「defensive」の検索結果

Remove AI-generated code slop, unnecessary comments, and over-engineering from the current branch diff. Cleans up boilerplate, simplifies abstractions, strips defensive code, and in skill-file mode lints SKILL.md files for quality. Use when cleaning up code, simplifying, removing boilerplate, before committing, or when reviewing a skill before promoting it.

日本語の概要は準備中です。原文の説明を表示しています。

Build safe, local, defensive reproductions of ALREADY-PATCHED, publicly disclosed security vulnerabilities (CVEs, vendor advisories, AI-agent incidents) for whitepapers, control testing, and education. Use this skill whenever the user wants to reproduce, demonstrate, or write up a known vulnerability or security incident — phrases like "reproduce this CVE", "build a repro for", "demonstrate the EchoLeak/Cursor/postmark-mcp issue", "show how this exploit worked", "add a reproducibility guide", or "pull the NVD/CVE details for". It fetches advisory metadata from NVD and CVE.org, confirms the issue is fixed, and produces a vulnerable-vs-patched harness that is offline, loopback-only, and uses synthetic markers. It NEVER discovers, develops, or weaponizes new zero-days and refuses any unpatched or live-target request.

日本語の概要は準備中です。原文の説明を表示しています。

Polish reviewer-response letters by softening defensive language, preserving factual meaning, and keeping responses professional, concise, and publication-appropriate.

日本語の概要は準備中です。原文の説明を表示しています。

Use when evaluating markets through Howard Marks-style second-level thinking, credit cycles, risk premiums, market psychology, and defensive versus aggressive posture.

日本語の概要は準備中です。原文の説明を表示しています。

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Handles static/dynamic analysis, unpacking, and IOC extraction. Use PROACTIVELY for malware triage, threat hunting, incident response, or security research.

日本語の概要は準備中です。原文の説明を表示しています。

Master of defensive Bash scripting for production automation, CI/CD pipelines, and system utilities. Expert in safe, portable, and testable shell scripts.

日本語の概要は準備中です。原文の説明を表示しています。

Remote API traps in Kotlin Multiplatform: Ktor clients, defensive parsing, Resource envelopes, OK responses that dropped your data, auth callbacks, retry backoff, downloads, websockets, clock sync. Use when calls succeed but data never lands.

日本語の概要は準備中です。原文の説明を表示しています。

Use when writing MATLAB functions with arguments blocks — repeating arguments (arguments (Repeating)), .?ClassName property import in constructors, name-value forwarding with namedargs2cell, or migrating from inputParser or validateattributes. Also when reviewing signatures for implicit-conversion pitfalls (size reshaping, class coercion, computed defaults), or when restricting, constraining, or validating function inputs — scalar vs vector enforcement, type rejection, size checking. Also when asked to harden inputs, make a function more robust, tighten input checking, or rewrite for safer input acceptance — even without "validation" or "arguments block" wording. Triggers on: arguments block, mustBe validators, name-value arguments, varargin, inputParser, nargin/narginchk, restrict input, type checking, scalar constraint, harden inputs, defensive programming. Not for: App Designer callbacks, Simulink mask parameters, class inheritance, or runtime validation outside function or property declarations.

日本語の概要は準備中です。原文の説明を表示しています。

通用防御性编码规范，适用于跨语言代码修改中的最小改动、真实边界处理、定向验证，以及约束假想风险驱动的过度兜底或抽象；不负责语言细节、正式 review 或结构化 debug。

日本語の概要は準備中です。原文の説明を表示しています。

When the user wants to choose an SEO-friendly domain for a new site—brand vs keyword domain, TLD selection, or domain best practices. Also use when the user mentions "domain choice," "pick domain," "SEO-friendly domain," "brand domain," "EMD," "PMD," "exact match domain," "partial match domain," "TLD," ".ai domain," ".com vs .io," "domain length," "domain history," or "defensive domain registration." For migration, use rebranding-strategy.

日本語の概要は準備中です。原文の説明を表示しています。

Validates defensive controls with paired authorized action and observation evidence, distinguishing blocked, prevented, detected, responded, and telemetry-gap outcomes. Use for purple-team validation design or offline fixture review; not unsanctioned testing or production efficacy claims.

日本語の概要は準備中です。原文の説明を表示しています。

Long-running iterative cycle — one entry, seven modes (debug|improve|planex|review|security|defensive|ui). Shared archaeology/audit → fix → verify → generalize → discover → persist skeleton with mode-specific dimensions. User-invoked campaign entry; single-step fixes route via /maestro-next

日本語の概要は準備中です。原文の説明を表示しています。

Remove AI-generated code slop from branches. Use after AI-assisted coding sessions to clean up defensive bloat, unnecessary comments, type casts, and style inconsistencies. Focuses on identifying and removing AI artifacts that degrade code quality.

日本語の概要は準備中です。原文の説明を表示しています。

Applies NASA Power of 10 rules for safety-critical verifiable code. Use when auditing financial, medical, or high-reliability system code.

日本語の概要は準備中です。原文の説明を表示しています。

A 股主板流动性池内按趋势回踩（trend_pullback）产出买入候选与持仓卖出信号；另有 realtime_quotes 批量拉取现价快照。供下单前决策；不跑回测、不自动下单。Use when 用户要选股、看实时报价、判断买卖信号或检查持仓是否触发离场条件。

日本語の概要は準備中です。原文の説明を表示しています。

A 股全市场高流动性池内按趋势回踩（trend_pullback）产出买入候选与持仓卖出信号；另有 realtime_quotes 批量拉取现价快照。供下单前决策；不跑回测、不自动下单。Use when 用户要选股、看实时报价、判断买卖信号或检查持仓是否触发离场条件。

日本語の概要は準備中です。原文の説明を表示しています。

Vulnerability and security scan (defensive, your own repo): dependency CVEs plus risky code patterns (secrets, injection, weak authz), severity x reachability triaged and remediated without suppressing. Complements the built-in /security-review. Triggers on "absolute audit", "security audit", "are we vulnerable", "scan for CVEs", "check for secrets/injection", "harden this".

日本語の概要は準備中です。原文の説明を表示しています。

Checkable-ish surface presentation signals a reviewer notices first — duplicate/near-identical tables, leftover pipeline/template strings, too-few or LLM-looking figures, and page-padding. AUXILIARY ONLY and weak by design: a deterministic pass (tools/check_presentation.py — dup-table + pipeline-artifact) plus a fresh cross-model GROSS-cases-only semantic pass (thin-float, LLM-figure, page-padding), every above-info finding span-anchored to the evidence ledger (claims.json). The adjudicator CAPS everything at minor (SURFACE_ONLY_SKILLS + SURFACE_PATTERNS) — these contribute at most SOFT_FLAGS, never a HARD verdict — default false_positive_risk:high. NOTE: the pure AI writing-STYLE impressions (AI-flavor prose, defensive 'not-X-but-Y' hedging, narrative-arc, jargon-stuffing, invented codenames) MOVED to the zero-verdict-weight AIS track — for those use skills/ai-style-impressions, NOT this. Emits presentation-signals.findings.json; NEVER computes the verdict. Triggers: "presentation signals", "surface check", "duplicate tables", "排版信号".

日本語の概要は準備中です。原文の説明を表示しています。

红队渗透 / 攻防 — 受授权的红队作业者 + 渗透测试工程师 + 攻击型安全顾问的认知操作系统 (侦察 OSINT / 外网渗透 / 内网 AD 渗透 BloodHound + Kerberoasting + ADCS 利用 + 横向移动 / Web 应用渗透 OWASP WSTG / 移动 OWASP MASTG / 云渗透 AWS Azure GCP IAM 路径 + 容器逃逸 + K8s / C2 操作 Cobalt Strike Sliver Mythic Havoc + OPSEC / 初始访问 + AV EDR 绕过 (仅授权场景) / 无线 RF / 物理社工 / 报告与整改 / 框架 MITRE ATT&CK + D3FEND + PTES + OSSTMM + NIST 800-115 + Kill Chain / 法律伦理 CFAA + 网络安全法 + 刑法 285 286 + 数据安全法 + GDPR + 授权书 + 范围 + 交战规则 — 不含 黑产 / 未授权攻击 / 大规模 exploitation / 供应链投毒 / 未授权 DoS — 这是 重罪 + 行业封杀 + 律师吊销, 本 skill 严守 authorized-only 边界 — 也不含 蓝队 SOC + 恶意软件 即服务 / 僵尸网络 / 勒索软件作者 — 这是 cybercrime 不是 红队) (Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasion (phishing infrastructure, payload development, AV / EDR evasion, BYOVD, AMSI / ETW bypass — strictly for authorized engagements), (i) wireless / RF (WPA2/3, evil twin, Wi-Fi pivots), (j) physical / social engineering (badge cloning, pretexting, vishing — under engagement letter), (k) reporting & remediation (executive summary, technical findings, CVSS, MITRE ATT&CK mapping, retest), (l) frameworks & methodology (MITRE ATT&CK, MITRE D3FEND, PTES, OSSTMM, NIST SP 800-115, OWASP WSTG / MASTG, Cyber Kill Chain, Unified Kill Chain, Diamond Model), (m) law & ethics (CFAA US, Computer Misuse Act UK, 中国 刑法 285/286 + 网络安全法 + 数据安全法, GDPR for tested EU systems, engagement letter, scope, rules of engagement, safe harbor for bug bounty); NOT criminal hacking / 黑产 / unauthorized targeting / mass exploitation / supply-chain compromise / DoS against unconsented systems (这是 重罪 + 业内开除 + 律师执照吊销, 本 skill 严守 authorized-only 边界), NOT pure defensive blue team / SOC analyst tradecraft (是 平行学科, 仅做 边界标注 + ATT&CK 反推方向), NOT malware-as-a-service development / botnet ops / ransomware authoring (是 cybercrime 不是 红队), NOT 'ethical hacking' 在 'just curious 看看' 自我合理化的灰色操作 (违反 authorization 原则即不是 红队).) Master OS — automated mastery of Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasi

日本語の概要は準備中です。原文の説明を表示しています。

投行并购 (投行并购 / 交易撮合 (Investment Banking M&A / Dealmaking) — 面向并购顾问、企业融资、卖方/买方交易执行的职业认知操作系统，从业者(分析师 Analyst / 经理 Associate / 副总裁 VP / 董事 Director / 董事总经理 MD / 内部公司发展 Corp Dev / PE 投资人)、想入行者、以及服务这行(法律/会计/估值/咨询)的视角。覆盖: (a) 第一性张力 — 投行 M&A 的核心世界观分歧: **价格 vs 价值 (price 是市场愿意付的, value 是内在的, deal 在两者缝隙里成交) ⇄ 确定性 vs 最高价 (certainty of close 对卖方常胜过纸面最高报价) ⇄ 顾问/中介 vs 委托代理 (banker 是 agent, 客户利益 vs 成交费的激励冲突真实存在, 「banker 总想成交」是行业原罪批判)**; 更深层 — 「过程/竞价纪律 (controlled auction 制造竞争张力、信息不对称管理) ⇄ 关系/信任 (relationship banking、长期 coverage、reputational capital)」, 「叙事/包装 (the story, equity story, positioning) ⇄ 数字/尽调 (the numbers, diligence, quality of earnings)」, 「估值的科学外衣 (DCF/comps 的伪精确) ⇄ 谈判的真实定价 (价格由 leverage、竞争、时机决定)」; (b) 估值与分析正典 (最标准化、最易蒸出高质量+CLI 化) — DCF (折现现金流: FCF 预测/WACC 折现率/terminal value 终值/Gordon growth vs exit multiple), Comparable Companies (可比公司/trading comps: EV/EBITDA, EV/Revenue, P/E), Precedent Transactions (先例交易/deal comps: control premium 控制权溢价), LBO (杠杆收购模型: IRR/MOIC/debt schedule/sources & uses), Accretion/Dilution (增厚/摊薄分析: EPS 影响、pro forma), Sum-of-the-Parts (分部估值/SOTP), Football Field (估值区间图), Merger Model (合并模型: synergies 协同/purchase accounting/goodwill), Sensitivity/scenario; (c) 交易流程与产出物 — 卖方流程 (sell-side: teaser 简介 → NDA → CIM/IM 信息备忘录 → management presentation → IOI 意向函 → data room 数据室 → LOI/term sheet → confirmatory diligence → SPA 买卖协议 → signing → closing), 买方流程 (buy-side: thesis/sourcing → outreach → valuation → bid → exclusivity → diligence → financing → close), auction 类型 (broad/targeted/negotiated/preemptive bid); 产出物: pitchbook 推介材料、CIM、fairness opinion 公平意见、board presentation、fee letter、engagement letter; (d) 交易结构与条款 — consideration (cash/stock/mix/earnout 对赌)、deal protections (breakup fee 分手费/go-shop/no-shop/MAC 重大不利变化条款)、representations & warranties 陈述与保证、escrow 托管、working capital adjustment 营运资金调整、reverse termination fee、collar 价格区间、tender offer vs merger、hostile vs friendly、defensive tactics (poison pill 毒丸/white knight 白衣骑士/staggered board); (e) 行业结构与角色 — bulge bracket (高盛/摩根士丹利/JPM/BofA/花旗) vs elite boutique (Centerview/Evercore/Moelis/Lazard/PJT/Perella) vs middle market (Houlihan Lokey/William Blair/Harris Williams) vs regional/independent; analyst→associate→VP→director→MD 晋升金字塔; coverage (行业组) vs product (M&A/ECM/DCM/leveraged finance/restructuring); sponsors group (服务 PE); 买方包括 PE/strategic acquirer/corp dev; (f) 量化指标与节奏 — deal fee (success fee 业内通常约 1-2% 视规模递减/retainer/Lehman formula)、league table 排行榜、pitch→mandate 转化、deal velocity、hours culture (analyst 80-100h/week 文化批判)、bonus/comp 结构、deal sheet (简历上的成交清单); (g) 争议/批判 — fairness opinion 是否橡皮图章 (利益冲突: 出意见的 banker 也收成交费)、estimate 的伪精确 (DCF garbage in garbage out、假设驱动结论)、banker 永远建议成交 (deal 偏见、empire building 助推 CEO 自利并购)、协同效应系统性高估 (大量并购毁灭价值、winner's curse 赢家诅咒)、analyst 血汗工厂文化 (2021 高盛 13 人 deck 事件、过劳死争议)、advisory 价值 vs 中介寻租之争、bulge vs boutique 的利益独立性叙事 (boutique 标榜「无承销利益冲突」)、SPAC 泡沫与 de-SPAC 教训; (h) 流派/思想谱系 — 估值学派 (Aswath Damodaran 估值教父/纽大、Tim Koller McKinsey《Valuation》、McKinsey valuation 体系) vs 公司金融教科书派 (Rosenbaum & Pearl《Investment Banking》行业圣经、Brealey Myers Allen、CFI/WSP/BIWS 培训体系) vs 交易实战派 (Bruce Wasserstein《Big Deal》、Joseph Perella/Felix Rohatyn 老派 dealmaker、现代 boutique 创始人) vs 行为/批判派 (并购毁灭价值的学术证据、Damodaran 对协同/控制权溢价的批判、Matt Levine《Money Stuff》解构华尔街逻辑) vs PE/buy-side 视角 (LBO 数学、value creation 杠杆/运营/multiple expansion)。不含: 二级市场股票交易/卖方研究 (equity research)、零售财富管理/private banking、纯 ECM/IPO 承销执行 (虽相关但聚焦 M&A advisory)、纯 PE 投后运营、量化交易/对冲基金策略、纯公司财务报表会计。) Master OS — automated mastery of 投行并购 / 交易撮合 (Investment Banking M&A / Dealmaking) — 面向并购顾问、企业融资、卖方/买方交易执行的职业认知操作系统，从业者(分析师 Analyst / 经理 Associate / 副总裁 VP / 董事 Director / 董事总经理 MD / 内部公司发展 Corp Dev / PE 投资人)、想入行者、以及服务这行(法律/会计/估值/咨询)的视角。覆盖: (a) 第一性张力 — 投行 M&A 的核心世界观分歧: **价格 vs 价值 (price 是市场愿意付的, value 是内在的, deal 在两者缝隙里成交) ⇄ 确定性 vs 最高价 (certainty of close 对卖方常胜过纸面最高报价) ⇄ 顾问/中介 vs 委托代理 (banker 是 agent, 客户利益 vs 成交费的激励冲突真实存在, 「banker 总想成交」是行业原罪批判)**; 更深层 — 「过程/竞价纪律 (controlled auction 制造竞争张力、信息不对称管理) ⇄ 关系/信任 (rela

日本語の概要は準備中です。原文の説明を表示しています。

Apply professional-grade security standards to any web application task. Use this skill when writing code that handles authentication, authorization, user input, APIs, file uploads, sessions, secrets, payments, or any data from external sources. Also use when the user asks to review, audit, or assess security of code or a web app. Covers OWASP Top 10 (2025), secure coding, threat modeling, and defensive architecture. Activate even when security is not explicitly mentioned — treat every web feature as a security surface.

日本語の概要は準備中です。原文の説明を表示しています。

Use for every task that plans, writes, edits, debugs, tests, refactors, reviews, or maintains code. Apply to professional repositories, scripts, apps, services, prototypes, beginner work, vibe coding, and bounded code changes inside large systems. Choose the fewest clear lines, files, paths, states, and abstractions that correctly implement the requested behavior. Do not invent fallbacks, compatibility paths, defensive layers, or future scale without evidence. Do not use for ordinary conversation, emotional support, prose, translation, summarization, social-media content, or general research or technical discussion that is not part of planning, changing, or reviewing code. Never weaken real security, integrity, concurrency, compatibility, privacy, accessibility, legal, or regulatory requirements.

日本語の概要は準備中です。原文の説明を表示しています。

Engineering detection rules (Sigma/YARA), detection coverage mapping, threat hunting hypotheses, Purple Team Blue side, Detection-as-Code CI/CD. Use when defensive verification is needed.

日本語の概要は準備中です。原文の説明を表示しています。

Design detection rules for a threat — SIEM queries, alert logic, and MITRE ATT&CK mapping. Use when asked to "write a detection rule", "how do we detect this attack", or "build a SIEM query for this TTP".

日本語の概要は準備中です。原文の説明を表示しています。