1,552 件 ・ 関連度順
概要と使いどころ
Email header injection and spoofing playbook. Use when testing contact forms, email APIs, password reset flows, or any feature that constructs SMTP messages with user-controlled fields. Covers CRLF injection in headers, SPF/DKIM/DMARC bypass, and phishing amplification.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit Insecure Direct Object Reference (IDOR) or Broken Object Level Authorization (BOLA) vulnerabilities specifically within GraphQL APIs. This skill focuses on manipulating node IDs, changing variables, and utilizing aliases to access unauthorized data.
日本語の概要は準備中です。原文の説明を表示しています。
Application-level business logic security testing for any domain. Takes an understanding-first approach: map the intended workflows before probing them. Covers: value/quantity logic abuse (negative, zero, overflow, rounding on any numeric field), workflow and state machine bypass (skipping required steps, forcing illegal state transitions, reusing one-time tokens), trust boundary violations (BOLA horizontal/vertical, BFLA, cross-tenant access, negative ownership attacks), idempotency and replay attacks (duplicate submissions, double-spend, same-reference reuse), multi-step flow integrity (checkout, registration, approval, verification), quota and rate limit bypass, time/date manipulation, and authorization code / reference number predictability. Domain-agnostic — applies to SaaS, e-commerce, banking, gaming, social platforms, APIs, or any multi-user application with stateful workflows. Chains from /pentester; chains into /param-fuzz when boundary violations or mass assignment are confirmed.
日本語の概要は準備中です。原文の説明を表示しています。
CORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, preflight policy bugs, and browser-based access to authenticated APIs.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit Cross-Origin Resource Sharing (CORS) misconfigurations. Use this skill when auditing APIs or web applications that share sensitive data across domains, forcing victims' browsers to inadvertently leak private information (e.g., API keys, PII, CSRF tokens) to an attacker-controlled website.
日本語の概要は準備中です。原文の説明を表示しています。
OS command injection occurs when user input is passed unsanitized to a system shell via dangerous APIs: Java `Runtime.exec()`, Python `os.system/subprocess`, PHP `system/shell_exec/exec/proc_open`, C `system/exec`. Detect via pipe `|`, semicolon `;`, `&&`, `||`, backtick, `$()` operators, and time-delay payloads (`sleep 5`). Tools: Commix, Burp Suite, OWASP WebGoat.
日本語の概要は準備中です。原文の説明を表示しています。
Use when hunting Broken Object Level Authorization (BOLA) or Insecure Direct Object Reference (IDOR) vulnerabilities in APIs or web applications. Trigger on: "BOLA", "IDOR", "broken object level", "access other users", "object reference", numeric or UUID IDs in URLs or request bodies, user-scoped resources, horizontal privilege escalation, "change the ID in the request", second-order IDOR, blind IDOR, indirect reference, encoded ID, deprecated API version, JSON globbing.
日本語の概要は準備中です。原文の説明を表示しています。
API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.
日本語の概要は準備中です。原文の説明を表示しています。
Use when developing plugins, tools, and extensions for OpenCode v1 - plugin contract, crash-prevention rules, ctx/event APIs, subagent lifecycle (abort races, compaction, orphan detection), MCP integration, testing patterns, or publishing to npm
日本語の概要は準備中です。原文の説明を表示しています。
Use when developing Firefox WebExtensions - Manifest V2/V3 configuration, WebExtension APIs, content security policy, web-ext CLI, cross-browser support with the polyfill, AMO submission, or debugging extensions
日本語の概要は準備中です。原文の説明を表示しています。
Use when building Django REST APIs with django-ninja - Pydantic schemas, routers, CRUD endpoints, authentication, pagination, file uploads, async views, OpenAPI docs, or migrating from DRF
日本語の概要は準備中です。原文の説明を表示しています。
Use when implementing PyQt/PySide6 dialogs - standard dialogs (QFileDialog, QMessageBox, QInputDialog, QColorDialog, QFontDialog), custom QDialog patterns, modal vs modeless dialogs, input validation, Qt 6 dialog APIs
日本語の概要は準備中です。原文の説明を表示しています。
Use when building high-performance APIs with django-bolt - routing, JWT auth, msgspec serializers, WebSockets, SSE streaming, file uploads, ORM patterns, runbolt deployment, or migrating from DRF
日本語の概要は準備中です。原文の説明を表示しています。
Use when building Django REST APIs with TurboDRF - model Meta configuration, role-based and field-level permissions, multi-tenant predicates, router wiring, management commands, settings, or troubleshooting
日本語の概要は準備中です。原文の説明を表示しています。
End-to-end AI website generation pipeline. Claude Opus 4.8 emits Bolt-style <boltArtifact> envelopes (multi-file, plan-first) that customize Vite+React+Tailwind templates from pre-researched business data. Pre-research via APIs, media acquisition, brand extraction, visual inspection via GPT Image 2 vision, R2 upload (per-file content-type by extension), D1 status updates. Supports all business types: SaaS, portfolio, non-profit, restaurant, salon, medical, legal, retail, tech.
日本語の概要は準備中です。原文の説明を表示しています。
Frappe backend guidance for Python and backend-adjacent JavaScript surfaces such as client interaction patterns, hooks, APIs, patches, scheduler logic, reports, and server-side review. Use when implementing or reviewing Frappe backend behavior.
日本語の概要は準備中です。原文の説明を表示しています。
Client-side routing with data APIs — loaders, actions, error boundaries, search params, nested layouts, and code splitting
日本語の概要は準備中です。原文の説明を表示しています。
Composable component APIs — parts, state, polymorphism
日本語の概要は準備中です。原文の説明を表示しています。
React Navigation 7+ patterns - static and dynamic APIs, type-safe navigation, stack/tab/drawer navigators, deep linking, authentication flows, screen preloading, header customization
日本語の概要は準備中です。原文の説明を表示しています。
Tauri 2.x official plugin ecosystem, plugin APIs, permissions, and custom plugin development
日本語の概要は準備中です。原文の説明を表示しています。
Electron process architecture, IPC patterns, preload security, native APIs, packaging and distribution
日本語の概要は準備中です。原文の説明を表示しています。
Payload CMS v3 — TypeScript-native headless CMS with code-first collections, hooks, access control, Local/REST/GraphQL APIs, admin panel, and database adapter pattern
日本語の概要は準備中です。原文の説明を表示しています。
Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).
日本語の概要は準備中です。原文の説明を表示しています。
This skill provides guidance for using DeepWiki MCP to explore GitHub repository documentation. Use when researching repository structure, understanding library APIs, asking questions about open-source projects, or exploring documentation for any GitHub repository.
日本語の概要は準備中です。原文の説明を表示しています。