818 件 ・ 関連度順
概要と使いどころ
Harden an application against common security risks — validate inputs at boundaries, least-privilege access, safe secrets handling, dependency hygiene, and secure defaults. Load when shipping user-facing code, adding auth/session flows, handling untrusted data, exposing APIs, or the user asks for "security hardening", "OWASP hardening", "secure this feature". Not for skill-library security gates (use secure-skill family).
日本語の概要は準備中です。原文の説明を表示しています。
Deploy with unified build/test/deploy intent across providers using .agent-loom/deploy.yml and per-provider adapters. Load when the user asks to deploy, ship to preview, release to production, or run a provider-agnostic deploy flow. Also triggers on "deploy anywhere", "deploy to Vercel", "deploy with GitHub Actions", "preview deploy", or "ship this". Runs preflight before any deploy — stops on missing secrets. Pairs with ci-cd-and-automation for pipeline design. Ships vercel and github-actions adapters; extensible adapter interface.
日本語の概要は準備中です。原文の説明を表示しています。
Azure Key Vault SDK for Python. Use for secrets, keys, and certificates management with secure storage.
日本語の概要は準備中です。原文の説明を表示しています。
Azure Identity SDK for Rust authentication. Use for DeveloperToolsCredential, ManagedIdentityCredential, ClientSecretCredential, and token-based authentication.
日本語の概要は準備中です。原文の説明を表示しています。
Set up, resume or troubleshoot cmail custom-domain email (domain at any registrar → Cloudflare Email Routing → any inbox; optional GoDaddy automation and Gmail send-as): runs cmail setup itself, asking only for missing input, secrets or risky approvals. Don't use for mail migrations or campaigns.
日本語の概要は準備中です。原文の説明を表示しています。
Set and wire Convex deployment env vars / secrets for the app.
日本語の概要は準備中です。原文の説明を表示しています。
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.
日本語の概要は準備中です。原文の説明を表示しています。
Azure Key Vault SDK for Python. Use for secrets, keys, and certificates management with secure storage.
日本語の概要は準備中です。原文の説明を表示しています。
Azure Identity SDK for Rust authentication. Use for DeveloperToolsCredential, ManagedIdentityCredential, ClientSecretCredential, and token-based authentication.
日本語の概要は準備中です。原文の説明を表示しています。
Performs a comprehensive security review of code changes in a GitHub PR or issue. Checks out the branch, analyzes changed files against a 9-category security checklist, and produces PASS/WARNING/FAIL verdicts. Use when reviewing pull requests for security vulnerabilities, hardcoded secrets, injection flaws, auth bypasses, or insecure configurations. Trigger keywords - security review, code review, appsec, vulnerability assessment, security audit, review PR security.
日本語の概要は準備中です。原文の説明を表示しています。
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in, and reading/injecting secrets for commands.
日本語の概要は準備中です。原文の説明を表示しています。
Clone, create, fork, configure, and manage GitHub repositories. Manage remotes, secrets, releases, and workflows. Works with gh CLI or falls back to git + GitHub REST API via curl.
日本語の概要は準備中です。原文の説明を表示しています。
Audit codebases and infrastructure for security issues. Use when scanning dependencies for vulnerabilities, detecting hardcoded secrets, checking OWASP top 10 issues, verifying SSL/TLS, auditing file permissions, or reviewing code for injection and auth flaws.
日本語の概要は準備中です。原文の説明を表示しています。
支持通过AI生成符合公众号规范的图文（文章和贴图），并推送到公众号草稿箱，兼容其它SKILL生成的图文、图片进行推送。通过配置向导扫码授权，支持多账号。无需泄露公众号Secret密钥，无需配置公众号IP白名单。
日本語の概要は準備中です。原文の説明を表示しています。
Fail-closed security auditing for OpenClaw/ClawHub skills & repos: trufflehog secrets scanning, semgrep SAST, prompt-injection/persistence signals, and supply-chain hygiene checks before enabling or installing.
日本語の概要は準備中です。原文の説明を表示しています。
Security audit engine for OpenClaw configurations. Detects vulnerabilities, misconfigurations, secret leaks, and over-privileged agents. Use when the user asks about security, hardening, config review, or audit of their OpenClaw setup.
日本語の概要は準備中です。原文の説明を表示しています。
CI/CD pipeline patterns with GitHub Actions, release automation, and testing strategies. Use for: github actions, workflow, CI, CD, pipeline, deploy, release, semantic release, changesets, goreleaser, matrix, cache, secrets, environment, artifact, reusable workflow, composite action.
日本語の概要は準備中です。原文の説明を表示しています。
Clone/create/fork repos; manage remotes, releases.
日本語の概要は準備中です。原文の説明を表示しています。
Configures Options pattern, user secrets, and feature flags. IOptions<T>, FeatureManagement.
日本語の概要は準備中です。原文の説明を表示しています。
Use when standing up a fresh deployment of this codebase (or the public vigyan-site-os template) — populates company identity, branding and starting content without committing any of it, and decides for each value whether it belongs in platform env, encrypted DB secrets, DB config, or an admin screen.
日本語の概要は準備中です。原文の説明を表示しています。
Exploits JWT algorithm confusion vulnerabilities where the server's token verification library accepts the algorithm specified in the JWT header rather than enforcing a fixed algorithm. The tester manipulates the alg header to switch from RS256 to HS256 (using the RSA public key as the HMAC secret), sets alg to none to bypass signature verification, or exploits kid/jku/x5u header injection to supply attacker-controlled keys. Activates for requests involving JWT algorithm confusion, alg none attack, key confusion attack, or JWT signature bypass.
日本語の概要は準備中です。原文の説明を表示しています。
Scans GitHub Actions workflows and CI/CD pipeline configurations for supply chain attack vectors including unpinned actions, script injection via expressions, dependency confusion, and secrets exposure. Uses PyGithub and YAML parsing for automated audit. Use when hardening CI/CD pipelines or investigating compromised build systems.
日本語の概要は準備中です。原文の説明を表示しています。
Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation, and anonymous API access. Builds threat detection rules from audit event patterns. Use when investigating Kubernetes cluster compromise or building k8s-specific SIEM detection rules.
日本語の概要は準備中です。原文の説明を表示しています。