「fetch」の検索結果

SSRF playbook. Use when the server fetches URLs, resolves hostnames, imports remote content, or can be driven toward internal networks, cloud metadata, or secondary protocols.

日本語の概要は準備中です。原文の説明を表示しています。

HTTP request smuggling and desynchronization testing. Use when front proxies, CDNs, or load balancers disagree with the origin on message framing (Content-Length vs Transfer-Encoding), on HTTP/2→HTTP/1 translation, or when exploring client-side desync via browser fetch pipelines.

日本語の概要は準備中です。原文の説明を表示しています。

Server-Side Request Forgery (SSRF) occurs when user-controlled input is used to construct URLs that the server fetches, enabling access to internal services, cloud metadata endpoints (169.254.169.254), and local files via `file://` scheme. Detect via parameters accepting URLs or hostnames, PDF/report generators rendering `<iframe>/<img>/<script>`, and blind SSRF via out-of-band DNS callbacks. Bypass filters using IP decimal/octal/hex encoding, URL-userinfo tricks, and URL fragments. Tools: Burp Collaborator, curl.

日本語の概要は準備中です。原文の説明を表示しています。

Identify and exploit Server-Side Request Forgery (SSRF) vulnerabilities in Next.js applications, specifically focusing on insecure server actions or API routes fetching user-controlled URLs on the server-side.

日本語の概要は準備中です。原文の説明を表示しています。

DNS rebinding attack playbook. Use when testing applications that trust DNS resolution for origin checks, interact with internal services from browser context, or when SSRF is not possible server-side but the target has client-side fetch/XHR to attacker-controlled domains.

日本語の概要は準備中です。原文の説明を表示しています。

Cross-Site Request Forgery (CSRF) tricks authenticated users into submitting forged requests to a target application by exploiting browser automatic cookie attachment. Detect via missing or predictable CSRF tokens in state-changing requests (POST/PUT/DELETE), absent `SameSite` cookie attributes, and JSON endpoints accepting `text/plain` Content-Type. Test using HTML auto-submitting forms, XHR requests, and CORS-enabled fetch. Tools: Burp Suite (Generate CSRF PoC), OWASP ZAP.

日本語の概要は準備中です。原文の説明を表示しています。

Utilize the native Windows binary `certutil.exe` to download malicious payloads and optionally decode Base64 encoded files as a Living-off-the-Land (LotL) technique. This skill details how attackers bypass application whitelisting and fetch stage-2 implants.

日本語の概要は準備中です。原文の説明を表示しています。

CORS misconfiguration allows attacker-controlled origins to read sensitive cross-origin responses when servers echo the `Origin` header in `Access-Control-Allow-Origin` or set it to `*` with `Access-Control-Allow-Credentials: true`. Detect via `Origin: https://attacker.com` reflection in `Access-Control-Allow-Origin` response header, wildcard `*` on credentialed endpoints, and null origin acceptance. Tools: OWASP ZAP, Burp Suite, manual `fetch()` with `credentials: include`.

日本語の概要は準備中です。原文の説明を表示しています。

Bug bounty findings secretary, tracker, and workspace initializer for the bb-huge portal. Use this skill for web security research, vulnerability hunting, and hunt workspace setup. Triggers on: "log finding", "save finding", "add to bb-huge", "record vulnerability", "update finding", "show findings", "bb-huge stats", "mark as confirmed", "mark as rewarded", "setup workspace", "pull evidence", "continue working on finding", "dump attachments", "list my skills", "what skills do I have", "/bb-huge init", "init hunt workspace", "new bug bounty program", "start hunting", "mobile bug bounty", "binary analysis", "source code review", "white-box audit", "h1-brain", "hack program", "hack()", "search disclosed", "fetch rewarded". Also auto-activates whenever a vulnerability is discovered during any recon, fuzzing, or manual testing session — do not wait to be asked.

日本語の概要は準備中です。原文の説明を表示しています。

Review and resolve PR review comments on the current branch's PR in this Flutter repository, from both AI reviewers (CodeRabbit, CodiumAI, CodePilot, Copilot, etc.) and human reviewers. Fetches comments via `gh`, splits them into AI and human groups, verifies each comment against the actual Flutter code, triages them, proposes fixes, and optionally applies fixes, replies to comments, and pushes. Use when the user asks to review PR comments, resolve PR feedback, review AI comments, review human review comments, or handle code review feedback.

日本語の概要は準備中です。原文の説明を表示しています。

Redux Toolkit patterns for complex client state. Use when managing enterprise-scale state, needing DevTools, entity normalization, or RTK Query for data fetching.

日本語の概要は準備中です。原文の説明を表示しています。

File-based routing, loaders, actions, defer streaming, useFetcher, error boundaries, progressive enhancement

日本語の概要は準備中です。原文の説明を表示しています。

Server-Sent Events for unidirectional server-to-client streaming, EventSource API, fetch streaming, reconnection patterns, message parsing

日本語の概要は準備中です。原文の説明を表示しています。

Apollo Client GraphQL patterns — normalized cache and type policies, queries, mutations with optimistic updates, pagination, fragments, subscriptions, and Suspense hooks

日本語の概要は準備中です。原文の説明を表示しています。

URQL GraphQL client patterns — the exchange pipeline, document and normalized caching, queries, mutations, subscriptions, and authentication

日本語の概要は準備中です。原文の説明を表示しています。

tRPC type-safe API patterns — routers and procedures, input validation, context and middleware, TRPCError, and the typed client bridge

日本語の概要は準備中です。原文の説明を表示しています。

Background fetch, processing tasks, background location, headless JS, battery optimization - Expo and bare React Native

日本語の概要は準備中です。原文の説明を表示しています。

Bootstrap a new standalone skill repo under gaia-research/ from the canonical template set at gaia-research/gaia-research/templates/skill-repo/. Handles the full flow: interactive prompts for all placeholders, fetches templates via the GitHub API, substitutes values, creates the new repo (gaia-research/skill-<name>), writes README.md / SKILL.md / install.sh / .gitignore / LICENSE / powered-by-gaia.svg, makes the initial commit and pushes. Also supports update mode: re-applies the template structure to a pre-existing skill repo and opens a draft PR with the drift. Use when the user says "new skill repo", "bootstrap a skill repo", "/skill-template", "create skill-foo", "spin up a gaia-research skill repo", "template a new skill", "align skill-fuse to the template", or "/skill-template update <repo>". Requires: gh CLI (authenticated with gaia-research org access), python3, git.

日本語の概要は準備中です。原文の説明を表示しています。

Phase 5 of the feature-pipeline suite. Use this after /fp-iterate prints the M4 stop hook confirming CI is green. Fetches origin/main, runs gaia dev diff to surface any skill-registry changes the PR introduced that are unrelated to its stated purpose (accidental drift), then prints the final pipeline summary including a CI churn report (via /ci-churn). Also invoke standalone whenever you want to audit whether a branch has unexpected registry drift — e.g. before merging any review/meta or cli/ branch, or when a reviewer asks "did this PR touch anything it shouldn't?". Triggers: "check for drift", "drift check", "final summary", "pipeline done", "wrap up the pipeline", "fp-drift", "Phase 5".

日本語の概要は準備中です。原文の説明を表示しています。

Curate Gaia bot crawler branches into real-skill catalog entries and clean up processed bot/* branches. Use when the user says: "process bot branches", "curate the crawl output", "clean up bot proposals", "run bot curation", "merge the crawler results", "review bot/* branches", "ingest crawler data", or explicitly types /gaia-bot-curate. Also triggers when the user asks to review pending `bot/*` branches, turn crawler JSON proposals into registry nodes, decide which crawled skills to accept vs reject, or batch-add skills from an automated crawl run. This skill handles the full pipeline: fetch remote bot branches, triage proposals, run `gaia dev` mutations, validate, open a PR, and delete consumed bot branches.

日本語の概要は準備中です。原文の説明を表示しています。

Discovery-only Gaia curation for one manually selected source page. Fetches and normalizes up to five real SKILL.md candidates, deduplicates and maps them for human L4 review, then stops without evidence scoring or registry mutation.

日本語の概要は準備中です。原文の説明を表示しています。

Implementer - fetches a GitHub issue, builds an implementation plan, then implements using TDD. Use when: implement, build this, code this, add this feature, TDD, test first, red green refactor, pick a task, next task, dev.

日本語の概要は準備中です。原文の説明を表示しています。

Pulp in the browser — the WAM v2 and WebCLAP adapters, the wasm runtime, the Skia/WebGL2 browser window host, and the WebGPU (emdawnwebgpu) GPU-audio lane. Covers what does and does not compile to wasm, the worklet-thread constraints (no std::thread, no fetch, no navigator.gpu), the non-realtime tick, memory growth, how to PROVE a GPU lane actually ran rather than silently falling back to CPU, and the silent-failure traps that make a wasm build "work" while producing no audio or no pixels.

日本語の概要は準備中です。原文の説明を表示しています。

Download the actual PDF binary from bot-gated sites (taxpolicycenter.org, urban.org, SSRN-hosted mirrors, think-tank/publisher sites) via the Wayback Machine id_ URL form. Use when: (1) curl/WebFetch of a .pdf URL returns HTML instead of a PDF even with a browser User-Agent, (2) pypdf fails with "invalid pdf header: b'<!DOC'" or "EOF marker not found" on a freshly downloaded file, (3) Firecrawl can parse the PDF to markdown but you need the original file on disk (e.g., filing a reference copy).

日本語の概要は準備中です。原文の説明を表示しています。