94 件 ・ 関連度順
概要と使いどころ
Use when choosing, implementing, or reviewing browser storage such as localStorage, sessionStorage, IndexedDB, cookies, client persistence, offline data, secure storage, or cleanup strategy; Chinese triggers include browser storage, client persistence.
日本語の概要は準備中です。原文の説明を表示しています。
Run the same scrape or task across many accounts at once - each in its own browser profile with its own fingerprint, cookies and exit IP - and read data from sites that need a session or that answer a plain HTTP scraper with a captcha while answering a real browser. One command per site returns JSON, so there are no selectors to write or repair: Amazon and Walmart search, Google and DuckDuckGo results, Reddit posts and comments, X timeline, Medium, Yelp, Indeed job listings, Hacker News, GitHub, PyPI, npm, plus exit-IP and fingerprint checks. Use for multi-account operations you are authorized to run, price and listing monitoring per region, SERP collection, logged-in data, and scrapers that keep breaking. Also for 'scrape amazon', 'google search results', 'reddit data', 'scrape logged in site', 'run task on many accounts', 'site blocks my scraper', 'scraping without selectors'. Node or Python.
日本語の概要は準備中です。原文の説明を表示しています。
Browser automation CLI for agents: navigate, click/fill, screenshot, extract data, test apps, Electron/Slack, cloud browsers. NOT for the user's real Chrome profile/cookies (mk:chrome-profile).
日本語の概要は準備中です。原文の説明を表示しています。
Target a specific Google Chrome user profile for browser automation via CDP. Discovers installed profiles from the Chrome Local State file, launches Chrome with the requested profile attached to a debug port, and connects agent-browser via `agent-browser connect <port>`. Use when "automate using my Work/Personal Chrome", "open site with my saved session", or "use Chrome profile named <name>". NOT for headless scraping without an existing user profile (use mk:agent-browser directly); NOT for importing cookies only (use agent-browser --auto-connect state save).
日本語の概要は準備中です。原文の説明を表示しています。
Browser automation CLI for AI agents using agent-browser. Use for navigating websites, clicking/filling pages, screenshots, data extraction, web app testing, exploratory QA, dogfooding, Electron apps, Slack automation, Vercel Sandbox browser runs, AWS AgentCore cloud browsers, auth-heavy flows, and long autonomous browser sessions. Prefer over generic browser tools when a fresh/tool-managed Chrome session is fine. NOT for the user's real Chrome cookies/profile (see mk:chrome-profile); NOT for reusable Playwright specs (see mk:qa-manual).
日本語の概要は準備中です。原文の説明を表示しています。
Use when wrangler deploys silently fail or produce wrong artifacts, secrets upload as empty strings, custom domain DNS is not resolving, route assignment broke after rename, observability/tail logs are needed, D1/KV/R2 bindings are missing, OAuth scope errors block a command, cookies on a redirect are not attaching, or the worker exceeds CPU time. Triggers: "Tenant or user not found", "Authentication error" on wrangler d1 push, secret length is 0 after upload, route returns origin not worker, "compatibility_date too old", 1101 errors, custom_domain assignment lost on script rename. NOT for AWS Lambda / Vercel Edge / Deno Deploy (different runtimes), Cloudflare Zero Trust, or R2-specific tuning.
日本語の概要は準備中です。原文の説明を表示しています。
Load for authentication or authorization changes involving BFF cookies/tokens, JWT validation, claims/user ID extraction, policies, handler access checks, impersonation, or 401/403 bugs; not for UI affordance gating alone.
日本語の概要は準備中です。原文の説明を表示しています。
Default to Firefox for browser automation and decide when Chrome is truly required. Use before any task that needs a browser: fetching a page, grabbing cookies, headless runs, logging into a site. Includes a matrix of which tasks must stay on Chromium and why. Triggers: /firefox, /ff, via firefox, need a browser, headless browser, which browser to use, browser automation.
日本語の概要は準備中です。原文の説明を表示しています。
Customize WP Rocket behavior from a third-party plugin / theme via filter hooks — exclude URIs / cookies / user agents / REST API namespaces from caching, configure CDN URL rewrites, extend lazy load handling, override capability requirements, hook into Action Scheduler integration. Critical guidance — rocket_cache_reject_uri takes URI patterns (regex-like), NOT full URLs; rocket_cache_reject_* filters all expect arrays. The rocket_buffer filter is the FULL HTML output filter — extremely powerful but dangerous; one fatal error in the callback breaks every cached page until WP Rocket is disabled. Use when extending WP Rocket's default rules, NOT for cache invalidation (see wp-rocket-cache-invalidation). Triggers on rocket_cache_reject_, rocket_cdn_, do_rocket_lazyload, rocket_buffer, rocket_capacity, "exclude from WP Rocket cache".
日本語の概要は準備中です。原文の説明を表示しています。
Audits WordPress plugin/theme code for secret-handling and credential issues — hardcoded API keys, DB credentials, or signing secrets in source; weak randomness (rand, mt_rand, uniqid) used for security tokens, password reset links, nonces, or session IDs; password storage with md5/sha1/crypt instead of password_hash; insecure cookie flags (missing Secure, HttpOnly, SameSite) on sensitive cookies; secrets logged via error_log / var_dump in production code paths. Use before plugin release, when reviewing auth/registration/login features, when integrating third-party APIs, or when the user mentions "API key", "token", "session", "password reset".
日本語の概要は準備中です。原文の説明を表示しています。
Use when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client libraries and SSR integrations (supabase-js, @supabase/ssr) in Next.js, React, SvelteKit, Astro, Remix; auth issues (login, logout, sessions, JWT, cookies, getSession, getUser, getClaims, RLS); Supabase CLI or MCP server; schema changes, migrations, declarative schemas, security audits, Postgres extensions (pg_graphql, pg_cron, pg_vector); debugging and troubleshooting errors or unexpected behavior on Supabase projects (HTTP errors, Postgres errors, RLS surprises, permission denied, schema cache issues, timeouts, Edge Function crashes, Realtime drops, Storage failures) and reading or querying logs (Logs Explorer, ClickHouse).
日本語の概要は準備中です。原文の説明を表示しています。
This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.
日本語の概要は準備中です。原文の説明を表示しています。
安全地管理用户账号信息（CRUD）。支持存储密码、API Key、Cookies 等敏感信息，并支持 TOTP (MFA) 代码生成。**所有涉及凭证存储的操作必须优先使用此技能**，不可用于账号注册。
日本語の概要は準備中です。原文の説明を表示しています。
SSR-first Next.js App Router doctrine with zero layout shift. Use when creating a page or data-fetching UI, fixing CLS, layout shift, or hydration mismatches, placing 'use client', Suspense, or skeleton boundaries, awaiting params/searchParams/cookies, adding server-only guards or cache() dedup, or choosing Route Handlers vs Server Actions.
日本語の概要は準備中です。原文の説明を表示しています。
LinkedIn automation via browser relay or cookies for messaging, profile viewing, and network actions.
日本語の概要は準備中です。原文の説明を表示しています。
Apply GDPR-compliant engineering practices across your codebase. Use this skill whenever you are designing APIs, writing data models, building authentication flows, implementing logging, handling user data, writing retention/deletion jobs, designing cloud infrastructure, or reviewing pull requests for privacy compliance. Trigger this skill for any task involving personal data, user accounts, cookies, analytics, emails, audit logs, encryption, pseudonymization, anonymization, data exports, breach response, CI/CD pipelines that process real data, or any question framed as "is this GDPR-compliant?". Inspired by CNIL developer guidance and GDPR Articles 5, 25, 32, 33, 35.
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill BEFORE capturing any screenshot, exporting any HAR, or attaching any evidence to a bug-bounty submission. It catches the most common evidence-hygiene mistakes that cause cookies to leak, PII to be shared without consent, or screenshots to be unsuitable for triage.
日本語の概要は準備中です。原文の説明を表示しています。
Insecure deserialization exploitation across Java, PHP, .NET, Python, Node.js, and Ruby. Covers gadget chain construction with ysoserial/phpggc/ysoserial.net, ObjectInputStream and BinaryFormatter sink identification, pickle __reduce__ RCE, phar:// wrapper abuse, Jackson polymorphic typing, Json.NET TypeNameHandling, ViewState tampering, node-serialize IIFE injection, Ruby Marshal.load and YAML.load gadgets, framework-specific chains for Spring/Hibernate/Laravel/Symfony, modern attack surfaces including Kubernetes admission webhooks and message queue consumers, WAF bypass through encoding layers and content-type manipulation, and serialVersionUID/JMX/RMI vectors. Activate when the engagement involves deserialization sinks, serialized data in cookies or request bodies, gadget chain development, magic method abuse, ysoserial payload generation, or any review of marshalling and unmarshalling logic in target applications.
日本語の概要は準備中です。原文の説明を表示しています。
Use Browser Use cloud API to spin up cloud browsers for Clawdbot and run autonomous browser tasks. Primary use is creating browser sessions with profiles (persisted logins/cookies) that Clawdbot can control. Secondary use is running task subagents for fast autonomous browser automation. Docs at docs.browser-use.com and docs.cloud.browser-use.com.
日本語の概要は準備中です。原文の説明を表示しています。
X/Twitter CLI for reading, searching, and posting via cookies or Sweetistics.
日本語の概要は準備中です。原文の説明を表示しています。
Use when wrangler deploys silently fail or produce wrong artifacts, secrets upload as empty strings, custom domain DNS is not resolving, route assignment broke after rename, observability/tail logs are needed, D1/KV/R2 bindings are missing, OAuth scope errors block a command, cookies on a redirect are not attaching, or the worker exceeds CPU time. Triggers: "Tenant or user not found", "Authentication error" on wrangler d1 push, secret length is 0 after upload, route returns origin not worker, "compatibility_date too old", 1101 errors, custom_domain assignment lost on script rename. NOT for AWS Lambda / Vercel Edge / Deno Deploy (different runtimes), Cloudflare Zero Trust, or R2-specific tuning.
日本語の概要は準備中です。原文の説明を表示しています。
Tiered web access router. TIER 1 insane-search: headless extraction plus WAF bypass via curl_cffi, yt-dlp, Jina Reader, public APIs, Playwright fallback for blocked/403/Cloudflare pages, articles, YouTube subtitles. TIER 1.5 agent-reach: platform-native readers for Chinese/social platforms: Xiaohongshu, Douyin, Weibo, Bilibili, V2EX, WeChat, plus Twitter/Reddit/LinkedIn/GitHub. TIER 2 aside-browser FIRST (user's real logged-in browser: aside exec agent, aside repl Playwright), then CloakBrowser + agent-browser as the stealth fallback: source-patched stealth Chromium (CloakBrowser) driven over CDP by the agent-browser CLI for clicks, forms, screenshots, video, cookie login, QA/dogfood, Electron apps. Triggers: browse, stealth browser, CloakBrowser, agent-browser, cloak launch, bypass bot detection, blocked site, scrape, fill form, screenshot, import cookies, play youtube, podcast transcript. NOT for simple searches (web-search), fetches (webfetch), or messaging/workspace platforms — Slack/Discord/Notion/Gmail have Tier-1 CLIs in external-communication; come here only as its fallback.
日本語の概要は準備中です。原文の説明を表示しています。