「oss」の検索結果

Generates comprehensive documentation templates for open-source and internal projects including README, CONTRIBUTING, SECURITY, CODE_OF_CONDUCT, LICENSE, and other standard docs with suggested sections and best practices. Use when users request "create project docs", "add OSS documentation", "setup standard docs", or "make it open-source ready".

日本語の概要は準備中です。原文の説明を表示しています。

Elite frontend image-direction skill for generating premium, conversion-aware website design references. CRITICAL OUTPUT RULE — generate ONE separate horizontal image FOR EVERY section. A landing page with 8 sections produces 8 images. Never compress multiple sections into one image. Enforces composition variety (not always left-text / right-image), background-image freedom, varied CTAs, varied hero scales (giant / mid / mini minimalist), narrative concept spine, second-read moments, and a single consistent palette across all images. Optimized for landing pages, marketing sites, and product comps that developers or coding models can accurately recreate.

日本語の概要は準備中です。原文の説明を表示しています。

Standardizes development environment setup across machines by generating tool version configs (Node, Python, Ruby), package manager configs (pnpm, Volta, asdf, mise), environment variable templates, and setup scripts with onboarding documentation. Use when users need to "setup dev environment", "standardize tooling", "configure version managers", or "create onboarding scripts".

日本語の概要は準備中です。原文の説明を表示しています。

Unifies API response patterns across endpoints including pagination format, error structure, status codes, response envelopes, and versioning strategy. Provides contract documentation, shared TypeScript types, middleware utilities, and migration plan. Use when standardizing "API contracts", "response formats", "API conventions", or "API consistency".

日本語の概要は準備中です。原文の説明を表示しています。

Reverse-lookup glossary that turns a vague description of a web animation or motion effect into its exact term ("the bouncy thing when a popover opens" → Pop in; "the iOS rubber-band scroll" → Rubber-banding). Use when the user asks "what's it called when…", or describes a motion effect without knowing its name and wants the right word to prompt an AI or designer with. For naming an effect, not designing or building one.

日本語の概要は準備中です。原文の説明を表示しています。

Installs and configures Prettier, ESLint, EditorConfig, and other code quality tools to enforce consistent code style across the team. Generates config files, npm scripts, editor settings recommendations, and CI integration suggestions. Use when users request "setup prettier", "add eslint", "configure code formatting", or "enforce code style".

日本語の概要は準備中です。原文の説明を表示しています。

Use when Spark engineering knowledge must be placed, deduplicated, migrated, or validated across AGENTS, Notes, Roles, Skills, and Workflows.

日本語の概要は準備中です。原文の説明を表示しています。

Use when a reference list needs APA 7 cleanup, when DOIs must be confirmed real against Crossref or PubMed, when the user asks whether AI-suggested citations actually exist, or when a manuscript needs a citation hygiene pass before submission or defense.

日本語の概要は準備中です。原文の説明を表示しています。

Use when a complete research workflow — its instructions, skills, data boundaries, and tool connections — must be assessed for portability across AI agents or environments, so each component is explicitly mapped before migration rather than assumed to transfer.

日本語の概要は準備中です。原文の説明を表示しています。

Use when a high-stakes analysis, citation set, or decision should be checked by a second independent AI agent that verifies rather than decides, or when disagreement between agents must be surfaced for the human to adjudicate.

日本語の概要は準備中です。原文の説明を表示しています。

Use when sources must stay traceable across sessions and years, when each reference needs a passport recording where it was found, how it was verified, and where it is cited, or when a draft needs a cited-but-unverified sweep before submission.

日本語の概要は準備中です。原文の説明を表示しています。

This skill should be used when implementing features from a PRD spec, tracking implementation progress, or resuming work across sessions. Covers Dex task management for PRD story execution, daily workflows, and skill auto-loading.

日本語の概要は準備中です。原文の説明を表示しています。

You are helping a penetration tester exploit Cross-Origin Resource Sharing

日本語の概要は準備中です。原文の説明を表示しています。

You are helping a penetration tester exploit reflected cross-site scripting. The

日本語の概要は準備中です。原文の説明を表示しています。

You are helping a penetration tester exploit stored (persistent) cross-site

日本語の概要は準備中です。原文の説明を表示しています。

You are helping a penetration tester exploit DOM-based cross-site scripting. The

日本語の概要は準備中です。原文の説明を表示しています。

Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query depth exploitation, and introspection abuse. Includes pagination exploitation for data exfiltration, webhook hijacking for SSRF and data interception, and resource exhaustion through algorithmic complexity attacks. Covers race conditions in API transactions using parallel request techniques. Provides comprehensive JWT manipulation including algorithm confusion, kid injection, jku/x5u abuse, and claim tampering. Details API key leakage detection across source repositories, client-side code, and error messages. Covers undocumented endpoint discovery through predictable naming, debug routes, and source map analysis. Tooling includes Arjun, ParamSpider, jwt_tool, and GraphQL Voyager. Designed for a...

日本語の概要は準備中です。原文の説明を表示しています。

Hunt WebSocket vulnerabilities — Cross-Site WebSocket Hijacking (CSWSH), missing/weak Origin validation on the WS handshake, no per-message authentication, message tampering, socket.io namespace/room authorization bypass, and handshake-layer Upgrade smuggling. Use when target has WebSocket endpoints (ws:// or wss://), socket.io / SignalR / Phoenix Channels, real-time features, chat, live dashboards, notifications, or trading platforms.

日本語の概要は準備中です。原文の説明を表示しています。

Time-of-Check / Time-of-Use (TOCTOU) race condition exploitation methodology across binary, kernel, filesystem, web, and container layers. Covers symbolic-link races (open/access/stat split), file-descriptor races, fopen/realpath traversal races, /proc and procfs races, FUSE-backed slow-fs races to widen the window, ptrace and signal races, kernel double-fetch / userspace pointer races, container/runc/symlink escape primitives, kubernetes admission/authz TOCTOU, web auth-vs-authz TOCTOU, JWT-claim TOCTOU at gateway vs service, payment/idempotency races, and modern race-amplification techniques (single-packet attack, slow loris, FUSE pause, cgroup freeze, scheduler shaping). Use when you've identified a 'check then act' pattern in code, when fuzzing for race conditions, or when exploiting concurrency bugs in privileged binaries / kernel / orchestrators.

日本語の概要は準備中です。原文の説明を表示しています。

Comprehensive API security testing methodology covering REST, gRPC, and WebSocket attack surfaces. Addresses the full OWASP API Security Top 10 2023 including BOLA/IDOR, broken authentication, excessive data exposure, rate limiting bypass, BFLA, mass assignment, SSRF, and security misconfiguration. Includes REST-specific attacks such as HTTP verb tampering, content-type switching, and parameter pollution. Covers gRPC exploitation through protobuf interception, reflection API enumeration, and metadata injection. Addresses WebSocket vulnerabilities including origin bypass, message injection, and cross-site WebSocket hijacking. Provides tooling guidance for Burp Suite, Postman, grpcurl, websocat, and mitmproxy. Each technique includes detection signatures and defensive indicators so you understand what artifacts your testing leaves behind. Designed for authorized penetration testing engagements against API-driven architectures.

日本語の概要は準備中です。原文の説明を表示しています。

Hunting skill for xss vulnerabilities. Built from 174 public bug bounty reports. Use when hunting xss on any target. For markup injection that reflects raw HTML but does NOT execute JavaScript (no `<script>`/event-handler execution), see hunt-html-injection — escalate here once script execution is possible.

日本語の概要は準備中です。原文の説明を表示しています。

Cross-Site Scripting testing checklist: stored/reflected/DOM/blind XSS discovery, polyglot payloads, CSP bypass, XSS filter bypass, event handler injection, DOM clobbering, mutation XSS, and impact escalation (session hijack, phishing, keylogging). Use for web app XSS testing and bug bounty.

日本語の概要は準備中です。原文の説明を表示しています。

Comprehensive offensive methodology for software supply chain attacks covering the full kill chain from reconnaissance through exploitation. Addresses dependency confusion across npm, PyPI, and NuGet ecosystems where internal registry override allows an attacker to inject malicious packages that shadow private dependencies. Covers typosquatting techniques for popular packages, compromised package injection via maintainer account takeover or social engineering, and build system attacks through Makefile injection, setup.py install hooks, and npm postinstall scripts. Extends into CI/CD artifact tampering where build outputs are replaced or modified in transit, code signing abuse through stolen or self-signed certificates, upstream repository compromise via commit injection or force-push to trusted repos, and container image supply chain attacks including base image trojaning and registry confusion. Maps to MITRE ATT&CK T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools...

日本語の概要は準備中です。原文の説明を表示しています。

DOM-based attacks execute in the victim's browser — the server often never sees the payload, so WAFs and server-side input filters do not apply. PostMessage missing-origin-check = cross-origin token theft with no XSS needed.

日本語の概要は準備中です。原文の説明を表示しています。