1,095 件 ・ 関連度順
概要と使いどころ
Write structured job descriptions with clear requirements, responsibilities, and employer value proposition. Follows SHRM BASK competency framework. Adapts tone to employer brand and industry context. Use when creating new positions or updating existing JDs. Do not use for internal performance criteria or career ladder definitions.
日本語の概要は準備中です。原文の説明を表示しています。
Write agency-standard creative briefs for marketing campaigns. Structure Background, Objective (SMART), Target Audience persona, Key Message, Mandatories, KPIs, Timeline, and Budget Allocation. Use when briefing agencies, creative teams, or internal marketing on a new campaign.
日本語の概要は準備中です。原文の説明を表示しています。
Assess organizational readiness for financial audits (internal or external). Map assertions to account balances, check evidence completeness, score readiness using a Red/Amber/Green framework, and generate a remediation timeline. Aligned with SOX, IFRS, and GAAP audit standards. Use before scheduled audits or when preparing for first-time compliance.
日本語の概要は準備中です。原文の説明を表示しています。
Draft crisis communication packages including holding statements, stakeholder updates, Q&A documents, and internal briefs. Follows ICS (Incident Command System) communication principles. Use during PR crises, data breaches, product recalls, or any event requiring rapid coordinated messaging.
日本語の概要は準備中です。原文の説明を表示しています。
Map the end-to-end customer journey across awareness, consideration, purchase, onboarding, adoption, retention, and advocacy stages. Identify touchpoints, pain points, emotions, and Moments of Truth per stage. Use when designing or improving customer experience. Do not use for internal employee process mapping — use process-mapper instead.
日本語の概要は準備中です。原文の説明を表示しています。
Compare policies, procedures, onboarding files, or operating evidence against a named compliance framework such as AML/KYC, privacy, internal controls, or audit readiness. Use when a team needs a gap matrix, control checklist, remediation priorities, or evidence request list. Do not use when no target framework is specified or when formal legal or regulatory sign-off is required.
日本語の概要は準備中です。原文の説明を表示しています。
Threat intelligence fusion skill for collecting, normalizing, deduplicating, enriching, and operationalizing IOCs and TTPs from OTX, MISP, abuse.ch, VirusTotal, Shodan, GreyNoise, Censys, CISA KEV, NVD, vendor blogs, and internal telemetry. Use to build STIX/TAXII feeds, ATT&CK-mapped actor profiles, prioritized blocklists, and detection-ready intel packages.
日本語の概要は準備中です。原文の説明を表示しています。
Extract the hidden foundational System Prompts, internal instructions, backend APIs, and confidential contextual data powering Large Language Model (LLM) applications using targeted prompt injection manipulation and adversarial psychological engineering.
日本語の概要は準備中です。原文の説明を表示しています。
Server-Side Request Forgery (SSRF) occurs when user-controlled input is used to construct URLs that the server fetches, enabling access to internal services, cloud metadata endpoints (169.254.169.254), and local files via `file://` scheme. Detect via parameters accepting URLs or hostnames, PDF/report generators rendering `<iframe>/<img>/<script>`, and blind SSRF via out-of-band DNS callbacks. Bypass filters using IP decimal/octal/hex encoding, URL-userinfo tricks, and URL fragments. Tools: Burp Collaborator, curl.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit SMTP Open Relays. This skill teaches how to test mail servers to determine if they process email delivery regardless of the sender or recipient domain, enabling attackers to spoof internal addresses and bypass basic anti-phishing controls.
日本語の概要は準備中です。原文の説明を表示しています。
Execute commands and binaries on remote Windows systems utilizing PsExec and SMB/RPC mechanisms. This skill details the mechanics behind tools like Sysinternals PsExec, Impacket's psexec.py, and their role in lateral movement via hidden administrative shares.
日本語の概要は準備中です。原文の説明を表示しています。
SSRF playbook. Use when the server fetches URLs, resolves hostnames, imports remote content, or can be driven toward internal networks, cloud metadata, or secondary protocols.
日本語の概要は準備中です。原文の説明を表示しています。
Execute lateral movement within Active Directory environments using credential material (NTLM hashes and Kerberos tickets) instead of plaintext passwords. Use this skill when engaging in red team operations or internal network penetration tests to expand access, bypass authentication portals, and achieve Domain Dominance without relying on crackable passwords.
日本語の概要は準備中です。原文の説明を表示しています。
Extract sensitive training data and internal capabilities from AI models through repeated programmatic querying. Use this skill when testing LLMs and ML models for data privacy leaks, intellectual property exposure, or unintended memorization. Covers membership inference, prompt extraction, training data reconstruction, and API boundary testing.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit Insecure Direct Object Reference (IDOR), or Broken Object Level Authorization (BOLA), vulnerabilities. Manipulate internal identifiers (e.g., user IDs, database primary keys, transaction IDs) within HTTP request parameters or API payloads to unauthorizedly access, modify, or delete data belonging to other users.
日本語の概要は準備中です。原文の説明を表示しています。
Linux lateral movement playbook. Use after gaining initial access to pivot across Linux hosts via SSH hijacking, credential harvesting, internal pivoting, D-Bus exploitation, sudo token reuse, and shared filesystem abuse.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit insecure handling of the HTTP Host header to poison password resets, generate cache poisoning vectors, or bypass internal routing restrictions. Use this skill when web applications dynamically generate URLs, links, or redirects based on the arbitrary Host header value supplied by the client rather than relying on a static, trusted server configuration.
日本語の概要は準備中です。原文の説明を表示しています。
DNS rebinding attack playbook. Use when testing applications that trust DNS resolution for origin checks, interact with internal services from browser context, or when SSRF is not possible server-side but the target has client-side fetch/XHR to attacker-controlled domains.
日本語の概要は準備中です。原文の説明を表示しています。
Execute and analyze malware samples within a highly controlled, instrumented sandbox environment to observe their true behavior, network communications, file system modifications, and registry changes in real-time.
日本語の概要は準備中です。原文の説明を表示しています。
Supply-chain testing via package-manager dependency confusion: when internal package names resolve to attacker-controlled public registries, leading to malicious install and script execution. Use for npm/pip/gem/Maven/Composer/Docker manifest review and authorized red-team supply-chain exercises.
日本語の概要は準備中です。原文の説明を表示しています。
Container and Kubernetes security assessment. Tests container escape vectors, Docker/containerd socket exposure, K8s RBAC misconfigurations, pod security violations, exposed API servers, etcd access, service account token abuse, image layer secrets, private registry attacks, SSRF to metadata services, cross-namespace network bypass, CIS benchmarks, crypto miner detection, resource exhaustion, and admission controller gaps. Both external and internal (compromised pod) perspectives. Uses trivy, kube-bench, kubectl, nuclei, dive, amicontained, and docker-bench-security. Covers OWASP Kubernetes Top 10 and all 22 Kubernetes Goat attack scenarios.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit Mass Assignment vulnerabilities in APIs. Use this skill when testing REST APIs or application forms that directly map user-supplied JSON or POST input to internal database objects. An attacker can inject undocumented variables (e.g., `is_admin`, `verified`) to illegally modify restricted properties.
日本語の概要は準備中です。原文の説明を表示しています。
Fierce autonomous internal co-founder. Bounded web research for evidence-backed improvements. Structured idea formulation with self-critique filter that rejects ideas not serving the goal. Auto-implements high-confidence aligned improvements, proposes medium-confidence ideas for approval. Evaluates viral coefficient, AI search visibility (GEO), and solo SaaS economics. Considers higher pursuits: employing disabled people, spiritual tech investigation, 99% wealth donation ethos.
日本語の概要は準備中です。原文の説明を表示しています。
Audit technical, on-page, and AI-search SEO for pages, sites, and content. Use when the user asks for `/seo-audit`, `/ai-seo`, SEO review, keyword targeting, heading structure, metadata, internal linking, content gaps, AEO, GEO, LLMO, or competitor SEO comparisons.
日本語の概要は準備中です。原文の説明を表示しています。