8,559 件 ・ 関連度順
概要と使いどころ
Phased risk-centric security assessment framework. Trigger when: - Auditing code for vulnerabilities, checking SQL injection, access control, or buffer overflows. - Prompt contains: /security-audit, security audit, taint analysis, threat model, vulnerability.
日本語の概要は準備中です。原文の説明を表示しています。
Notion ページを描画する直前に粒度を検証したいとき、info-collector-agent ページと同等の section 充足度を section_canonical_map 基準で機械検証したいときに使う。
Use for security review, audit, hardening, compliance, DevSecOps, network, infrastructure, or application security with focused references.
日本語の概要は準備中です。原文の説明を表示しています。
Elite frontend image-direction skill for generating premium, conversion-aware website design references. CRITICAL OUTPUT RULE — generate ONE separate horizontal image FOR EVERY section. A landing page with 8 sections produces 8 images. Never compress multiple sections into one image. Enforces composition variety (not always left-text / right-image), background-image freedom, varied CTAs, varied hero scales (giant / mid / mini minimalist), narrative concept spine, second-read moments, and a single consistent palette across all images. Optimized for landing pages, marketing sites, and product comps that developers or coding models can accurately recreate.
日本語の概要は準備中です。原文の説明を表示しています。
Automate AWS secrets rotation for RDS, API keys, and credentials
日本語の概要は準備中です。原文の説明を表示しています。
Detect and prevent QR code phishing (quishing) attacks that bypass traditional email security by embedding malicious URLs in QR code images within emails.
日本語の概要は準備中です。原文の説明を表示しています。
Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity audit logs and JSON WAF event logs to identify SQLi patterns (UNION SELECT, OR 1=1, SLEEP(), BENCHMARK()), tracks attack sources, correlates multi-stage injection attempts, and generates incident reports with OWASP classification.
日本語の概要は準備中です。原文の説明を表示しています。
Deploy cloud-native deception across AWS, Azure, and GCP using decoy (honey) resources whose only purpose is to generate a high-fidelity alert the instant an attacker touches them: canary IAM access keys, permission-less decoy users/roles/service principals, honey object-storage buckets, and decoy secrets in Secrets Manager / Key Vault / Secret Manager. Wires detection through CloudTrail + EventBridge, Azure Sentinel honeytoken watchlists + Defender, and GCP Cloud Audit Logs, so any use of a decoy is routed to the SOC with near-zero false positives. Use when protecting cloud accounts and data stores, when an org has only on-prem honeypots and needs cloud coverage, when seeding fake AWS keys to catch credential theft and code-leak exposure, or when detecting cloud reconnaissance and lateral movement. Keywords: cloud deception, canary token AWS, honey S3 bucket, decoy IAM credentials, CloudTrail alert, GuardDuty, Sentinel honeytoken, decoy secret, honey service account, cloud honeypot, breach detection.
日本語の概要は準備中です。原文の説明を表示しています。
Detecting exposed AWS credentials in source code repositories, CI/CD pipelines, and configuration files using TruffleHog, git-secrets, and AWS-native detection mechanisms to prevent credential theft and unauthorized account access.
日本語の概要は準備中です。原文の説明を表示しています。
Configures host-based intrusion detection systems (HIDS) to monitor endpoint file integrity, system calls, and configuration changes for security violations. Use when deploying OSSEC, Wazuh, or AIDE for endpoint monitoring, building file integrity monitoring (FIM) policies, or meeting compliance requirements for change detection. Activates for requests involving HIDS configuration, file integrity monitoring, OSSEC/Wazuh deployment, or host-based detection.
日本語の概要は準備中です。原文の説明を表示しています。
Defense-in-depth security across Rust, TypeScript, and Bash for the Pump SDK — cryptographic key handling, memory zeroization, secure file I/O, input validation, privilege management, dependency auditing, and a 60+ item security checklist.
日本語の概要は準備中です。原文の説明を表示しています。
Hardcoded-secret detection — AWS keys, GitHub PATs, Slack tokens, Stripe keys, generic high-entropy strings. Pre-commit (`--staged-only`), explicit paths, or full repo. Use when guarding `git commit`, auditing a repo for leaked credentials, validating no secrets entered the diff before push, or producing a rotation list for an exposed-secret incident.
日本語の概要は準備中です。原文の説明を表示しています。
Review secret handling, brokered execution, redaction, vault boundaries, host approval, and public hygiene.
日本語の概要は準備中です。原文の説明を表示しています。
Next.js + Better Auth + PostgreSQL を Docker で構築し、Cloud Run へデプロイするスキル。ローカル開発環境のセットアップから Docker Compose、Dockerfile 作成、Cloud Run + Cloud SQL + Secret Manager を使った本番デプロイまでをカバーする。「Next.js と Better Auth でアプリを作りたい」「Docker で PostgreSQL を使いたい」「Docker で構築したい」「Docker Compose を使いたい」「アプリを Docker 化したい」「Dockerfile を書きたい」「Cloud Run にデプロイしたい」「Cloud SQL や Secret Manager を使いたい」ときに使う。
Deep security audit for WordPress plugin/theme PHP code, covering issues beyond the basic sanitize/escape/nonce checklist — PHP object injection (unserialize), SSRF in remote requests, CSRF on state-changing GET handlers, mass assignment via $_POST loops, insecure file include / template injection, mail header injection, ZipSlip in archive extraction, type-juggling in auth comparisons, and TOCTOU race patterns in option/meta locks. Use after or alongside wp-security-audit when reviewing complex plugins, REST APIs, integrations that fetch remote URLs, file processors, or any code that handles uploads, archives, or self-rolled auth tokens.
日本語の概要は準備中です。原文の説明を表示しています。
API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.
日本語の概要は準備中です。原文の説明を表示しています。
Check common security risks in application code (SQLi, XSS, secrets, open redirect).
日本語の概要は準備中です。原文の説明を表示しています。
Use when performing security audits, vulnerability assessments, penetration testing, or when asked to find security issues. Use when encountering code that handles user input, executes commands, reads files, or makes network requests.
日本語の概要は準備中です。原文の説明を表示しています。
Reviews mobile security across Flutter, native Android, native iOS, React Native and Kotlin Multiplatform using OWASP MASVS. Covers credential storage, secrets, transport, deep links, WebViews, logging and platform implementations of shared KMP contracts. Use for security audits, auth/token handling, pentest findings or release hardening.
日本語の概要は準備中です。原文の説明を表示しています。
Master smart contract security best practices to prevent common vulnerabilities and implement secure Solidity patterns. Use when writing smart contracts, auditing existing contracts, or implementing security measures for blockchain applications.
日本語の概要は準備中です。原文の説明を表示しています。
Azure Key Vault Secrets Java SDK for secret management. Use when storing, retrieving, or managing passwords, API keys, connection strings, or other sensitive configuration data.
日本語の概要は準備中です。原文の説明を表示しています。
Use when working with Chamber — chamber secrets management using AWS Systems Manager Parameter Store, service-scoped secret organization, environment variable export, and parameter auditing. Covers reading and writing secrets by service, comparing environments, listing services, version tracking, and IAM permission validation. Use when managing AWS SSM-based secrets with Chamber, auditing parameter changes, or comparing configs across services.
日本語の概要は準備中です。原文の説明を表示しています。
Use when working with Gcp Secret Manager — google Secret Manager secret lifecycle management, version control, rotation configuration, IAM policy auditing, and access diagnostics via gcloud CLI.
日本語の概要は準備中です。原文の説明を表示しています。
Use when working with Wiz — wiz cloud security posture management. Covers cloud security posture analysis, vulnerability prioritization, attack path analysis, compliance assessment, container security, and resource inventory. Use when assessing cloud security posture, investigating attack paths, prioritizing vulnerabilities, or auditing cloud compliance.
日本語の概要は準備中です。原文の説明を表示しています。