111 件 ・ 関連度順
概要と使いどころ
This ASE skill uses zizmor to audit GitHub Actions workflows and composite actions for security mistakes before they ship. An agent can scan local repos or remote GitHub repositories, flag risky permission scopes and unsafe workflow patterns, and return plain output, GitHub-native findings, or SARIF for follow-up automation.
日本語の概要は準備中です。原文の説明を表示しています。
Insert a trace-aware guardrail layer between agents and their tools so unsafe message patterns or tool-call sequences are blocked by explicit rules.
日本語の概要は準備中です。原文の説明を表示しています。
Use ESLint in .NET repositories that ship JavaScript, TypeScript, React, or other Node-based frontend assets. Use when a repo needs a configurable CLI lint gate for frontend correctness, import hygiene, unsafe patterns, or framework-specific rules.
日本語の概要は準備中です。原文の説明を表示しています。
Perform security-focused review of code diffs and pull requests, identifying newly introduced vulnerabilities, security regressions, and unsafe patterns in changed code.
日本語の概要は準備中です。原文の説明を表示しています。
Triage maintenance problems by severity, document findings with context, route to appropriate specialist agent or human, and create actionable issue reports. Use when a maintenance task encounters problems beyond automated cleanup: code that is unsafe to delete, configuration changes requiring domain expertise, breaking changes detected during cleanup, complex refactoring needed, or security-sensitive findings such as hardcoded secrets or vulnerabilities.
日本語の概要は準備中です。原文の説明を表示しています。
Use when Rust code, especially unsafe or panic-critical paths, needs a Kani, Verus, or Creusot harness written, run, and its failure read. Not for choosing the proof policy: use proof-driven.
日本語の概要は準備中です。原文の説明を表示しています。
TypeScript discipline for any JavaScript/TypeScript project (frontend + backend): strict mode, type design, generics, narrowing, error types, module resolution, tsconfig hygiene. Apply when the project has `tsconfig.json` and `typescript` in devDependencies. Stack-agnostic — referenced by every JS/TS framework plugin in the marketplace. Use this skill to: - Write types that catch bugs at compile time, not runtime. - Use generics, conditional types, and discriminated unions correctly. - Avoid `any`, `unknown`, and unsafe casts. - Match the project's tsconfig strictness level. - Type third-party libraries (with @types/* or declaration files). Do NOT use this skill for: - Plain JavaScript projects (no tsconfig.json). - Framework-specific type idioms (React component props, Vue defineProps, Angular signals — those live in framework plugins' own conventions skills). - tRPC/Zod runtime-validation specifics — handled by validation libs at the boundary.
日本語の概要は準備中です。原文の説明を表示しています。
Audit and remediate NowStack Mobile security flaws. Use for auth/session abuse, Apple or Stripe payment bypass, Convex authorization, cross-user data leaks, unsafe deep links, R2 uploads, client secrets, SSRF, XSS, or pentest follow-up.
日本語の概要は準備中です。原文の説明を表示しています。
Scan codebase for security vulnerabilities including secrets, insecure dependencies, and unsafe code patterns. Use when performing automated security scans.
日本語の概要は準備中です。原文の説明を表示しています。
Detects code quality vulnerabilities in mobile apps (Android/iOS). Trigger on: SQL injection in SQLite, JavaScript injection in WebViews, intent injection, unsafe deserialization, NSKeyedUnarchiver, NSCoding, Java serialization, Parcelable, buffer overflow, JNI native code, PIE disabled, NX disabled, stack canary absent, RELRO, ARC disabled, third-party library CVE, vulnerable dependency, outdated SDK, targetSdkVersion, update enforcement missing, implicit Intent, URL loading in WebView, object persistence, memory corruption, OWASP dependency check. Covers MASVS-CODE-1/2/3/4.
日本語の概要は準備中です。原文の説明を表示しています。
Use when hunting Client-Side Path Traversal (CSPT) vulnerabilities where attacker- controlled input is unsafely concatenated into the path component of a JavaScript fetch() or XHR request. Trigger on: "CSPT", "client-side path traversal", "fetch path traversal", "XHR path injection", "fetch concatenation", "../ in fetch", "user input in fetch URL", "path component injection", fetch redirect chaining, CSPT to XSS, open redirect fetch, "JavaScript fetch user input", DOM fetch injection.
日本語の概要は準備中です。原文の説明を表示しています。
Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every technique includes actual payloads, commands, and verification logic. Chains from /pentester or /codebase when API endpoints are discovered, chains into /web-exploit when classic injection points are found in API parameters, chains into /post-exploit when RCE is achieved, and chains into /ai-redteam when an LLM/AI endpoint is discovered (chat APIs, completion endpoints, RAG search, agentic tool-use, MCP servers).
日本語の概要は準備中です。原文の説明を表示しています。
Use when reviewing frontend security risks such as XSS, CSRF, sensitive data exposure, unsafe DOM APIs, untrusted user input, authentication/token handling, payment flows, file upload, CSP, dependency risk, or third-party scripts; Chinese triggers include security review, security check.
日本語の概要は準備中です。原文の説明を表示しています。
AI and LLM red-teaming skill for evaluating prompt injection, jailbreak, data exfiltration, tool abuse, agent hijack, RAG poisoning, model denial of service, and unsafe tool-use chains in Gemini, Claude, GPT, and open-weight models. Use to build evaluation harnesses, attack corpora, defensive guardrails, and red-team reports for AI systems you own or are authorized to test.
日本語の概要は準備中です。原文の説明を表示しています。
Inspect Caveman Cloud's eval-gated experiment lifecycle and block unsafe execution. Use when the user asks to start, approve, cancel, promote, or roll back a Caveman experiment, or asks what action an experiment's evidence supports. Read evidence first; do not execute lifecycle mutations until server-authoritative transition and evidence gates ship.
日本語の概要は準備中です。原文の説明を表示しています。
Detects unsafe safe-area overrides and hardcoded inset values that hide content behind the Dynamic Island, notch, or home indicator, violating Apple's Human Interface Guidelines for adaptive layout.
日本語の概要は準備中です。原文の説明を表示しています。
Audit code against NASA JPL's Power of Ten rules, extended for AI-assisted development. Use when checking code for dangerous complexity, unsafe control flow, resource leaks, hidden side effects, missing validation, weak CI gates, AI-generated artifacts, or missing failure-mode tests.
日本語の概要は準備中です。原文の説明を表示しています。
MUST USE for ANY work on .py .pyi .rs .ts .tsx .mts .cts .go files. One philosophy: strict types, modern stacks (Pydantic v2 / serde+thiserror / Zod / gin+sqlc+pgx+slog), modern toolchains (uv+basedpyright+ruff / cargo+clippy+miri / Bun+Biome+tsc / gofumpt+golangci-lint v2+nilaway+go-race), parse-don't-validate, exhaustive match, typed errors, no any/unwrap/panic, 250 LOC ceiling, TDD. Routes to references/{python,rust,typescript,rust-ub,go}/. Triggers: write/edit Python/Rust/TypeScript/Go code, new project, gin server, bubbletea TUI, CJK IME, connect-go RPC, sqlc pgx, branded ids, exhaustive match, unsafe Rust, miri, oversized file, refactor, TDD, e2e test, arena, allocator, bumpalo, const fn, const generics, comptime, zero-alloc, bitfield, repr, scopeguard, errdefer, Zig-like, zerocopy, packed struct.
日本語の概要は準備中です。原文の説明を表示しています。
Create or review dygo Fixtures and explicit Patches for reference data, setup Records, backfills, renames, and unsafe lifecycle transitions. Use when metadata sync alone cannot express the required data change.
日本語の概要は準備中です。原文の説明を表示しています。
Use when auditing Drupal 11 custom modules/themes for security issues such as unsafe input handling, XSS risks, SQL injection, and access control gaps.
日本語の概要は準備中です。原文の説明を表示しています。
Find Amazon Ads search terms ready for exact-match harvesting from auto, broad, phrase, or other discovery campaigns. Use when Codex needs standalone or Rocketcart MCP-aware search-term harvesting: classify terms by harvest readiness, resolve live IDs, choose safe destination campaigns/ad groups, preflight duplicates/current negatives/destination feasibility, decide whether source negatives are justified, execute only explicitly approved rows, and read back/monitor Sponsored Products or Sponsored Brands actions without unsafe negatives, duplicate routing, stale approvals, brand-defense cuts, own-ASIN-defense cuts, launch/rank mistakes, or low-sample overfitting.
日本語の概要は準備中です。原文の説明を表示しています。
Use when reviewing a migration diff or schema change for scale hazards — indexes, unsafe migrations, unbounded growth, N+1. Triggers on 'review this migration', 'will this scale'.
日本語の概要は準備中です。原文の説明を表示しています。
Use when a diff may introduce security risk — authZ, injection, secrets, unsafe deserialization, SSRF, XSS, mass assignment — dispatched by /review-changes, /do-and-judge, /judge.
日本語の概要は準備中です。原文の説明を表示しています。
Use when reviewing, fixing, or verifying a pull request. Focus on correctness regressions, missing tests, permission mistakes, unsafe behavior, and minimal fixes.
日本語の概要は準備中です。原文の説明を表示しています。