「ssm」の検索結果

"Conduct a systematic literature review following the PRISMA framework with explicit search strategy, inclusion and exclusion criteria, quality assessment, and transparent synthesis. Use this skill when the user needs to design a reproducible literature search, apply PRISMA flow documentation, develop inclusion and exclusion criteria, assess study quality, or when they ask 'how do I do a systematic review', 'what is PRISMA', or 'how do I make my literature review reproducible'.".

日本語の概要は準備中です。原文の説明を表示しています。

"Conduct SWOT analysis with TOWS matrix for strategic planning. Use this skill when the user needs to evaluate a company, product, or project by identifying strengths, weaknesses, opportunities, and threats, or wants to generate strategic options from internal and external factors. Also use when the user mentions competitive positioning, strategic assessment, or asks 'what are our advantages and risks', even without naming SWOT explicitly.".

日本語の概要は準備中です。原文の説明を表示しています。

"Conduct FMEA to systematically identify, prioritize, and mitigate potential failure modes. Use this skill when the user needs to assess product or process risks, prioritize corrective actions, or build a risk register — even if they say 'failure mode analysis', 'risk assessment', 'what could go wrong', or 'RPN calculation'.".

日本語の概要は準備中です。原文の説明を表示しています。

Generate project assessment markdown documents from JSON data with WHY/WHO/WHAT sections and GO/NO-GO decision matrix.

日本語の概要は準備中です。原文の説明を表示しています。

Validate user stories — INVEST scoring, story-to-test coverage mapping, PRP completeness, and development-readiness assessment. Use after writing stories and before starting implementation. Trigger on "validate the stories", "are these stories ready", "INVEST check", "story coverage", "is this ready to build".

日本語の概要は準備中です。原文の説明を表示しています。

Run security verification — SAST pattern scanning, DAST against a running app, OWASP Top 10 compliance, CVSS assessment, and adversarial code audit. Use before commit/push or when checking code for vulnerabilities. Trigger on "security scan", "is this vulnerable", "OWASP check", "security verify", "scan for vulnerabilities".

日本語の概要は準備中です。原文の説明を表示しています。

Performs a white-box security review of Atlassian Forge apps using structured, Forge-specific security rules and evidence-driven reporting. Use when the user asks for a Forge security review, security audit, vuln assessment, pentest-style code review, authz review, tenant isolation analysis, web trigger hardening, or static analysis execution for a Forge app.

日本語の概要は準備中です。原文の説明を表示しています。

Facilitate and document Sprint Retrospectives per Scrum Guide 2020. Choose format by team maturity, structure the session, capture action items, and track improvement across sprints. Use after every sprint. Do not use for individual performance reviews, blame sessions, or annual assessments.

日本語の概要は準備中です。原文の説明を表示しています。

Map existing business processes using BPMN 2.0 notation or simplified swimlane diagrams. Identify waste, handoffs, decision points, and improvement opportunities using Lean principles (8 Wastes). Use when documenting workflows for SOP creation, automation assessment, or process improvement. Do not use for software architecture diagrams — use architecture tools instead.

日本語の概要は準備中です。原文の説明を表示しています。

Convert scattered progress notes, RAID changes, and milestone movement into a clean weekly or biweekly status update. Use when the work is routine status packaging or steering prep. Do not use for project governance design, root cause analysis, or deep portfolio risk assessment.

日本語の概要は準備中です。原文の説明を表示しています。

Write structured legal memoranda following the Issue-Rule-Analysis-Conclusion (IRAC) framework. Suitable for internal legal opinions, advisory memos, and compliance assessments. Use when legal analysis needs to be documented for decision-makers. Do not use as a substitute for licensed legal advice on high-stakes matters.

日本語の概要は準備中です。原文の説明を表示しています。

Record and track organizational decisions using the RAPID framework. Captures decision context, options analysis, RAPID roles, risk assessment, and communication plan. Use when making cross-functional decisions, documenting governance choices, or building an auditable decision trail.

日本語の概要は準備中です。原文の説明を表示しています。

Write blameless incident postmortems following Google SRE methodology. Covers timeline reconstruction, root cause analysis (5 Whys), impact assessment, and action items with owners. Use after production incidents, outages, or significant bugs to prevent recurrence.

日本語の概要は準備中です。原文の説明を表示しています。

Write structured business cases with problem framing, options analysis, financial modeling (NPV/ROI/Payback), risk assessment, and implementation roadmap. Follows HBR business case structure. Use when seeking budget approval, proposing new initiatives, or justifying investment decisions.

日本語の概要は準備中です。原文の説明を表示しています。

API security automation skill for REST, GraphQL, gRPC, and WebSocket APIs. Covers OpenAPI/AsyncAPI ingestion, authenticated fuzzing, OWASP API Top 10 (BOLA, BFLA, mass assignment, SSRF), schema diffing, GraphQL introspection abuse, JWT and OAuth misuse, rate-limit and replay testing. Use to automate API assessments with safe, scoped, evidence-backed findings.

日本語の概要は準備中です。原文の説明を表示しています。

Authorized exploit development and vulnerability research skill for lab environments, CTFs, owned software, crash analysis, memory corruption, exploitability assessment, fuzzing results, proof-of-concept design, and remediation. Use for defensive validation and education; avoid real-world weaponization, stealth, persistence, evasion, or unauthorized targets.

日本語の概要は準備中です。原文の説明を表示しています。

Post-exploitation workflow. Covers privilege escalation (Linux SUID/sudo/kernel, Windows UAC/service/token), persistence assessment, local enumeration, credential harvesting, and pivot preparation. Structured workflows for Linux and Windows targets using impacket, netexec, john, linpeas/winpeas, and standard Kali tools. Includes kernel exploit reference tables, GTFOBins exploitation chains, Potato attack selection, Docker/container escapes, DLL hijacking, SSH key harvesting, credential recovery from memory, and Windows token manipulation. Chains from /pentester or /credential-audit when access is obtained.

日本語の概要は準備中です。原文の説明を表示しています。

Deep OAuth 2.0 / OpenID Connect security assessment. Covers the full attack surface: redirect_uri validation bypass (path traversal, open redirect chains, subdomain confusion, URL parsing tricks, parameter pollution, response mode switching), missing/broken state parameter CSRF, PKCE downgrade and absent-challenge attacks, implicit grant token leakage (Referer, browser history, XSS fragment theft), authorization code injection, scope escalation, client confusion attacks, mutable-claims account takeover (iss+sub confusion, email-keyed identity merging), pre-account takeover via unverified registration, OpenID Connect dynamic client registration SSRF (logo_uri, jwks_uri, sector_identifier_uri, request_uri), nonce replay, ID token validation failures, Device Code phishing flow, mobile custom URI scheme hijacking, refresh token persistence, token introspection enumeration, consent screen clickjacking, host header injection, and cross-IdP mix-up attacks. Uses KOAuth, jwt_tool, nuclei oauth templates, and manual http(action="request", ...) payloads. Every technique includes actual request payloads and verification logic. Chains from /pentester or /api-security when OAuth endpoints are discovered. Chains into /web-exploit for open redirect, XSS, and SSRF chaining. Chains into /post-exploit when full account takeover is achieved. Chains into /credential-audit when access tokens or refresh tokens are recovered.

日本語の概要は準備中です。原文の説明を表示しています。

Perform advanced network scanning and service enumeration using Nmap for penetration testing and security assessments. Use this skill when conducting network reconnaissance, port scanning, service version detection, OS fingerprinting, and vulnerability scanning. Covers stealth scanning, firewall evasion, NSE script usage, and network mapping for infrastructure penetration tests.

日本語の概要は準備中です。原文の説明を表示しています。

Test Model Context Protocol (MCP) servers and tool-calling systems for security vulnerabilities including tool injection, parameter manipulation, privilege escalation, and data exfiltration through AI agent tool interfaces. Use this skill when assessing MCP server implementations, AI agent tool integrations, or any system that exposes tools to language models. Covers tool confusion attacks, cross-tool exploitation, and MCP server hardening assessment.

日本語の概要は準備中です。原文の説明を表示しています。

Internal network assessment. VLAN hopping, ARP spoofing detection, broadcast protocol abuse (LLMNR/NBT-NS/mDNS), network segmentation verification, SNMP enumeration, NFS exposure, router/switch audit, and internal service mapping. Assumes attacker has network access. Uses nmap, arp-scan, nbtscan, snmpwalk, onesixtyone, smbmap, nfs-common, masscan, hping3, and netexec.

日本語の概要は準備中です。原文の説明を表示しています。

iOS pentesting playbook. Use when testing iOS applications for keychain extraction, URL scheme hijacking, Universal Links exploitation, runtime manipulation, binary protection analysis, data storage issues, and transport security bypass during authorized mobile security assessments.

日本語の概要は準備中です。原文の説明を表示しています。

Systematically bypass LLM safety filters and content moderation systems using advanced jailbreaking techniques. Use this skill when testing AI systems for safety alignment robustness, evaluating content moderation effectiveness, or conducting authorized AI red team assessments. Covers role-play attacks, few-shot manipulation, encoding bypass, multi-modal exploitation, and automated jailbreak discovery methods.

日本語の概要は準備中です。原文の説明を表示しています。

Active Directory and network lateral movement assessment. Pass-the-hash, pass-the-ticket, Kerberoasting, AS-REP roasting, NTLM relay, SMB relay, WMI/WinRM/PSRemoting abuse, constrained/unconstrained delegation, RBCD, cross-trust exploitation, and pivoting. Uses impacket, netexec, enum4linux-ng, smbmap, smbclient, bloodhound-python, Responder, ntlmrelayx, mitm6, and ldap-utils. Chains from /post-exploit or /credential-audit.

日本語の概要は準備中です。原文の説明を表示しています。