1,495 件 ・ 関連度順
概要と使いどころ
Facilitate talent review and people decisions with a structured view of performance, potential, readiness, risks, and development actions using talent calibration and 9-box logic. Use when preparing talent review, succession planning, promotion readiness, or performance calibration sessions. Do not use for payroll administration, HRIS updates, or generic praise notes.
日本語の概要は準備中です。原文の説明を表示しています。
Analyze budget-versus-actual or forecast-versus-actual performance and turn finance data into a management-ready narrative using variance logic, drivers, cash impact, and forward actions. Use when finance, FP&A, or business leaders need commentary, management accounts, or performance explanation. Do not use for bookkeeping entries, tax filing preparation, or legal accounting sign-off.
日本語の概要は準備中です。原文の説明を表示しています。
Write custom Semgrep rules to identify organization-specific logic flaws, improper cryptography usage, or missing authorization checks during source code review. This skill focuses on moving beyond default rulesets to locate complex vulnerabilities.
日本語の概要は準備中です。原文の説明を表示しています。
SQL injection occurs when untrusted user input is interpolated directly into database queries, allowing attackers to alter query logic. Detect via single-quote errors, boolean-based blind responses (AND 1=1 vs AND 1=2), time-delay payloads (SLEEP, WAITFOR), UNION column enumeration, and error messages from MySQL, Oracle, MSSQL, PostgreSQL. Tools: sqlmap, sqlbftools, Burp Suite, wfuzz with SQLi fuzz strings.
日本語の概要は準備中です。原文の説明を表示しています。
SQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execution paths.
日本語の概要は準備中です。原文の説明を表示しています。
Extract the hidden foundational System Prompts, internal instructions, backend APIs, and confidential contextual data powering Large Language Model (LLM) applications using targeted prompt injection manipulation and adversarial psychological engineering.
日本語の概要は準備中です。原文の説明を表示しています。
Deep OAuth 2.0 / OpenID Connect security assessment. Covers the full attack surface: redirect_uri validation bypass (path traversal, open redirect chains, subdomain confusion, URL parsing tricks, parameter pollution, response mode switching), missing/broken state parameter CSRF, PKCE downgrade and absent-challenge attacks, implicit grant token leakage (Referer, browser history, XSS fragment theft), authorization code injection, scope escalation, client confusion attacks, mutable-claims account takeover (iss+sub confusion, email-keyed identity merging), pre-account takeover via unverified registration, OpenID Connect dynamic client registration SSRF (logo_uri, jwks_uri, sector_identifier_uri, request_uri), nonce replay, ID token validation failures, Device Code phishing flow, mobile custom URI scheme hijacking, refresh token persistence, token introspection enumeration, consent screen clickjacking, host header injection, and cross-IdP mix-up attacks. Uses KOAuth, jwt_tool, nuclei oauth templates, and manual http(action="request", ...) payloads. Every technique includes actual request payloads and verification logic. Chains from /pentester or /api-security when OAuth endpoints are discovered. Chains into /web-exploit for open redirect, XSS, and SSRF chaining. Chains into /post-exploit when full account takeover is achieved. Chains into /credential-audit when access tokens or refresh tokens are recovered.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit Mass Assignment vulnerabilities in APIs and web frameworks to inject unauthorized parameters. This skill details how attackers uncover hidden fields and manipulate JSON or HTTP bodies to elevate privileges or tamper with data logic.
日本語の概要は準備中です。原文の説明を表示しています。
NoSQL injection playbook. Use when MongoDB-style operators, JSON query objects, flexible search filters, or backend query DSLs may allow data or logic abuse.
日本語の概要は準備中です。原文の説明を表示しています。
Systematic fuzzing across two dimensions: (1) content discovery — hidden directories, files, backup/source leaks, HTTP verb enumeration, 401/403 bypass via path manipulation; (2) input validation — auth/token stripping, type confusion, boundary value analysis, HTTP parameter pollution, header fuzzing, cookie fuzzing, mass assignment discovery, and entropy/predictability analysis of any generated value. Works on any domain. Chains from /web-exploit or /pentester; chains into /business-logic when boundary violations, predictable IDs, or mass assignment are confirmed.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit Java Insecure Deserialization vulnerabilities leading to Remote Code Execution (RCE). Identify serialized Java objects natively passed within HTTP parameters, cookies, or sockets (e.g., `rO0AB...`). Utilize `ysoserial` to meticulously craft malignant payload chains exploiting vulnerable gadget libraries like CommonsCollections inherently present in the application's classpath.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit Algorithm Confusion vulnerabilities in JSON Web Tokens (JWT). This skill details how to bypass signature verification by changing the signing algorithm from asymmetric (RS256) to symmetric (HS256) and using the public key as the symmetric secret.
日本語の概要は準備中です。原文の説明を表示しています。
HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks. Use when filters and application layers disagree on which value wins, enabling bypass, SSRF second URL, logic abuse, or CSRF token confusion.
日本語の概要は準備中です。原文の説明を表示しています。
Authentication bypass testing playbook. Use when assessing login flows, password reset logic, account recovery, MFA bypass, token predictability, brute-force resistance, and session boundary flaws.
日本語の概要は準備中です。原文の説明を表示しています。
Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every technique includes actual payloads, commands, and verification logic. Chains from /pentester or /codebase when API endpoints are discovered, chains into /web-exploit when classic injection points are found in API parameters, chains into /post-exploit when RCE is achieved, and chains into /ai-redteam when an LLM/AI endpoint is discovered (chat APIs, completion endpoints, RAG search, agentic tool-use, MCP servers).
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit flaws in API rate limiting enforcement. Use this skill when encountering HTTP 429 Too Many Requests errors during password brute-forcing, OTP validation, credential stuffing, or enumeration attacks. These bypasses leverage IP spoofing, parameter manipulation, and edge-case application logic.
日本語の概要は準備中です。原文の説明を表示しています。
Use this agent when you need to review UniProt annotation rules (ARBA, UniRule) for quality, biological accuracy, and GO annotation appropriateness. This agent performs comprehensive analysis of rule condition sets, evaluates literature support, assesses taxonomic scope, and recommends curation actions.
日本語の概要は準備中です。原文の説明を表示しています。
Review computational protein or gene function predictions and fill PredictionReview YAML files using the COR/CNN/LSP/UNC/PLI/NPI/REP biological-validity taxonomy. Use for ProtNLM, DeepECTF, BioReason/GO-GPT, InterPro2GO, PANTHER/IBA, CLEAN, GloEC, MAPred, ProteinInfer, or other predicted EC/GO annotations, including audits of the evidence and reasoning in existing prediction reviews.
日本語の概要は準備中です。原文の説明を表示しています。
Use this agent when you need to create a pathway summary for a gene after completing the main gene review. This agent should be invoked specifically to generate GENE-pathway.md files that summarize the gene's role in biological pathways with proper citations and mermaid diagrams.
日本語の概要は準備中です。原文の説明を表示しています。
Use when writing or reviewing functions, classes, naming, or non-trivial logic (≥3 lines)
日本語の概要は準備中です。原文の説明を表示しています。
Frappe backend guidance for Python and backend-adjacent JavaScript surfaces such as client interaction patterns, hooks, APIs, patches, scheduler logic, reports, and server-side review. Use when implementing or reviewing Frappe backend behavior.
日本語の概要は準備中です。原文の説明を表示しています。
Webhook patterns — receiving, sending, signature verification, and retry logic
日本語の概要は準備中です。原文の説明を表示しています。
Prepare logical commits, publish through Pharos’s protected-main pull-request gate, monitor deployment, and hand off operational acceptance. Use only when commit, push, publish, release, or deployment watching is requested.
日本語の概要は準備中です。原文の説明を表示しています。
Audit a spreadsheet for formula accuracy, errors, and common financial-model mistakes. Use for selected ranges, single sheets, or whole-workbook model checks including balance-sheet balance, cash tie-out, roll-forwards, and logic sanity.
日本語の概要は準備中です。原文の説明を表示しています。