Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session fixation, (6) JWT manipulation (forge token to another identity; crypto details → hunt-jwt-crypto), (7) password change without step-up (chain with login timing/length oracle), (8) social-recovery / security-question brute-force, (9) SSO subdomain takeover at OAuth redirect_uri. Chains: cookie theft + password oracle + no step-up = persistent ATO; lax redirect_uri = auth-code theft; dangling-CNAME takeover at redirect_uri = ATO. Validate: demonstrate real takeover of test account B from attacker A's session; OOB/Collaborator confirm blind token-leak steps. Use when hunting ATO chains, testing password reset / email change / MFA / OAuth / session / JWT, or chaining primitives toward Critical.
日本語の概要は準備中です。原文の説明を表示しています。
elementalsouls/Claude-BugHunter☆ 5,0732026年10月12日 更新
List directory contents including files and subdirectories. When you need to explore directory structure, find specific files, or check what exists in a folder.
日本語の概要は準備中です。原文の説明を表示しています。
openakita/openakita☆ 1,9992026年9月24日 更新
Generate, visually expand, optimize, diagnose, and route structured AI image prompts for adult female portraits. Use for lifestyle, curve-focused, fashion, oriental, fantasy, realism, beauty, CCD, low-key cinematic, studio, sport, travel, and e-commerce portrait requests; onboarding or usage help; parameter recommendations; prompt rewrites; image-to-prompt preparation; direct image generation; or identity- and product-preserving edits from authorized reference images. Preserve explicit user parameters and locked reference subjects while creating a coherent photography-directed scene.
日本語の概要は準備中です。原文の説明を表示しています。
liyue-aigc/female-portrait-director☆ 1,6582026年7月15日 更新
Use this skill when planning, redesigning, or reviewing Xiaohongshu carousel visuals, covers, 3:4 image posts, page-by-page visual direction, image-generation prompts, style selection, layout critique, or XHS captions. It acts as a senior visual director for 小红书图文, not a generic copywriting assistant.
日本語の概要は準備中です。原文の説明を表示しています。
ziguishian/xhs-visual-director-skill☆ 1,4002026年7月3日 更新
Viking Search tuning for specified policy directions. Use this when the user provides specific queries, a type of query, or a business policy direction, and asks to boost, suppress, or fix a class of search results through request-parameter passthrough. You must only perform read-only baseline evaluation and request-level candidate testing; do not modify search scenes, app config, dictionaries, recommend scenes, or primary recall parameters.
日本語の概要は準備中です。原文の説明を表示しています。
volcengine/SearchCLI☆ 1,1942026年10月10日 更新
Use when a creative task has no direction yet: finding inspiration, exploring looks or styles, proposing concept directions to pick between, building a moodboard or reference board, doing visual research, mining existing assets for a style, or escaping generic AI-looking output. Also when a saved Scenario collection should drive a new batch as art direction. Keywords: inspiration, moodboard, references, art direction, style exploration, concepts, serendipity, ideation, surprise me.
日本語の概要は準備中です。原文の説明を表示しています。
scenario-labs/skills☆ 9922026年10月13日 更新
Generate, evaluate, and narrow brand concepts during early ideation including positioning territories, naming candidates, mood directions, and narrative angles. Use this skill whenever the user is in the early phase of brand creation, exploring brand directions, brainstorming names, building moodboards, generating positioning options, or trying to choose between multiple brand directions. Triggers on brand ideation, brand concept, naming, brand name, name candidates, positioning, brand positioning, mood board, brand directions, exploring brands, early brand work, brand exploration, brand brainstorm, brand options. Also triggers when the user has multiple half-formed brand ideas and needs help converging on one, even if they do not say 'ideation' explicitly.
日本語の概要は準備中です。原文の説明を表示しています。
rampstackco/claude-skills☆ 9542026年10月7日 更新
Expert patterns for Godot 3D lighting including DirectionalLight3D shadow cascades, OmniLight3D attenuation, SpotLight3D projectors, VoxelGI vs SDFGI, and LightmapGI baking. Use when implementing realistic 3D lighting, shadow optimization, global illumination, or light probes. Trigger keywords: DirectionalLight3D, OmniLight3D, SpotLight3D, shadow_enabled, directional_shadow_mode, directional_shadow_split, omni_range, omni_attenuation, spot_range, spot_angle, VoxelGI, SDFGI, LightmapGI, ReflectionProbe, Environment, WorldEnvironment.
日本語の概要は準備中です。原文の説明を表示しています。
thedivergentai/Game-Design-Agentic-Skills☆ 8452026年10月13日 更新
Drive the LTX Director (Timeline) node. Its Add Image/Text/Audio buttons are DOM-only and cannot be clicked by an agent; edit the hidden timeline_data JSON widget instead. Load when a workflow contains LTXDirector / LTXDirectorGuide / PromptRelayEncodeTimeline, or when asked to add, move, retime, or remove timeline segments (image / text / audio / motion).
日本語の概要は準備中です。原文の説明を表示しています。
artokun/comfyui-mcp☆ 8172026年10月5日 更新
Turns a brief, script, scene breakdown, treatment, or story idea into ONE connected director's shotlist for Seedance 2.0 — a single editable HTML artifact with a global Style Prefix, an @-asset glossary, and named per-scene prompts (1a, 1b, 2a…) each in Style → Characters → Scene → CUT 1..N form. Use whenever the user says 'make a shotlist', 'break this script into prompts', 'generate Seedance prompts for this ad/film', 'turn this brief into a shot list', 'director's shotlist', or wants many connected scene prompts rather than one. Also use to revise an existing shotlist (edit-once-propagates: 'change the style prefix everywhere', 'rewrite scene 4', 'split prompt 6'). Each prompt targets 15s; longer scenes split across 1a/1b/1c under one scene number.
日本語の概要は準備中です。原文の説明を表示しています。
OSideMedia/higgsfield-ai-prompt-skill☆ 7332026年9月27日 更新
EU 사용자 대상 서비스용 Privacy Notice·Terms of Service·Consent Modal·Cookie Banner 자동 생성. GDPR (Regulation 2016/679) + ePrivacy Directive + Consumer Rights Directive 2011/83 + Digital Services Act + Digital Content Directive + Unfair Terms Directive 반영. 영문 인터뷰로 진행.
日本語の概要は準備中です。原文の説明を表示しています。
kimlawtech/korean-privacy-terms☆ 5902026年8月29日 更新
Generate, derive, optimize, and diagnose structured AI image prompts for luminous cinematic Eastern xianxia environments under one inherited master canon with measurable divine scale, fixed five-layer space, 40–60% content-bearing breathing air, monumental Eastern architecture, railing-free edges, and coherent immortals and costume. Cover one-location scenic landmarks, immense inhabited celestial realms, cloud-borne palace cities, high-key Eastern sky-megastructure imagery, and the explicit `仙界大境原典` creative route. Use for Chinese fantasy scenery, places where immortals live, heavenly capitals, colossal celestial gates, architectural fragments above cloud seas, measurable divine scale, unusual framing, color and lighting direction, style-preserving variants, prompt rewrites, diagnosis, or direct image generation. Support 16:9, 21:9, 4:3, 3:2, 4:5, and 9:16; default to 16:9 for one prompt and never infer a nine-image series from a vertical ratio.
日本語の概要は準備中です。原文の説明を表示しています。
liyue-aigc/xianxia-visual-director☆ 5762026年8月8日 更新
USE ONLY for (1) two or more projects with repeated MSBuild policy, targets, or package versions, or (2) an existing Directory.Build.props/targets/rsp hierarchy with an import, placement, or layering defect. A one-project repo without an existing Directory.Build file is outside scope; do not load this skill. Covers centralizing shared policy and targets, Directory.Packages.props across projects, parent hierarchy/import structure, props-versus-targets placement, and folder/project exceptions. An existing hierarchy defect remains in scope when only one project is affected. For property value or condition semantics use property-patterns. Exclude legacy-to-SDK migration and non-MSBuild systems.
日本語の概要は準備中です。原文の説明を表示しています。
managedcode/dotnet-skills☆ 4862026年10月13日 更新
Directs the current request through configured lower-tier agents. Use only for explicit /director or /dev-toolkit:director invocation.
日本語の概要は準備中です。原文の説明を表示しています。
jamditis/claude-skills-journalism☆ 4182026年10月5日 更新
Manages the absolute right to object to direct marketing under GDPR Article 21(2)-(3), covering immediate cessation of all direct marketing processing, suppression list management, cross-channel enforcement, and profiling for marketing purposes. Activate for marketing opt-out, unsubscribe, Art. 21(2), direct marketing objection queries.
日本語の概要は準備中です。原文の説明を表示しています。
mukul975/Privacy-Data-Protection-Skills☆ 3032026年3月17日 更新
Provides GDPR Article 14 information for personal data obtained from sources other than the data subject, covering timing requirements (within reasonable period, max one month), source disclosure, all required elements, and exemptions under Art. 14(5). Activate for Art. 14, indirect collection, third-party data source, indirect data notice queries.
日本語の概要は準備中です。原文の説明を表示しています。
mukul975/Privacy-Data-Protection-Skills☆ 3032026年3月17日 更新
Provides GDPR Article 13 information at the point of direct data collection, covering all required elements under Art. 13(1)(a)-(f) and Art. 13(2)(a)-(g), layered notice design, and timing requirements. Activate for Art. 13, direct collection notice, privacy notice at collection, data collection information queries.
日本語の概要は準備中です。原文の説明を表示しています。
mukul975/Privacy-Data-Protection-Skills☆ 3032026年3月17日 更新
Fix OAuth PKCE "Session not found" or "No code verifier" errors in SPAs after redirect from external auth server. Use when: (1) OAuth callback fails with session/verifier not found despite flow starting correctly, (2) PKCE code_verifier stored in sessionStorage is missing after redirect back from auth server, (3) Error only happens in production or cross-origin redirects, not in local dev. Root cause: sessionStorage is lost when the browser opens a new tab, changes browsing context, or certain browsers clear it during cross-origin navigation. Fix: use localStorage instead (clean up after exchange).
日本語の概要は準備中です。原文の説明を表示しています。
divinevideo/divine-mobile☆ 2662026年10月13日 更新
Extract structured company lists from directories with Firecrawl. Use for scraping YC, Crunchbase, Product Hunt, G2, startup directories, category directories, or custom company databases into JSON, CSV, CRM-ready lists, or research tables.
日本語の概要は準備中です。原文の説明を表示しています。
firecrawl/firecrawl-workflows☆ 1922026年8月21日 更新
Extract structured company lists from directories with Firecrawl. Use for scraping YC, Crunchbase, Product Hunt, G2, startup directories, category directories, or custom company databases into JSON, CSV, CRM-ready lists, or research tables.
日本語の概要は準備中です。原文の説明を表示しています。
firecrawl/skills☆ 1222026年10月9日 更新
Design and build websites with film-inspired visual systems, director-driven art direction, storyboard-first layout planning, and cinematic motion. Use when the user asks for a cinematic site, movie-style landing page, director-inspired UI, film-noir, sci-fi, romance, thriller, action, animation, or a movie-like website aesthetic, including requests phrased in Chinese. Do not use for generic web design unless the user explicitly wants a film or director reference.
日本語の概要は準備中です。原文の説明を表示しています。
akseolabs-seo/cinematic-ui☆ 742026年4月8日 更新
Use on any page build, redesign, or 'make it look better' request on a site that has (or needs) a saved Art Direction. Loads the direction before the first element is written, plans tokens in two passes against the direction's donts and the known AI-default aesthetics, builds with tokens preserved, checks the result with respira_check_design, and mints a live preview. Also the import lane for Claude Design output and other design-system documents.
日本語の概要は準備中です。原文の説明を表示しています。
respira-press/agent-skills-wordpress☆ 462026年9月13日 更新
Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for attack path analysis, Mimikatz for credential extraction, and Impacket for protocol-level attacks including Kerberoasting, AS-REP Roasting, and delegation abuse. Activates for requests involving Active Directory pentest, AD attack simulation, domain compromise testing, or Kerberos attack assessment.
日本語の概要は準備中です。原文の説明を表示しています。
galyarderlabs/galyarder-framework☆ 262026年10月11日 更新
Exploit AI applications using Indirect Prompt Injection. This skill focuses on hiding malicious instructions within data sources (web pages, documents, emails) that the LLM processes, causing the AI to execute unintended actions or leak data without direct user interaction.
日本語の概要は準備中です。原文の説明を表示しています。
ShulkwiSEC/bb-huge☆ 242026年7月11日 更新