9,233 件 ・ 関連度順
概要と使いどころ
Use when preparing or publishing a local project as a clean GitHub repository. Covers new repositories, private staging releases, public README cleanup, updates to existing remotes, and research-code packaging without datasets, checkpoints, papers, or generated artifacts.
日本語の概要は準備中です。原文の説明を表示しています。
Use when designing, redrawing, or validating research-paper figures and tables, including Matplotlib plots, LaTeX tables, benchmarks, captions, legends, annotations, color, and typography. Preserves exact evidence and checks rendered PDFs for clipping, overlap, and readability.
日本語の概要は準備中です。原文の説明を表示しています。
Performs a lightweight pre-release readiness review of Atlassian Forge apps across manifest/module wiring, architecture, runtime compatibility, dependency posture, tests, deploy readiness, and obvious security, cost, or reliability smells. Use when the user asks "review my Forge app", "pre-deploy check", "is this app ready to ship", "review manifest", "general app review", "release readiness", or asks for a broad quality pass. Do not use for deep security audits/SAST/exploitability review, cost optimization, or diagnosing a known broken app; route those to forge-security-review, forge-cost-optimizer, or forge-debugger respectively.
日本語の概要は準備中です。原文の説明を表示しています。
Write and cascade OKRs (Objectives and Key Results) for company, department, team, or project level. Ensure objectives are inspiring and key results are measurable outcomes. Includes weekly check-in template. Use at the start of each quarter or when aligning strategy to execution. Do not use for KPI performance reviews or daily task tracking.
日本語の概要は準備中です。原文の説明を表示しています。
Turn ambiguous requests into an executable implementation plan with assumptions, sequence, acceptance checks, and rollback thinking.
日本語の概要は準備中です。原文の説明を表示しています。
Break complex work into bounded Codex delegation tasks with clear ownership, expected outputs, and integration checkpoints.
日本語の概要は準備中です。原文の説明を表示しています。
Compare policies, procedures, onboarding files, or operating evidence against a named compliance framework such as AML/KYC, privacy, internal controls, or audit readiness. Use when a team needs a gap matrix, control checklist, remediation priorities, or evidence request list. Do not use when no target framework is specified or when formal legal or regulatory sign-off is required.
日本語の概要は準備中です。原文の説明を表示しています。
Natural-language orchestration of security tools through Gemini. Translates intent ("scan this scope for exposed admin panels") into safe, parameterized tool pipelines using nmap, masscan, naabu, httpx, nuclei, ffuf, gobuster, subfinder, amass, dnsx, katana, gau, semgrep, trivy, checkov, gitleaks, syft, grype, and custom scripts. Use when the user wants Gemini to drive a chain of CLI tools end to end with guardrails.
日本語の概要は準備中です。原文の説明を表示しています。
Write custom Semgrep rules to identify organization-specific logic flaws, improper cryptography usage, or missing authorization checks during source code review. This skill focuses on moving beyond default rulesets to locate complex vulnerabilities.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit Time-of-Check to Time-of-Use (TOCTOU) race conditions in web applications and APIs. Use this skill when testing transactional operations (e.g., applying coupons, transferring funds, redeeming rewards, or purchasing items) to bypass business logic and duplicate actions before the server updates its database state.
日本語の概要は準備中です。原文の説明を表示しています。
Deep OSINT reconnaissance using the MITRE ATT&CK Reconnaissance framework. Email harvesting with SMTP verification, subdomain takeover detection, certificate transparency mining, Shodan/Censys intelligence, Wayback Machine historical analysis, social media profiling, cloud storage enumeration, document metadata extraction, DNS history, credential leak checks, and passive infrastructure mapping. Uses theHarvester, amass, dnsrecon, fierce, dnstwist, dmitry, whatweb, wafw00f, exiftool, metagoofil, smtp-user-enum, swaks, waybackurls, subfinder, and crt.sh. Pure reconnaissance — no active exploitation. Produces: confidence-scored findings, infrastructure diagram, employee roster, email pattern confirmation, subdomain takeover candidates. Chains into /pentester for active testing.
日本語の概要は準備中です。原文の説明を表示しています。
Detects code quality vulnerabilities in mobile apps (Android/iOS). Trigger on: SQL injection in SQLite, JavaScript injection in WebViews, intent injection, unsafe deserialization, NSKeyedUnarchiver, NSCoding, Java serialization, Parcelable, buffer overflow, JNI native code, PIE disabled, NX disabled, stack canary absent, RELRO, ARC disabled, third-party library CVE, vulnerable dependency, outdated SDK, targetSdkVersion, update enforcement missing, implicit Intent, URL loading in WebView, object persistence, memory corruption, OWASP dependency check. Covers MASVS-CODE-1/2/3/4.
日本語の概要は準備中です。原文の説明を表示しています。
Detects weak reverse engineering and tampering protections in mobile apps (Android/iOS). Trigger on: root detection bypass, jailbreak detection bypass, Frida detection, debugger detection, anti-debugging, ptrace, sysctl, emulator detection, code obfuscation absent, debug symbols present, get-task-allow, ProGuard disabled, R8 disabled, string encryption, integrity check, file tampering, repackaging, dynamic instrumentation, runtime hook, Magisk hide, Magisk, frida-server, objection bypass, signing verification, apk resign. Covers MASVS-RESILIENCE-1/2/3/4.
日本語の概要は準備中です。原文の説明を表示しています。
Entry P1 category router for injection testing. Use when routing between XSS, SQLi, SSRF, XXE, SSTI, command injection, and NoSQL injection workflows based on how attacker-controlled input is consumed.
日本語の概要は準備中です。原文の説明を表示しています。
IDOR and broken object authorization testing playbook. Use when requests expose object identifiers, tenant boundaries, writable fields, or missing object-level authorization checks.
日本語の概要は準備中です。原文の説明を表示しています。
Covers object-level authorization bypass in GraphQL APIs where introspection reveals hidden fields or mutations that accept arbitrary user/resource IDs without ownership checks. Trigger on keywords like "GraphQL", "query", "mutation", "introspection", "resolver", "node ID", "relay", "object type", "schema", "batching", or "alias". Applies to dual-stack REST+GraphQL apps, Relay-style global IDs, and unauthenticated resolvers.
日本語の概要は準備中です。原文の説明を表示しています。
DNS rebinding attack playbook. Use when testing applications that trust DNS resolution for origin checks, interact with internal services from browser context, or when SSRF is not possible server-side but the target has client-side fetch/XHR to attacker-controlled domains.
日本語の概要は準備中です。原文の説明を表示しています。
Use when hunting CI/CD bot comment command vulnerabilities where issue_comment or pull_request_review_comment triggers invoke privileged workflows without verifying the commenter's identity or authorization. Trigger on: "bot command injection", "issue_comment trigger", "@github-actions", "slash command CI", "CI bot command", "comment triggered workflow", "unauthenticated bot", "github-actions publish", "comment dispatch", no authorization check on workflow_dispatch from comment, chatops CI/CD, supply chain via PR comment.
日本語の概要は準備中です。原文の説明を表示しています。
Application-level business logic security testing for any domain. Takes an understanding-first approach: map the intended workflows before probing them. Covers: value/quantity logic abuse (negative, zero, overflow, rounding on any numeric field), workflow and state machine bypass (skipping required steps, forcing illegal state transitions, reusing one-time tokens), trust boundary violations (BOLA horizontal/vertical, BFLA, cross-tenant access, negative ownership attacks), idempotency and replay attacks (duplicate submissions, double-spend, same-reference reuse), multi-step flow integrity (checkout, registration, approval, verification), quota and rate limit bypass, time/date manipulation, and authorization code / reference number predictability. Domain-agnostic — applies to SaaS, e-commerce, banking, gaming, social platforms, APIs, or any multi-user application with stateful workflows. Chains from /pentester; chains into /param-fuzz when boundary violations or mass assignment are confirmed.
日本語の概要は準備中です。原文の説明を表示しています。
Writes professional bug bounty reports for HackerOne, Bugcrowd, and Intigriti with CVSS 4.0 scoring, business impact, working exploits, and remediation. Runs 5-check Pre-Report Verification first: hallucination detection, AI writing patterns, PoC reproducibility, duplicate detection, and impact plausibility. Use when user describes a vulnerability, shares HTTP logs, HAR files, recon output, or screenshots; says 'write a bug report', 'format my finding', 'draft a vuln report', 'is this valid', 'rate my vulnerability', 'verify my report', or any variant. Trigger for partial or messy input — raw notes, one-liners, or full writeups all work. Do not wait for perfect input.
日本語の概要は準備中です。原文の説明を表示しています。
Anti-debugging detection and bypass playbook. Use when reversing protected binaries that detect debuggers via ptrace, PEB flags, timing checks, or signal/exception handlers on Linux and Windows.
日本語の概要は準備中です。原文の説明を表示しています。
Evaluate and review GO-CAM (Gene Ontology Causal Activity Model) activities / annotons — molecular-function typing, has-input, causal relations, complexes, evidence — and check their consistency with gene annotation reviews. Use when reviewing cached GO-CAMs under gocams/, filling a GoCamReview YAML (gocams/<id>/<id>-review.yaml), or grounding a module in GO-CAM models.
日本語の概要は準備中です。原文の説明を表示しています。
Build/test/lint verification pass for this Flutter app — runs codegen, analyze, test, then iOS + Android native builds in parallel, then `dart format`. Does NOT commit anything; leaves the working tree dirty so the user can review and commit on demand. Used at the end of the prd → techspec → tasks → implement-tasks-sequence flow before `pr-review`, and can also be invoked manually when the user says "verify build", "run full verification", or "check everything".
日本語の概要は準備中です。原文の説明を表示しています。
Run Flutter/Dart formatting and static analysis for this repository. Use after completing Dart, Flutter, generated-source-input, or project configuration changes; when the user asks to lint, format, analyze, or check code style; or when preparing code for a pull request.
日本語の概要は準備中です。原文の説明を表示しています。