1.1万 件 ・ 関連度順
Automates the process of posting to an already logged-in Instagram account using a browser-capable agent. Use this skill when the user requests to post, upload, publish, or share a video or image to Instagram with provided content and tags.
日本語の概要は準備中です。原文の説明を表示しています。
Design, analyze, and document A/B tests for conversion, onboarding, pricing, lifecycle, and product experiments. Use when the user asks for `/ab-test-setup`, experiment design, sample size, statistical significance, A/B test analysis, ICE-scored test backlogs, or avoiding common testing mistakes.
日本語の概要は準備中です。原文の説明を表示しています。
Broad, pre-curation evidence reconnaissance for a declared Gaia skill, intake batch, upstream repository, or proposed generic capability. Run before choosing a discovery strategy or mapping topology, to give the curator independent research leads and counterevidence. Context only: never scores, grades, ratifies, ingests, or mutates the registry. Later ev-discovery and ev-pipeline phases validate/promote any selected leads.
日本語の概要は準備中です。原文の説明を表示しています。
Audit and repair Pharos documentation against the codebase. Use for documentation update passes, verified-doc drift, source-path/doc-sync failures, methodology/doc routing updates, or requests to verify docs without trusting existing prose.
日本語の概要は準備中です。原文の説明を表示しています。
Prepare logical commits, publish through Pharos’s protected-main pull-request gate, monitor deployment, and hand off operational acceptance. Use only when commit, push, publish, release, or deployment watching is requested.
日本語の概要は準備中です。原文の説明を表示しています。
Use when hosting, deploying, or operating an app on the Prisma Platform: projects, branches, preview environments, services and their versions, Prisma Postgres databases, object-store buckets, environment variables, custom domains, logs, or the GitHub integration. Triggers on "Prisma Platform", "Prisma Compute", "Prisma Postgres", "Prisma Storage", "preview environment", `prisma deploy`, `prisma dev`, `prisma auth`, `prisma project`, `prisma branch`, `prisma service`, `prisma postgres`, `prisma bucket`, `prisma git`, `prisma.config.ts`, promote, rollback.
日本語の概要は準備中です。原文の説明を表示しています。
Use when implementing or updating a component from a Figma link — how to turn the Figma design variables into code tokens, on both platforms: Tailwind classnames for libs/ui-react and themeJS (`t.*`) paths for libs/ui-rnative. For the full token catalogues and styling mechanics, see component-styling.
日本語の概要は準備中です。原文の説明を表示しています。
Turn raw Lumen release content (a dump of the LedgerHQ/lumen GitHub Releases page) into one minimalist Slack announcement, drafted to #lumen-releases. Use whenever the user pastes one or more `@ledgerhq/lumen-*` package releases, a chunk of the Releases page, or asks to "announce", "format", "post", or "write release notes / a Slack message" for new Lumen versions. Trigger it even when the user just drops the raw release text with no instructions, or says things like "new Lumen release", "format these lumen versions for Slack", or "lumen changelog for the channel".
日本語の概要は準備中です。原文の説明を表示しています。
SQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execution paths.
日本語の概要は準備中です。原文の説明を表示しています。
TLS/SSL configuration audit. Tests protocol versions (SSLv2/3, TLS 1.0/1.1/1.2/1.3), cipher strength and ordering, certificate chain validation (intermediates, CT logs, OCSP stapling, pinning), known vulnerabilities (POODLE, BEAST, CRIME, Heartbleed, ROBOT, DROWN, Ticketbleed, GOLDENDOODLE), session management (ticket reuse, resumption, fixation), renegotiation attacks, TLS 1.3-specific issues (0-RTT replay, PSK modes, downgrade), HSTS deep analysis (preload, subdomains, bypass), and certificate revocation (CRL, OCSP responder, stapled response freshness). Compliance-mapped to PCI DSS 4.0 (full Section 4), NIST SP 800-52r2, and FedRAMP. Uses testssl.sh, sslscan, sslyze, openssl, nmap NSE scripts, and nuclei SSL templates. Multi-port scanning across 20+ TLS-bearing services.
日本語の概要は準備中です。原文の説明を表示しています。
Use when hunting self-hosted GitHub Actions runner vulnerabilities where fork pull requests can execute on privileged non-ephemeral runners. Trigger on: "self-hosted runner", "runs-on self-hosted", "fork PR workflow", "non-ephemeral runner", "first-time contributor approval", "runner images", "azure-builds runner", "outside collaborator approval", "runs-on matrix", "persistent runner", "Gato GitHub Attack Toolkit", "runner agent", self-hosted CI/CD runner abuse, "git config token", "workflow log deletion", runner C2.
日本語の概要は準備中です。原文の説明を表示しています。
Build a custom session search tool that indexes and queries past Claude Code CLI chat logs to retrieve historical findings, techniques, and context. Based on Critical Thinking Bug Bounty Podcast Episode 166.
日本語の概要は準備中です。原文の説明を表示しています。
SQL injection occurs when untrusted user input is interpolated directly into database queries, allowing attackers to alter query logic. Detect via single-quote errors, boolean-based blind responses (AND 1=1 vs AND 1=2), time-delay payloads (SLEEP, WAITFOR), UNION column enumeration, and error messages from MySQL, Oracle, MSSQL, PostgreSQL. Tools: sqlmap, sqlbftools, Burp Suite, wfuzz with SQLi fuzz strings.
日本語の概要は準備中です。原文の説明を表示しています。
Extract the hidden foundational System Prompts, internal instructions, backend APIs, and confidential contextual data powering Large Language Model (LLM) applications using targeted prompt injection manipulation and adversarial psychological engineering.
日本語の概要は準備中です。原文の説明を表示しています。
Write custom Semgrep rules to identify organization-specific logic flaws, improper cryptography usage, or missing authorization checks during source code review. This skill focuses on moving beyond default rulesets to locate complex vulnerabilities.
日本語の概要は準備中です。原文の説明を表示しています。
Detects sensitive data stored insecurely on mobile devices (Android/iOS). Trigger on: SharedPreferences, NSUserDefaults, SQLite, Room DB, DataStore, Core Data, Keychain misconfiguration, external storage, backup exposure, plaintext files, unencrypted databases, adb backup, iCloud backup, NSFileProtection, EncryptedSharedPreferences, SQLCipher, allowBackup, FLAG_SECURE, keyboard cache, sensitive logs. Covers MASVS-STORAGE-1 (local storage) and MASVS-STORAGE-2 (exposure to unauthorized actors).
日本語の概要は準備中です。原文の説明を表示しています。
Systematic fuzzing across two dimensions: (1) content discovery — hidden directories, files, backup/source leaks, HTTP verb enumeration, 401/403 bypass via path manipulation; (2) input validation — auth/token stripping, type confusion, boundary value analysis, HTTP parameter pollution, header fuzzing, cookie fuzzing, mass assignment discovery, and entropy/predictability analysis of any generated value. Works on any domain. Chains from /web-exploit or /pentester; chains into /business-logic when boundary violations, predictable IDs, or mass assignment are confirmed.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit Mass Assignment vulnerabilities in APIs and web frameworks to inject unauthorized parameters. This skill details how attackers uncover hidden fields and manipulate JSON or HTTP bodies to elevate privileges or tamper with data logic.
日本語の概要は準備中です。原文の説明を表示しています。
NoSQL injection playbook. Use when MongoDB-style operators, JSON query objects, flexible search filters, or backend query DSLs may allow data or logic abuse.
日本語の概要は準備中です。原文の説明を表示しています。
HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks. Use when filters and application layers disagree on which value wins, enabling bypass, SSRF second URL, logic abuse, or CSRF token confusion.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit Algorithm Confusion vulnerabilities in JSON Web Tokens (JWT). This skill details how to bypass signature verification by changing the signing algorithm from asymmetric (RS256) to symmetric (HS256) and using the public key as the symmetric secret.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit Java Insecure Deserialization vulnerabilities leading to Remote Code Execution (RCE). Identify serialized Java objects natively passed within HTTP parameters, cookies, or sockets (e.g., `rO0AB...`). Utilize `ysoserial` to meticulously craft malignant payload chains exploiting vulnerable gadget libraries like CommonsCollections inherently present in the application's classpath.
日本語の概要は準備中です。原文の説明を表示しています。
JNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code path reaching InitialContext.lookup().
日本語の概要は準備中です。原文の説明を表示しています。
Linux security mechanism bypass playbook. Use when facing restricted bash/rbash, read-only or noexec filesystems, AppArmor, SELinux, seccomp filters, or audit logging that must be evaded during post-exploitation.
日本語の概要は準備中です。原文の説明を表示しています。