1,138 件 ・ 関連度順
概要と使いどころ
Bypass authentication via forced browsing to protected URLs, parameter tampering (authenticated=yes, debug=true, fromtrustIP=true), session ID prediction from linear/incremental cookies, SQL injection on login forms, PHP unserialize() boolean type juggling (b:1 payload), and credential transport over HTTP. Detectable with Burp Suite, OWASP ZAP, WebGoat.
日本語の概要は準備中です。原文の説明を表示しています。
Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every technique includes actual payloads, commands, and verification logic. Chains from /pentester or /codebase when API endpoints are discovered, chains into /web-exploit when classic injection points are found in API parameters, chains into /post-exploit when RCE is achieved, and chains into /ai-redteam when an LLM/AI endpoint is discovered (chat APIs, completion endpoints, RAG search, agentic tool-use, MCP servers).
日本語の概要は準備中です。原文の説明を表示しています。
401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.
日本語の概要は準備中です。原文の説明を表示しています。
Analyzes CVE vulnerabilities in project dependencies with code path tracing and PoC generation for Burp Suite. Traces vulnerable code from user input to sink, assesses exploitability, and generates HTTP requests for testing.
日本語の概要は準備中です。原文の説明を表示しています。
Secrets management, XSS prevention, CSRF protection, dependency scanning, DOMPurify sanitization, CSP headers, CODEOWNERS, HttpOnly cookies
日本語の概要は準備中です。原文の説明を表示しています。
Bun-native HTTP framework — routing, TypeBox validation, Eden Treaty, plugins, lifecycle hooks
日本語の概要は準備中です。原文の説明を表示しています。
Application-level caching strategies, HTTP caching, cache invalidation, and stampede prevention
日本語の概要は準備中です。原文の説明を表示しています。
国内 Git 平台配置参考——Gitee、Coding.net、极狐 GitLab、CNB 的 SSH/HTTPS/凭据/CI 接入差异与镜像同步配置。仅在用户显式 /chinese-git-workflow 时调用，不要根据上下文自动触发。
日本語の概要は準備中です。原文の説明を表示しています。
Hunts for domain fronting and CDN abuse by detecting TLS SNI versus HTTP Host header mismatches and high-reputation CDN domains carrying anomalous traffic in network telemetry. Activates for requests to hunt domain fronting, detect SNI/Host mismatch, or find CDN abuse used to mask C2.
日本語の概要は準備中です。原文の説明を表示しています。
Hunts for Cobalt Strike beacon traffic by detecting default stager URI checksum8 values, default Malleable C2 profile artifacts, and default ports/named pipes in HTTP and process telemetry. Activates for requests to hunt Cobalt Strike, detect beacon stager URIs, or find default Malleable C2 indicators.
日本語の概要は準備中です。原文の説明を表示しています。
Builds Zeek-based network hunting analytics by writing scripts and analyzing Zeek logs (conn, dns, http, ssl, files) to surface long connections, rare JA3s, suspicious downloads, and beaconing. Activates for requests to build Zeek analytics, write a Zeek hunting script, or analyze Zeek logs for threats.
日本語の概要は準備中です。原文の説明を表示しています。
Captures and analyzes malware network traffic from a detonation: extracting C2 endpoints, HTTP/DNS patterns, TLS metadata (JA3/SNI), and beaconing from a PCAP to build network IOCs and detection. Activates for requests to analyze malware PCAP, extract C2 from traffic, or study network behavior.
日本語の概要は準備中です。原文の説明を表示しています。
OpenUI generative UI with C# ASP.NET Core Minimal API backend. Direct OpenAI API SSE streaming via HttpClient on .NET 10.
日本語の概要は準備中です。原文の説明を表示しています。
OpenUI generative UI with a Ruby on Rails backend. SSE streaming via ActionController::Live, forwarding the OpenAI API stream with Net::HTTP.
日本語の概要は準備中です。原文の説明を表示しています。
Natural-language orchestration of security tools through Gemini. Translates intent ("scan this scope for exposed admin panels") into safe, parameterized tool pipelines using nmap, masscan, naabu, httpx, nuclei, ffuf, gobuster, subfinder, amass, dnsx, katana, gau, semgrep, trivy, checkov, gitleaks, syft, grype, and custom scripts. Use when the user wants Gemini to drive a chain of CLI tools end to end with guardrails.
日本語の概要は準備中です。原文の説明を表示しています。
Validate SEO preservation during site migrations. Checks redirect chains (301 vs 302, hop count), canonical consistency, title/meta preservation, HTTP status codes, content similarity, and schema preservation. Accepts single URL pair or CSV file of URL pairs. Use when user says "migration check", "site migration", "redirect audit", "URL mapping", "domain change", "relaunch", "site move".
日本語の概要は準備中です。原文の説明を表示しています。
Generate images via the Stable Diffusion WebUI / Forge HTTP API (AUTOMATIC1111-compatible `/sdapi/v1/*`). Use when the user wants to (1) discover or pick a model / extra module (TE/VAE) / sampler / scheduler / style preset from a running sd-webui server, (2) generate an image with a given prompt (txt2img), (3) check generation progress, (4) cancel/interrupt an in-flight generation, (5) inspect or change a global sd-webui option (e.g. active checkpoint), or (6) test connectivity. This skill talks to a *generic* sd-webui-compatible server (AUTOMATIC1111, Forge, reForge, sd-webui-forge-classic). Do NOT trigger for requests that are purely writing the prompt itself.
日本語の概要は準備中です。原文の説明を表示しています。
Caddy guidance — automatic HTTPS, Caddyfile patterns, reverse proxying, and simple production deployments.
日本語の概要は準備中です。原文の説明を表示しています。
Build interactive "living workflow" flowcharts in the visual style of https://statuesque-starship-49757d.netlify.app/revenue-engine - vanilla HTML/CSS/JS files with a horizontal step bar, a vertical trunk that grows per step, tool-to-tool columns with animated payload pills between brand-marked tool nodes, alternating left/right step descriptions, and per-step outputs. Use whenever the user says "build a flowchart", "interactive flowchart", "living workflow", "revenue engine flowchart", "demand gen flowchart", "GTM workflow diagram", "process diagram with animations", "Nebor-style flowchart", or asks to recreate the workflow visual from the Nebor site. Always asks which flowchart to build (Revenue Engine / Demand Gen / CRM & RevOps / Custom) and waits for explicit approval of the step + tool + edge table before generating any files.
日本語の概要は準備中です。原文の説明を表示しています。
Use @vercel/error to design, implement, migrate, audit, or review structured TypeScript errors. Trigger when a project uses or adopts the package, or when work involves its codes, fields, factories, HTTP APIs, telemetry, or terminal output. Use native Error for local failures that need no stable identity, recovery guidance, observability, or transport.
日本語の概要は準備中です。原文の説明を表示しています。
Plan and, with explicit network consent, use an optional external Defuddle cleaner to extract article-like HTTPS pages as Markdown. Use for defuddle, clean this URL, strip page clutter, readable Markdown from a web page, or preparing a web source for later wiki ingestion.
日本語の概要は準備中です。原文の説明を表示しています。
FALLBACK ONLY — do not invoke unless you have already ruled out (1) a native API (Gmail API, GitHub API, Slack API …), (2) a CLI (git, gh, aws, npm, curl …), (3) direct file editing, and (4) existing browser automation (Playwright, Puppeteer). Only when all four are unavailable or have already failed should you use this skill. It gives AI agents a cursor and a keyboard on a real desktop — the last mile when the only remaining surface is a GUI. Concretely: use it when an earlier attempt via API, CLI, or direct file edit has failed and the user says things like "open X", "click Send", "type this in Word", "read what is on my screen", "do this in Outlook", "drive the Figma UI", "control my desktop", "automate this workflow", "fill out this form", or "copy text between apps". Works on Windows, macOS, and Linux with any LLM that can call functions (Claude, GPT, Gemini, Llama, Kimi, Ollama) over MCP — stdio for editor hosts (Claude Code, Cursor, Windsurf, Zed) or HTTP for daemons and dashboards.
日本語の概要は準備中です。原文の説明を表示しています。
Manages Cloud Run services, jobs, and worker pools. Use when you need to deploy applications responding to HTTP requests (services), run event-triggered or scheduled tasks (jobs), or handle always-on pull-based background processing (worker pools).
日本語の概要は準備中です。原文の説明を表示しています。
Produce or review API contract documentation for Salesforce integrations: versioning policy artifacts, request/response schema specs, error code catalogs, rate limit documentation, OpenAPI generation for sObjects. Trigger keywords: Salesforce API versioning policy, API end-of-life policy, document API endpoints, REST API rate limits, OpenAPI sObjects, API contract record, error contract, errorCode catalog, 410 GONE retired API version, HTTP 300 external ID upsert, idempotency key, deprecation notice, composite subrequest limit. NOT for building the endpoint or writing the Apex REST service — use apex/apex-rest-services. NOT for upgrading the API version on your own Apex, LWC or sfdx-project.json — use devops/api-version-management.
日本語の概要は準備中です。原文の説明を表示しています。