「rce」の検索結果

Audit whether an enforced-coordination MCP has actually shrunk its ~19 legacy etiquette verbs into the 5 enforced tools — work/act/ask/recall/status — each carrying one denial shape and one transcript event, migrated through a real retirement path (intake-metadata, alias, or doc-history — never a parallel runtime), with zero legacy-verb calls once a body reaches compliance mode C4+. Use when reviewing a broker-collapse migration plan, gating a body's move from advisory (C0-C3) to enforced (C4+) coordination, or verifying IT-018 Broker Collapse compliance. NOT for the inbound trigger→spawn boundary that decides whether an event may spawn an agent at all (use fleet-event-spawn-trust), the capability-token cryptographic mechanism behind a denial (use agentic-zero-trust-security), designing how a swarm of agents invokes and shards work (use swarm-invocation-designer), or auditing an individual PR's mergeability (use agent-pr-authoring).

日本語の概要は準備中です。原文の説明を表示しています。

Audits an Articles of Agreement contract — the daemon-witnessed agreement every official Port Daddy agent signs covering registration, transcript reporting, tool-use gating, file claims, parley conduct, budget limits, and operator control — against the enforcement-beats-hope bar: a clause counts as safe only when it resolves to a concrete, daemon-observable mechanism with a defined denial shape, never a promise the agent might honor. Use when drafting a new agent's Articles, reviewing a compliance-level (C0-C6) claim, deciding whether a clause is genuinely enforced or merely documented, or auditing whether an agent's claimed identity can be trusted. NOT for securing the inbound event-to-spawn path (fleet-event-spawn-trust), designing the relay's transport PKI and signing keys (pd-relay-zero-trust), or tracking an agent's identity and reputation across its whole lifetime after it signs (agent-identity-continuity-reputation).

日本語の概要は準備中です。原文の説明を表示しています。

Comprehensive overview of ALL Coval platform resources, their hierarchy, relationships, API endpoints, and ID formats. Use when user asks about Coval resources, data model, how things relate, what endpoints exist, or needs context about the platform structure before making API calls.

日本語の概要は準備中です。原文の説明を表示しています。

E-commerce SEO analysis: Google Shopping visibility, Amazon marketplace intelligence, product schema validation, competitor pricing analysis, and marketplace keyword gaps. Combines on-page product SEO with marketplace data from DataForSEO Merchant API. Use when user says "ecommerce SEO", "product SEO", "Google Shopping", "marketplace SEO", "product schema", "Amazon SEO", "product listings", "shopping ads", or "merchant SEO".

日本語の概要は準備中です。原文の説明を表示しています。

Apply forces and pressures to structures. Use when user asks to apply a force, add pressure, put a load on, or mentions gravity, point loads, or distributed forces.

日本語の概要は準備中です。原文の説明を表示しています。

[32] ANALYZE. Ensure every critical claim has verifiable evidence with confidence levels. Each fact must have source + confidence percentage. If confidence <85%, enter Loop150 to find more sources. Use for critical decisions, factual claims, legal/compliance work, or any situation where unverified claims are dangerous.

日本語の概要は準備中です。原文の説明を表示しています。

Extract product data, prices, reviews, and seller information from any e-commerce platform using Apify's E-commerce Scraping Tool.

日本語の概要は準備中です。原文の説明を表示しています。

Research synthesis from sources — "summarize these URLs or papers", "research this topic with these sources", "create a podcast about", "audio overview", "mind map", "quiz from these sources", "flashcards", "deep research on". Wraps Google NotebookLM via notebooklm-py.

日本語の概要は準備中です。原文の説明を表示しています。

Block writes through filesystem junctions and symlinks — file write through .mxm-system or .claude junction, git commit through a junction, delete through a junction. Enforces the junction read-only rule so the real repo stays the source of truth.

日本語の概要は準備中です。原文の説明を表示しています。

Open-source embedding database for AI applications. Store embeddings and metadata, perform vector and full-text search, filter by metadata. Simple 4-function API. Scales from notebooks to production clusters. Use for semantic search, RAG applications, or document retrieval. Best for local development and open-source projects.

日本語の概要は準備中です。原文の説明を表示しています。

Collects and synthesizes open-source intelligence (OSINT) about threat actors, malicious infrastructure, and attack campaigns using publicly available data sources, passive reconnaissance tools, and dark web monitoring. Use when investigating external threat actor infrastructure, performing pre-engagement reconnaissance for authorized red team assessments, or enriching CTI reports with publicly available adversary context. Activates for requests involving Maltego, Shodan, OSINT framework, SpiderFoot, or infrastructure reconnaissance.

日本語の概要は準備中です。原文の説明を表示しています。

Migrates legacy AEM (6.x, AMS, on-prem) to AEM as a Cloud Service using BPA CSV or cache, CAM/MCP target discovery, and a one-pattern-per-session workflow. Use for BPA/CAM findings, Cloud Service blockers, or fixes for scheduler, ResourceChangeListener, replication, EventListener, OSGi EventHandler, DAM AssetManager, HTL data-sly-test lint. OSGi configs → Cloud Manager — scan ui.config, .cfg.json, secrets, $[secret:]/$[env:] — agent follows references/osgi-cfg-json-cloud-manager.md when prompted. After BPA/CAM discovery, migration hands off each (pattern, file) pair to the code-assessment skill — code-assessment owns the five pattern guides (scheduler/, resource-change-listener/, replication/, event-migration/, asset-manager/) and the shared references for SCR→DS, ResourceResolver/SLF4J, HTL lint, and prerequisites.

日本語の概要は準備中です。原文の説明を表示しています。

Enforces minimum quality thresholds in CI including code coverage, linting, type checking, and security scanning. Provides required checks, PR rules, and automated enforcement. Use for "quality gates", "CI checks", "code quality", or "PR requirements".

日本語の概要は準備中です。原文の説明を表示しています。

Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps `cloudapp.azure.com` regional-pool re-issue (1-click OAuth ATO via wildcard `reply_to`, Binary Security), Zendesk help-desk takeover → email interception → password reset chain (0xprial writeup), Vercel `cname.vercel-dns.com` deleted-project takeover, plus general Fastly CDN service re-attach and S3 dangling-bucket cookie-scope techniques. Use when hunting subdomain takeover — emphasis on ATO-chain primitives (OAuth `redirect_uri`, cookie-domain, email DNS).

日本語の概要は準備中です。原文の説明を表示しています。

Hunting skill for rce vulnerabilities. Built from 67 public bug bounty reports. Use when hunting rce on any target.

日本語の概要は準備中です。原文の説明を表示しています。

Complete reference for 26 web2 bug classes with root causes, detection patterns, bypass tables, exploit techniques, and real paid examples. Covers IDOR, auth bypass, XSS, SSRF (11 IP bypass techniques), SQLi, business logic, race conditions, OAuth/OIDC, file upload (10 bypass techniques), GraphQL, LLM/AI (ASI01-ASI10 agentic framework), API misconfig (mass assignment, JWT attacks, prototype pollution, CORS), ATO taxonomy (9 paths), SSTI (Jinja2/Twig/Freemarker/ERB/Spring), subdomain takeover, cloud/infra misconfigs, HTTP smuggling (CL.TE/TE.CL/H2.CL), cache poisoning, MFA bypass (7 patterns), SAML attacks (XSW/comment injection/signature stripping), error disclosure / debug endpoints (stack trace regex per framework, chain templates), CSS injection (attribute-selector exfiltration, opacity clickjacking, @import). LFI / file inclusion -> RCE (php://filter source disclosure, iconv filter-chain RCE with no upload, log/environ poisoning, .user.ini/.htaccess auto_prepend, data:// + expect:// wrappers, session inclusion, traversal bypass table). Insecure deserialization (PHP __wakeup bypass / phar:// POP chains, Java ysoserial CommonsCollections gadgets + magic bytes, Python pickle __reduce__ + signed-cookie forgery, Node node-serialize). Dependency confusion / supply chain (internal package-name discovery, unclaimed-name confirmation, callback-only PoC, npm/pip/Maven/RubyGems variants). Use when hunting a specific vuln class or studying what makes bugs pay.

日本語の概要は準備中です。原文の説明を表示しています。

Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via error-string / status-code / timing differences, weak password policy, missing CAPTCHA (CAPTCHA token replay / single-use / concurrency-window bypass specifics → hunt-captcha-bypass), IP-based rate-limit bypass via X-Forwarded-For and friends, ReDoS. Distinguishes hard lockout vs soft IP-throttle vs CAPTCHA-injection vs silent shadow-throttling (avoids false-negative 'no rate limit' conclusions). Medium to Critical depending on what the brute reaches (OTP→ATO = Critical).

日本語の概要は準備中です。原文の説明を表示しています。

VMware vSphere / vCenter Server external attack matrix — version fingerprinting, the high-impact CVE chain (CVE-2021-21972 vRealize unauth file upload, CVE-2021-21985 vSAN plugin RCE, CVE-2022-22954 Workspace ONE SSTI, CVE-2023-20887 Aria RCE, CVE-2024-37085 ESXi AD bypass, CVE-2023-34048 vCenter DCERPC OOB write APT-exploited), default credentials, SSO configuration disclosure, vmdir LDAP enumeration, ESXi Open SLP RCE history. ONLY for vCenter / Workspace ONE / Aria instances exposed to the internet — internal-network vCenter is out of scope per the external-only boundary. Use when recon shows port 443 with vCenter banner, `/ui` redirect, `/websso/SAML2/Metadata`, or VMware product fingerprints.

日本語の概要は準備中です。原文の説明を表示しています。

Handles comprehensive resource acquisition, categorization, and asset management. Adaptive to various sources (URLs, PDFs, local paths) and centralizes media in a lowercase 'assets' folder.

日本語の概要は準備中です。原文の説明を表示しています。

リモート環境やDockerで、導入・連携・実操作のテストを進めるスキル。コードの信頼性に応じた環境の選択から、障害調査と実行後の後片付けまで扱います。

• クリーン環境でのパッケージ導入テスト
• 実サービスとの連携を検証したいとき
• macOS・Windows・WSL2の動作確認

OpenClawの課題やプルリクエストを、現在のソースとテスト結果に基づいて調査・レビューし、許可された範囲で修正からマージ完了の確認まで進めるスキル。

• OpenClawのPRをレビューしたいとき
• 報告された不具合のローカル修正
• 課題が既に解決済みか確認したいとき

OpenClawの既存ドキュメントを、仕様や操作の説明をソースで確かめながら再構成し、詳細の移動先やリンク、書式まで検証するスキル。

• 仕様説明を保ちながらページを短くしたいとき
• 詳細仕様を参照ページへ分けたいとき
• 説明を現在のCLIの動作に合わせたいとき

ブログやRSS/Atomフィードを登録し、更新をスキャンして新着記事を見つけ、記事一覧の確認や既読管理、登録先の追加・削除を行うスキル。

• お気に入りブログの新着確認
• 複数のRSS/Atomを追いたいとき
• 確認した記事を既読にしたいとき

REST APIのURL命名、HTTPステータス、一覧の分割取得、エラー形式を整理し、認証や利用制限、バージョン管理まで設計・レビューを支援するスキル。

• 新しいREST APIを設計したいとき
• ステータスコードとエラー応答の見直し
• 一覧APIの分割取得方式を選びたいとき