via Action_Exception for errors or via context + 'jet-form-builder/form-handler/after-send' + Messages_Manager::dynamic_success() for success messages). Use when a custom JFB action needs configurable messages for cases like "already subscribed", "duplicate row skipped", "API rate limited", or per-action success copy. Triggers on mentions of "JFB messages", "Action_Exception", "Base_Action_Messages", "jet-form-builder/form-messages/register", "_jf_messages", "dynamic_success", "add_context_once" with a message, "after-send" hook, or "custom action message".

日本語の概要は準備中です。原文の説明を表示しています。

Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.

日本語の概要は準備中です。原文の説明を表示しています。

Find and identify the CDecoyProjectile_Create factory in CS2 server binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the decoy projectile spawn factory. It is a non-virtual, direct-call static factory found via the entity classname string "decoy_projectile" it references (excluding the RTTI class string "CDecoyProjectile"). Emits a unique IDA-style byte signature and a func YAML. Mirrors the find-CDecoyProjectile_Create.py preprocessor (xref_strings FULLMATCH:decoy_projectile). Trigger: CDecoyProjectile_Create, CDecoyProjectile::Create, decoy projectile Create

日本語の概要は準備中です。原文の説明を表示しています。

Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.

日本語の概要は準備中です。原文の説明を表示しています。

Expert in temporal event detection, spatio-temporal clustering (ST-DBSCAN), and photo context understanding. Use for detecting photo events, clustering by time/location, shareability prediction, place recognition, event significance scoring, and life event detection. Activate on 'event detection', 'temporal clustering', 'ST-DBSCAN', 'spatio-temporal', 'shareability prediction', 'place recognition', 'life events', 'photo events', 'temporal diversity'. NOT for individual photo aesthetic quality (use photo-composition-critic), color palette analysis (use color-theory-palette-harmony-expert), face recognition implementation (use photo-content-recognition-curation-expert), or basic EXIF timestamp extraction.

日本語の概要は準備中です。原文の説明を表示しています。

TypeScriptのバックエンドでPrismaを使う際の設計・実装を支援します。検索や一括更新、移行、接続管理のパターンと注意点を具体例で確認できます。

• Prismaのモデルと関連を設計したいとき
• 検索処理とページ分割の見直し
• トランザクションや一括更新の不具合調査

AIエージェントの危険なコマンドを実行前に確認し、ファイル編集を指定ディレクトリ内に制限します。単独または併用のモードで、本番作業や自律実行時の操作を管理します。

• 本番作業で危険なコマンドを確認
• 特定ディレクトリだけ編集したいとき
• 自律実行時に保護を併用したいとき

ウォレットや取引の実行権限を持つAIエージェントについて、外部入力への対策、支出上限、送信前の検証、停止条件、秘密鍵の管理を設計・点検するスキル。

• 取引権限を持つボットを監査したいとき
• 取引ごと・日ごとの支出上限の設計
• 送信前検証と自動停止の設計

Expert India Digital Personal Data Protection Act, 2023 (DPDPA) compliance advisor. Use this skill whenever a user asks about the DPDPA, DPDP Act, DPDP Rules 2025, India data privacy law, Data Fiduciary obligations, Data Principal rights, Significant Data Fiduciary, Data Protection Board of India, consent under DPDPA, notice requirements, breach notification India, children's data India, cross-border data transfer India, India privacy compliance, DPDPA gap analysis, DPDPA vs GDPR, or any obligation under India's personal data protection framework. Also trigger for: "Section 6 consent", "Section 7 legitimate uses", "Section 9 children's data", "Section 10 SDF", "Section 16 cross-border", "Rule 6 breach notification", "Rule 13 SDF obligations", "Data Protection Board complaint", "verifiable parental consent India", "DPDPA compliance roadmap", or "India privacy law global company".

日本語の概要は準備中です。原文の説明を表示しています。

Expert India Digital Personal Data Protection Act, 2023 (DPDPA) compliance advisor. Use this skill whenever a user asks about the DPDPA, DPDP Act, DPDP Rules 2025, India data privacy law, Data Fiduciary obligations, Data Principal rights, Significant Data Fiduciary, Data Protection Board of India, consent under DPDPA, notice requirements, breach notification India, children's data India, cross-border data transfer India, India privacy compliance, DPDPA gap analysis, DPDPA vs GDPR, or any obligation under India's personal data protection framework. Also trigger for: "Section 6 consent", "Section 7 legitimate uses", "Section 9 children's data", "Section 10 SDF", "Section 16 cross-border", "Rule 6 breach notification", "Rule 13 SDF obligations", "Data Protection Board complaint", "verifiable parental consent India", "DPDPA compliance roadmap", or "India privacy law global company".

日本語の概要は準備中です。原文の説明を表示しています。

Implements data protection compliance for whistleblowing systems under EU Directive 2019/1937 and GDPR. Covers anonymous reporting channels, identity protection for whistleblowers and accused persons, retention limits, access restrictions, and retaliation prevention. Addresses national transpositions and DPA guidance. Keywords: whistleblower, Directive 2019/1937, anonymous reporting, identity protection, retaliation, retention, reporting channel.

日本語の概要は準備中です。原文の説明を表示しています。

Implements NIST SP 800-88 Rev. 1 media sanitization procedures including Clear, Purge, and Destroy methods for all media types. Covers certificate of destruction generation, verification procedures, vendor management for third-party destruction, and chain of custody documentation. Activate for data destruction, media sanitization, secure erasure, certificate of destruction queries.

日本語の概要は準備中です。原文の説明を表示しています。