1,152 件 ・ 関連度順
概要と使いどころ
Facilitate monthly S&OP or integrated business planning cycles by aligning demand, supply, inventory, capacity, and executive decisions with a standard meeting rhythm and decision log. Use when operations teams need a demand review, supply review, pre-S&OP reconciliation, or executive S&OP pack. Do not use for single-SKU replenishment math only.
日本語の概要は準備中です。原文の説明を表示しています。
Organize month-end or quarter-end close blockers, reconciliations, owners, and evidence gaps into a routine control pack. Use when the work is finance close coordination and issue tracking. Do not use for accounting judgment, policy interpretation, or final technical accounting conclusions.
日本語の概要は準備中です。原文の説明を表示しています。
Write blameless incident postmortems following Google SRE methodology. Covers timeline reconstruction, root cause analysis (5 Whys), impact assessment, and action items with owners. Use after production incidents, outages, or significant bugs to prevent recurrence.
日本語の概要は準備中です。原文の説明を表示しています。
Digital forensics and incident response triage skill for disk, memory, network, cloud, and endpoint artifacts. Covers Volatility 3, Velociraptor, KAPE, Plaso, Autopsy, Chainsaw, Hayabusa, Zeek, Arkime, EVTX, AWS/Azure/GCP audit logs, and timeline reconstruction. Use to extract IOCs, build incident timelines, and produce defensible analyst reports.
日本語の概要は準備中です。原文の説明を表示しています。
Authorized offensive security skill for ethical penetration testing, red-team planning, vulnerability validation, reconnaissance of owned assets, web/API/mobile/cloud assessment, report writing, remediation guidance, and lab-based security testing. Use only for systems the user owns or is authorized to test; focus on safe, scoped, legal assessment and defensive improvement.
日本語の概要は準備中です。原文の説明を表示しています。
Bug bounty workflow skill for program scope mapping, recon-to-report automation, deduplication against prior submissions, and high-signal reporting on HackerOne, Bugcrowd, Intigriti, YesWeHack, and self-hosted programs. Use to organize bounty work end to end while staying inside program rules.
日本語の概要は準備中です。原文の説明を表示しています。
Utilize Shodan, the search engine for Internet-connected devices, to discover exposed assets, vulnerable ports, default credentials, and specific infrastructure configurations using advanced search queries (dorks).
日本語の概要は準備中です。原文の説明を表示しています。
Memory forensics playbook using Volatility 2/3. Use when analyzing memory dumps for malware analysis, credential extraction, process investigation, code injection detection, and incident response timeline reconstruction.
日本語の概要は準備中です。原文の説明を表示しています。
Extract sensitive training data and internal capabilities from AI models through repeated programmatic querying. Use this skill when testing LLMs and ML models for data privacy leaks, intellectual property exposure, or unintended memorization. Covers membership inference, prompt extraction, training data reconstruction, and API boundary testing.
日本語の概要は準備中です。原文の説明を表示しています。
Perform advanced network scanning and service enumeration using Nmap for penetration testing and security assessments. Use this skill when conducting network reconnaissance, port scanning, service version detection, OS fingerprinting, and vulnerability scanning. Covers stealth scanning, firewall evasion, NSE script usage, and network mapping for infrastructure penetration tests.
日本語の概要は準備中です。原文の説明を表示しています。
Full penetration test using MCP tools — recon, scanning, exploitation, and reporting. Tailored for OpenCode (BYO LLM). Supports network/web targets and local codebases. Chains into analyze-cve, threat-modeling, and remediate skills automatically.
日本語の概要は準備中です。原文の説明を表示しています。
Source control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidden dirs, or backup/config leaks during authorized testing.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit exposed GraphQL introspection endpoints to map the entire API schema. This skill details how to extract available queries, mutations, types, and fields, which significantly aids in identifying hidden endpoints, Broken Object Level Authorization (BOLA/IDOR), and mass assignment vulnerabilities.
日本語の概要は準備中です。原文の説明を表示しています。
Email infrastructure security audit. Tests SPF, DKIM, DMARC configuration, open relay, email spoofing resilience, S/MIME, MTA-STS, TLS-RPT, and SMTP security. Uses swaks, dnsrecon, nmap SMTP scripts, smtp-user-enum, and dig. Pure skill markdown — no new infrastructure needed.
日本語の概要は準備中です。原文の説明を表示しています。
Entry P0 primary router for HackSkills. Use when the task involves web application testing, API security assessment, recon, vulnerability triage, exploit path planning, or choosing the right next category skill before any deep topic skill.
日本語の概要は準備中です。原文の説明を表示しています。
Writes professional bug bounty reports for HackerOne, Bugcrowd, and Intigriti with CVSS 4.0 scoring, business impact, working exploits, and remediation. Runs 5-check Pre-Report Verification first: hallucination detection, AI writing patterns, PoC reproducibility, duplicate detection, and impact plausibility. Use when user describes a vulnerability, shares HTTP logs, HAR files, recon output, or screenshots; says 'write a bug report', 'format my finding', 'draft a vuln report', 'is this valid', 'rate my vulnerability', 'verify my report', or any variant. Trigger for partial or messy input — raw notes, one-liners, or full writeups all work. Do not wait for perfect input.
日本語の概要は準備中です。原文の説明を表示しています。
AI/LLM red-team assessment using the OWASP LLM Top 10 (2025) + OWASP AI Testing Guide (AITG v1, Nov 2025) frameworks, plus OWASP MCP Top 10 runtime testing for agentic/MCP targets. Tests prompt injection, jailbreaks, system prompt leakage, sensitive data extraction, excessive agency, improper output handling, model extraction, content bias, evasion, membership inference, MCP token exposure, MCP command injection, and more. Uses four tools in combination: FuzzyAI (single-turn jailbreak fuzzing), PyRIT (multi-turn orchestrated attacks), Garak (probe-based vulnerability scanning), and promptfoo (plugin-based red-team evaluation). Each tool covers different OWASP categories; running them together gives systematic coverage. Includes a conditional MCP reconnaissance phase and a post-access AI infrastructure phase (chained from /post-exploit). Produces: OWASP LLM Top 10 + AITG + MCP coverage matrix, findings per category, architecture diagram of the AI system, PoCs for confirmed exploits. Chains into /gh-export for issue filing.
日本語の概要は準備中です。原文の説明を表示しています。
Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.
日本語の概要は準備中です。原文の説明を表示しています。
Bug bounty findings secretary, tracker, and workspace initializer for the bb-huge portal. Use this skill for web security research, vulnerability hunting, and hunt workspace setup. Triggers on: "log finding", "save finding", "add to bb-huge", "record vulnerability", "update finding", "show findings", "bb-huge stats", "mark as confirmed", "mark as rewarded", "setup workspace", "pull evidence", "continue working on finding", "dump attachments", "list my skills", "what skills do I have", "/bb-huge init", "init hunt workspace", "new bug bounty program", "start hunting", "mobile bug bounty", "binary analysis", "source code review", "white-box audit", "h1-brain", "hack program", "hack()", "search disclosed", "fetch rewarded". Also auto-activates whenever a vulnerability is discovered during any recon, fuzzing, or manual testing session — do not wait to be asked.
日本語の概要は準備中です。原文の説明を表示しています。
Frappe Payments and ERPNext payment workflow guidance for payment gateways, payment requests, subscriptions, invoices, reconciliation, webhooks, and secure checkout flows. Use when work touches payments in Frappe or ERPNext.
日本語の概要は準備中です。原文の説明を表示しています。
Native WebSocket API patterns, connection lifecycle, reconnection strategies, heartbeat, message typing, binary data, custom hooks
日本語の概要は準備中です。原文の説明を表示しています。
Socket.IO v4.x client patterns, connection lifecycle, reconnection, authentication, rooms, namespaces, acknowledgments, binary data, TypeScript integration
日本語の概要は準備中です。原文の説明を表示しています。
Server-Sent Events for unidirectional server-to-client streaming, EventSource API, fetch streaming, reconnection patterns, message parsing
日本語の概要は準備中です。原文の説明を表示しています。
Broad, pre-curation evidence reconnaissance for a declared Gaia skill, intake batch, upstream repository, or proposed generic capability. Run before choosing a discovery strategy or mapping topology, to give the curator independent research leads and counterevidence. Context only: never scores, grades, ratifies, ingests, or mutates the registry. Later ev-discovery and ev-pipeline phases validate/promote any selected leads.
日本語の概要は準備中です。原文の説明を表示しています。