「red」の検索結果

Operate Cobalt Strike for red team engagements including Beacon deployment, C2 communication, post-exploitation, lateral movement, and evasion. Use this skill when conducting authorized red team operations that require a commercial C2 framework. Covers malleable C2 profiles, staged/stageless payloads, sleep and jitter configuration, SOCKS proxying, and advanced BOF (Beacon Object Files) usage for opsec-safe operations.

日本語の概要は準備中です。原文の説明を表示しています。

Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every technique includes actual payloads, commands, and verification logic. Chains from /pentester or /codebase when API endpoints are discovered, chains into /web-exploit when classic injection points are found in API parameters, chains into /post-exploit when RCE is achieved, and chains into /ai-redteam when an LLM/AI endpoint is discovered (chat APIs, completion endpoints, RAG search, agentic tool-use, MCP servers).

日本語の概要は準備中です。原文の説明を表示しています。

AI/LLM red-team assessment using the OWASP LLM Top 10 (2025) + OWASP AI Testing Guide (AITG v1, Nov 2025) frameworks, plus OWASP MCP Top 10 runtime testing for agentic/MCP targets. Tests prompt injection, jailbreaks, system prompt leakage, sensitive data extraction, excessive agency, improper output handling, model extraction, content bias, evasion, membership inference, MCP token exposure, MCP command injection, and more. Uses four tools in combination: FuzzyAI (single-turn jailbreak fuzzing), PyRIT (multi-turn orchestrated attacks), Garak (probe-based vulnerability scanning), and promptfoo (plugin-based red-team evaluation). Each tool covers different OWASP categories; running them together gives systematic coverage. Includes a conditional MCP reconnaissance phase and a post-access AI infrastructure phase (chained from /post-exploit). Produces: OWASP LLM Top 10 + AITG + MCP coverage matrix, findings per category, architecture diagram of the AI system, PoCs for confirmed exploits. Chains into /gh-export for issue filing.

日本語の概要は準備中です。原文の説明を表示しています。

Master Alfred on macOS: search, workflows, clipboard history, snippets, and the Powerpack. Use when building a keyboard-driven command layer on the Mac with Alfred.

日本語の概要は準備中です。原文の説明を表示しています。

Product marketing and go-to-market strategy for B2B SaaS launches and positioning. Use this skill when planning a product launch, developing positioning and messaging, analyzing competitive landscape, building customer advocacy programs, designing a customer referral program (who may accept the reward, how the introduction is made), designing a win/loss interview program, working out why we lose deals, designing GTM strategy, creating category positioning, planning analyst briefings, or deciding which country to expand into and how far to localize. Also use it for an early-stage startup where the founder is still doing the selling — running founder-led sales, setting up a design-partner program, judging whether you have product-market fit, deciding what not to do yet, deciding when to hire the first AE or first marketer, and moving upmarket to larger buyers. Also use it when your company has just acquired another (or is about to), to plan the marketing integration: what you may and may not do between signing and close, the first letter to the acquired customers, whether to keep, endorse, fold in or retire the acquired brand, merging the two marketing databases without mailing people who opted out, when to start cross-selling, and announcing a product sunset. Also use it to design a demand-generation campaign and the channel plan it runs on: one campaign with one job, the offer for buyers who are and are not in market, what each channel is for, the kill and scale rules set before launch, the follow-up sales agrees to, the yearly calendar of always-on programs and tentpole campaigns, and which channels to keep, test or stop. Also use it for brand marketing and demand creation — how much to spend on brand versus performance, what to measure when a brand campaign produces no conversion event, and how to answer "we cannot attribute it". Also triggers on: founder-led sales, founder-led GTM, design partners, design partner agreement, first customers, first 10 customers, do we have product-market fit, PMF, Sean Ellis test, very disappointed survey, pre-seed, seed stage, when to hire our first AE, first sales hire, first marketing hire, moving upmarket, going upmarket, enterprise readiness, first enterprise deal, what do enterprise buyers need before they sign, positioning, product launch, beta program, early access program, design partners, private preview, public preview, general availability, GA launch, when can we call it GA, can sales sell a beta feature, selling the roadmap, launch tier, competitive intelligence, messaging, customer advocacy, win/loss analysis, win/loss interviews, why we lose deals, closed-lost analysis, loss reason, close-reason field, competitive displacement, displace an incumbent, rip and replace, competitive takeout, switch from a competitor, win deals from a competitor, incumbent contract, renewal window, auto-renewal notice period, switching costs, EU Data Act, cloud switching rights, why do we lose to no decision, GTM, category design, ideal customer profile, ICP, what is our real ICP, who actually buys from us, refresh our ICP from closed-won deals, ICP refresh before planning, analyst briefing, G2 review, international expansion, market entry, expand into Europe, which country should we launch in next, localization, translate our site, in-country go-to-market, regional GTM, is cold email legal in Germany, brand marketing, brand awareness, brand vs performance, brand versus demand gen, demand creation, demand capture, 95-5 rule, out of market buyers, category entry points, distinctive brand assets, mental availability, brand tracking, brand health, brand lift, share of search, how do we measure brand, justify brand spend, brand budget. Also triggers on public-sector marketing: sell to government, government marketing, public sector go-to-market, federal marketing, state and local government, SLED, FedRAMP, FedRAMP marketing claims, can we say FedRAMP ready, GovRAMP, StateRAMP, VPAT, accessibility confor

日本語の概要は準備中です。原文の説明を表示しています。

Validates detection coverage by mapping Atomic Red Team tests to ATT&CK techniques, checking which of your detections cover each tested technique, and reporting coverage gaps. Activates for requests to validate detections with atomic tests, map Atomic Red Team to coverage, or find detection gaps against tested techniques.

日本語の概要は準備中です。原文の説明を表示しています。

Generate and maintain browser demos of Pulp audio plugins (both web ABIs — WAM and WCLAP) from one declarative config, so every demo mounts the SAME shared player and the two ABIs stay in lockstep. Invoke it whenever you publish/update a browser demo of a Pulp plugin, add a plugin to a demo gallery, stand up a new gallery, or touch demo pages/hosting. It runs a deterministic generator (config → stamped WAM+WCLAP site + owned-files manifest) and a blocking validator (config schema, cross-origin-isolation coverage, OG metadata, regeneration ownership). Customization is declarative config in <repo>/.pulp-web-demo/config.json (schema bundled) plus at most two typed module seams; the shared player (pinned @danielraffel/web-player) holds all UX behavior and is never vendored. Works in Claude and Codex.

日本語の概要は準備中です。原文の説明を表示しています。

Playwright-first strategy for shared DB + shared test accounts. Use when E2E tests collide in QA/staging, need safe parallelism, or require deterministic cleanup without touching baseline data. Covers per-test ownership, namespacing, ID-based teardown, serial shared-state suites, and optional stale-data janitor jobs.

日本語の概要は準備中です。原文の説明を表示しています。

Diagnose whether an LLM classifier's validation-gate failure is GOLD-BOUND before spending on prompt revision or model changes. Use when: (1) a scoring pipeline over-predicts a label (precision low, recall high) and a prompt clarification is proposed to tighten it, (2) a pilot/validation gate fails and the fix candidates are prompt edits, (3) inter-rater agreement on the weak label was already low (κ < ~0.6). Core check: if gold POSITIVES share the exact feature the revision would exclude, no prompt can pass a gold-scored gate — recall craters while precision barely moves. Also documents the verified surgical-pilot design (single-section diff, tune/holdout split, pre-registered gate, perturbation check on untouched sections).

日本語の概要は準備中です。原文の説明を表示しています。

Upgrade the vendored NeMo-Skills slice to a newer upstream commit. Use when the user asks to "bump vendored", "sync NeMo-Skills", "update vendored sha", "upgrade NS", or wants to pull a specific upstream fix. Inside the sgl-eval repo.

日本語の概要は準備中です。原文の説明を表示しています。

Use when a task needs the judgment of a Brownfield Redevelopment Specialist and Site Manager — confirming landowner liability protections (BFPP/AAI) before a contaminated-site acquisition closes, matching a cleanup standard to the actual reuse plan instead of defaulting to the most conservative one, sequencing a brownfield funding stack (EPA grants, state VCP, tax credits) by eligibility dependency, or deciding whether an institutional control/deed restriction needs disclosure to a lender or buyer.

日本語の概要は準備中です。原文の説明を表示しています。

Use when a task needs the judgment of an Aerospace Engineering and Operations Technologist/Technician — verifying an installed fastener's preload against a drawing's torque callout via the T=K·D·F relationship, reducing strain-gauge data from a structural proof-load test into stress and checking it against an FEA-predicted margin, selecting and executing an NDI method against a defect type and material, reducing a wind-tunnel test point's dynamic-pressure and Reynolds-number data, or ballooning and dispositioning an AS9102 first article inspection. Distinct from an aerospace-engineer (owns the design, structural analysis, and certification basis) — this role builds, instruments, tests, and inspects the hardware the engineer specified, closing the loop with measurement rather than deriving a new analysis.

日本語の概要は準備中です。原文の説明を表示しています。

Use when a task needs the judgment of an Administrative Law Judge, Adjudicator, or Hearing Officer — applying a mandatory sequential/structured evaluation framework in required order, weighing conflicting medical or vocational opinion evidence using specific regulatory factors, writing findings that explicitly address significant contrary evidence in the record, drafting a credibility/consistency finding tied to specific record citations, or checking whether a draft decision would survive substantial-evidence review.

日本語の概要は準備中です。原文の説明を表示しています。

Detect, validate, and generate Schema.org structured data with Ahrefs traffic prioritization. JSON-LD format preferred. Use when user says "schema", "structured data", "rich results", "JSON-LD", "markup", or "schema priority".

日本語の概要は準備中です。原文の説明を表示しています。

Run a task iteratively over a user-specified duration by dispatching subagents. The orchestrator stays strictly linear and time-checked, but each iteration fans out MULTIPLE subagents in parallel over independent units (and those subagents may fan out further). Shared state — a compact progress digest and a growing environment cheatsheet — lives on disk and is passed to every subagent BY REFERENCE, killing the per-subagent rediscovery tax. Every subagent first reads an initialiser preamble that points it at that shared state and makes it write findings back, so the cheatsheet populates itself; role prompts are produced ONCE on the filesystem by a single scaffold command and dispatched by path, never re-typed per dispatch. Subagents persist their results to disk and return only a tiny status, so the orchestrator's context stays small and lasts. The orchestrator classifies the goal as FINITE or OPEN-ENDED: finite lists may finish early; open-ended goals use the full duration, never idle, never manufacture busywork. Use when the user gives a task and a duration and wants it ground out iteratively by subagents over that time.

日本語の概要は準備中です。原文の説明を表示しています。

Analyze preventive and predictive maintenance scheduling systems including CMMS/EAM work order optimization, asset condition scoring with Facility Condition Index, PM compliance tracking, maintenance backlog reduction, reliability-centered maintenance strategy.

日本語の概要は準備中です。原文の説明を表示しています。

Credentialed Google API calls for a blog: PageSpeed Insights, CrUX history, Search Console performance and URL Inspection, GA4 organic traffic, Cloud NLP entities, YouTube video search, Google Ads Keyword Planner, and the Indexing API (job and livestream pages only). Uses the user's Google credentials, quotas, and sometimes billing, and asks for consent before the first call. Runs only on an explicit request: /blog google, "run PageSpeed on this blog URL", "pull my Search Console data", "inspect this URL's index status", "set up Google API credentials". Shares config with claude-seo at ~/.config/claude-seo/google-api.json.

日本語の概要は準備中です。原文の説明を表示しています。

Redact PII in your own code before it reaches Agentforce prompts, models, and logs. Trigger keywords: agentforce pii, pii redaction, data masking llm, prompt pii filter, audit pii leakage. NOT for turning on the platform's own masking, zero-retention and audit-trail controls — use agentforce/einstein-trust-layer. NOT for masking PII in a refreshed sandbox — use security/sandbox-data-masking.

日本語の概要は準備中です。原文の説明を表示しています。

Use when designing or reasoning about an Agentforce Grid worksheet — the spreadsheet-like Agentforce workspace where rows are jobs and columns are sequential Data / AI / Action steps that process left to right — to run bulk record updates, generate insights, or test multi-turn AI conversations over CRM or Data Cloud (Data 360) data without Apex or Flow. Trigger keywords: Agentforce Grid, workbook, worksheet, grid column, data column, AI column, action column, bulk AI update, Flex Credits per row, metered compute. NOT for building the agent, its topics, or its actions themselves (use agentforce/* action and topic skills), NOT for single-record prompt design (use the prompt-builder skills), NOT for deployable metadata/Apex (Grid is a no-code Studio tool, not a metadata type), and NOT for AI governance/ethics policy (use admin/ai-ethics-and-governance-requirements).

日本語の概要は準備中です。原文の説明を表示しています。

Configure pricebooks, tiered pricing, promotions, coupon codes, and cart discounts for B2B or D2C Commerce stores. Trigger keywords: WebStorePricebook, BuyerGroupPricebook, PriceAdjustmentSchedule, PromotionsCartCalculator, commerce coupon, cart-level discount, tiered price, Commerce promotion. NOT for Sales Cloud pricebooks and PricebookEntry - use admin/products-and-pricebooks. NOT for CPQ quote pricing and discount schedules - use admin/cpq-pricing-rules.

日本語の概要は準備中です。原文の説明を表示しています。

White-box security audit. Blue-teamer and lead red-teamer run in parallel isolation for an independent first pass — neither sees the other's output during reconnaissance. A synthesis step categorizes findings into four prescriptive buckets (anchoring-suppressed, convergent, blue-flagged-unverified, divergent), producing a unified target list. Focused red-teamers then deep-dive each target. Iterates when exploit chains are discovered. Heavy and thorough by design. Advisory only — produces findings and proposes tickets; does not implement remediation.

日本語の概要は準備中です。原文の説明を表示しています。

Replace OneCLI gateway with the built-in credential proxy. For users who want simple .env-based credential management without installing OneCLI. Reads API key or OAuth token from .env and injects into container API requests.

日本語の概要は準備中です。原文の説明を表示しています。

Extracts structured data from large sets of legal documents into tabular format for review, analysis, and reporting. Processes contracts, agreements, correspondence, filings, and other legal documents in bulk — extracting key terms, dates, parties, obligations, risks, and custom fields into organized tables. Use when conducting due diligence document review, bulk contract extraction, compliance audits across document sets, lease portfolio analysis, employment agreement review, regulatory filing review, or any task requiring structured extraction from multiple documents. Trigger keywords: tabular review, bulk extraction, document review table, data room review, batch document analysis, contract extraction, portfolio review, structured extraction, document comparison table.

日本語の概要は準備中です。原文の説明を表示しています。

Drafts a Motion for Bail Reduction for criminal defense pretrial proceedings. Argues current bail is excessive under the Eighth Amendment using defendant financial circumstances, community ties, and flight-risk factors adapted to jurisdictional bail standards. Use when seeking bail modification, bail reduction, pretrial release, or excessive bail challenges.

日本語の概要は準備中です。原文の説明を表示しています。