「exa」の検索結果

Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact, severity-request paragraph as first body section, OOS-clause rebuttal templates (rate limiting on auth-flow endpoints, debug-info framing, user-enumeration with sensitive PII, theoretical-issue counter), chained-finding cross-reference patterns, target selection for QA-vs-prod programs, researcher-side hygiene (Bugcrowdninja email alias, account state restoration, friendly-tester posture). Use when filing a Bugcrowd submission, when VRT default seems wrong, when triager closes as OOS or downgrades severity, when chaining linked submissions, or when scope distinguishes production from QA. Pairs with report-writing and triage-validation.

日本語の概要は準備中です。原文の説明を表示しています。

Hunt file upload bugs — RCE via webshell, XSS via SVG/HTML, SSRF via XXE in DOCX, path traversal via filename. Bypass tables (10 techniques): double extension (shell.php.jpg if server checks last ext only), magic bytes spoofing (PNG header on PHP), null byte (shell.php.jpg), case (PHP, .Php, .pHP), .htaccess upload to enable execution, SVG with <script>, HTML/SVG XSS, DOCX with embedded XXE, ZIP slip (../../../etc/passwd in archive), polyglot files. Detection: any /upload, /avatar, /profile-picture, /attachment, /import endpoint. Test: upload PHP/JSP/ASPX shells, request via direct URL, check response. Validate: actual code execution (whoami output) for RCE; reflected XSS in profile-photo URL. Use when testing file upload features, avatar/attachment endpoints, import/export functions, XML/DOCX/ZIP processors. Real paid examples.

日本語の概要は準備中です。原文の説明を表示しています。

Hunt HTTP request smuggling (CL.TE, TE.CL, H2.CL, H2.TE). Cause: front-end proxy and back-end server disagree on where one request ends and the next begins (Content-Length vs Transfer-Encoding header parsing inconsistency). CL.TE: front-end uses CL, back uses TE → smuggle by sending TE: chunked but with body that fits CL count. TE.CL: opposite. H2.CL: HTTP/2 downgrade, smuggle CL into HTTP/1.1 back-end. Detection tools: Burp HTTP Request Smuggler extension, smuggler.py, h2csmuggler. Confirm: time-delay technique (smuggled GET with 30s timeout) — if front-end returns slow on next victim request, smuggling works. Validate: cache poisoning chain (smuggle request that gets cached for victim), credential theft (smuggle X-Forwarded-For override that captures next user's cookies), bypass auth (smuggled internal-path request). Real paid examples from major CDN deployments. Use when hunting H1 paid programs running CDN+origin stacks, when targeting load balancer / WAF bypass.

日本語の概要は準備中です。原文の説明を表示しています。

Internal — invoked headlessly by `peon create`; humans should run `peon create` instead. Author and render a brand-new PeonPing draft pack — invoked headlessly as: "Use the peon-ping-create-pack skill to draft a pack: name=<n> flavor=<f> vibe=<v> draft_root=<dir>. Follow the skill exactly." Authors all 7 CESP categories honoring the vibe, writes openpeon.json (draft-stamped) and prompts.json, renders every sound via scripts/pack-render.py, and always ends by telling the human to run `peon eval <name>`.

日本語の概要は準備中です。原文の説明を表示しています。

Log exercise reps for the Peon Trainer. Use when user says they did pushups, squats, or wants to log reps. Examples - "/peon-ping-log 25 pushups", "/peon-ping-log 30 squats", "log 50 pushups".

日本語の概要は準備中です。原文の説明を表示しています。

Use this skill when working with symbolic mathematics in Python. This skill should be used for symbolic computation tasks including solving equations algebraically, performing calculus operations (derivatives, integrals, limits), manipulating algebraic expressions, working with matrices symbolically, physics calculations, number theory problems, geometry computations, and generating executable code from mathematical expressions. Apply this skill when the user needs exact symbolic results rather than numerical approximations, or when working with mathematical formulas that contain variables and parameters.

日本語の概要は準備中です。原文の説明を表示しています。

Systematically reviews code for SQL injection, XSS, SSRF, broken access control, cryptographic failures, and other common OWASP Top 10 vulnerabilities, providing vulnerable code examples and ready-to-use remediation guidance. Trigger this skill when users ask for a security review, vulnerability scan, or penetration testing assistance, or mention keywords like OWASP, SQL injection, XSS, code audit, or security checklist.

日本語の概要は準備中です。原文の説明を表示しています。

This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories.

日本語の概要は準備中です。原文の説明を表示しています。

Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions "grill me".

日本語の概要は準備中です。原文の説明を表示しています。

The exact column header names required by the TRES Finance bulk transaction CSV upload. Use whenever building, fixing, or validating the header row of a TRES manual transaction or sub-transaction upload CSV — especially after an upload fails with "Missing required column(s): ...". Trigger phrases include: 'fix my CSV headers', 'bulk transaction upload failed', 'missing required columns', 'validate TRES upload CSV', 'transaction CSV template headers'. This skill is ONLY about the header naming convention; it does not cover row values or upload workflow. Do NOT trigger for contacts import CSV (use tres-import-contacts), wallet upload CSV (use tres-wallets-upload), or general CSV parsing unrelated to bulk TX upload headers.

日本語の概要は準備中です。原文の説明を表示しています。

Compute the EXACT sub-transaction impact of a rollup rule in TRES Finance — every filter applied — and flag genuine problems (zero matches, overlap, config mistakes) before the rule is created. Two modes. Mode A: a pre-create quality gate invoked by the tres-rollup-rules skill to vet proposed candidate rules. Mode B: standalone review of a rule someone submitted or of existing PENDING rules. Trigger this skill when the user says "review this rollup rule", "what would this rollup rule actually match", "preview the rollup impact", "how many transactions would this rule catch", "is this rollup rule valid", "validate my rollup rule", "check my pending rollup rules", or "review the rollup requests". Do NOT use this to design or propose new rollups — that is tres-rollup-rules. This skill only measures impact and flags issues; it never executes mutations.

日本語の概要は準備中です。原文の説明を表示しています。

Query, display, and resolve reconciliation gaps from the TRES Finance MCP connector. Trigger this skill ONLY when the user explicitly requests to view or close reconciliation gaps — for example: "show me the reconciliation gaps", "close the recon gaps", "view gaps for today", "plug the reconciliation gaps for ETH", "fix the gaps for USDC and BTC". Do NOT trigger for general balance queries, transaction history, or ledger browsing. Covers the full workflow: confirming the target date, optionally filtering by asset, fetching gap data, enriching with fiat and on-chain balances, rendering an HTML dashboard where each gap row has copy-prompt buttons (Plug / Auto-fill) — clicking copies a ready-to-paste Claude prompt for that gap. The user pastes it in the chat and Claude executes the action. Ends with a data collect once the user is done.

日本語の概要は準備中です。原文の説明を表示しています。

Match TRES ledger transactions to ERP invoices/bills (AP/AR) and optionally sync them to the connected ERP (Xero, QuickBooks Online, NetSuite). Trigger this skill whenever the user wants to match, link, close, reconcile, or sync an invoice or bill against a blockchain transaction — even if they don't say "skill" or use those exact words. Trigger phrases include: "match this invoice to a transaction", "match a bill to tx", "close invoice INV-123", "close bill 9988", "link this tx to a bill", "pay this invoice from this transaction", "set up this tx as AP", "set up this tx as AR", "sync this transaction as AP/AR", "match AP/AR", "find the invoice/bill for this hash", "what bill does this tx pay". Trigger ONLY for explicit AP/AR matching/closing intent — do NOT trigger for general transaction explanations (use tres-tx-story), for ingesting an explorer link into the ledger (use tres-explorer-tx-to-ledger), or for ERP connection setup itself (use tres-settings-management).

日本語の概要は準備中です。原文の説明を表示しています。

Analyze an organization's sub-transaction patterns in TRES Finance, identify groups of repetitive transactions, and propose data-driven rollup rules that consolidate them into one aggregated entry per interval (daily or monthly) for cleaner ERP integration. Also lists and deletes rollup rules. Trigger this skill whenever the user asks about rollup rules, transaction aggregation, consolidating transactions, reducing transaction noise, rolling up gas fees, rolling up staking rewards, rolling up micro-transactions, or collapsing many small ledger entries into fewer summary entries. Also trigger on "create a rollup rule", "suggest rollup rules", "what should I roll up", "show my rollup rules", "delete a rollup rule", "aggregate transactions", "too many transactions", "reduce transaction count", "roll up fees", "daily rollup", "monthly rollup". If a wallet has too many transactions, high-frequency activity, or noisy ledger entries, proactively suggest rollup rules. For computing the EXACT impact of a single already-specified rule or reviewing submitted/pending rules, use the tres-rollup-review skill instead.

日本語の概要は準備中です。原文の説明を表示しています。

Diverga help guide - displays all 24 agents across 9 categories, commands, and usage examples. Triggers: help, guide, how to use, 도움말

日本語の概要は準備中です。原文の説明を表示しています。

Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, artifacts, posters, or applications (examples include websites, landing pages, dashboards, React components, HTML/CSS layouts, or when styling/beautifying any web UI). Generates creative, polished code and UI design that avoids generic AI aesthetics.

日本語の概要は準備中です。原文の説明を表示しています。

Read when the user asks what OpenKnowledge is, wants to install it on a repository, wants to open or preview a single markdown file that is not part of an OpenKnowledge project, wants to share an OpenKnowledge project with collaborators, asks whether OpenKnowledge supports a particular capability, or asks how `ok init` / `ok cowork` / OK Desktop set up a project. Do NOT load to perform OpenKnowledge reads/writes — the runtime guidance for editing markdown inside an initialized OK project ships as a separate project-local skill installed into each detected agent's skills dir (for example `.claude/skills/open-knowledge/`) whenever `ok init` runs.

日本語の概要は準備中です。原文の説明を表示しています。

Compares your Meta ad sets and identifies where audiences overlap significantly, causing your ads to compete against each other in the same auctions. Tells you exactly which ad sets are cannibalizing each other and how much it's costing you in inflated CPMs. Platform: Meta.

日本語の概要は準備中です。原文の説明を表示しています。

When your CPA spikes, Claude breaks down exactly what caused it. It looks across your campaign data and isolates the contributing factors — audience fatigue, bid landscape shifts, creative decay, landing page conversion drops, budget distribution changes, or new competitor activity. Platform: Google and Meta.

日本語の概要は準備中です。原文の説明を表示しています。

Find the exact pages AI assistants cite when answering questions in your category, and identify which ones you can get into. Claude clusters the cited sources, scores each by attainability, and outputs an outreach/content plan. Platform: AI visibility.

日本語の概要は準備中です。原文の説明を表示しています。

Breaks down Quality Score components for your Google Ads keywords — expected CTR, ad relevance, and landing page experience — and tells you exactly which component is dragging each keyword down, with specific fixes ranked by potential CPC impact. Platform: Google.

日本語の概要は準備中です。原文の説明を表示しています。

Analyzes performance by day of week and hour of day across your campaigns. Identifies when your ads perform best and worst, recommends ad schedule adjustments with estimated savings, and tells you exactly what you'd give up by restricting hours. Platform: Google and Meta.

日本語の概要は準備中です。原文の説明を表示しています。

Tracks daily spend against monthly budget targets across all campaigns and accounts. Tells you exactly where you'll land at current pace, flags campaigns that are over or underspending, and calculates the daily budget adjustments needed to hit your target by month end. Platform: Google and Meta.

日本語の概要は準備中です。原文の説明を表示しています。

Search Unity's package registry plus locally installed packages (Git, local, embedded sources) by query string. Returns available versions and installation status. Online mode fetches exact matches from the live registry then supplements with cached substring matches.

日本語の概要は準備中です。原文の説明を表示しています。