3.1万 件 ・ 関連度順
概要と使いどころ
AI-first security scanning with Medusa. 3,000+ detection patterns covering AI/ML, agents, MCP, RAG, prompt injection, and traditional SAST vulnerabilities. Wraps Medusa CLI with SARIF/JSON parsing, structured finding output, OWASP mapping, and remediation guidance.
日本語の概要は準備中です。原文の説明を表示しています。
Modern Java idioms for any JVM project (Java 17+): records, sealed types, text blocks, pattern matching, Optional discipline, streams, immutability, null safety, package layout, var usage, and code organisation. Apply when the project is a Java 17+ project. Stack-agnostic — referenced by every Java plugin in the marketplace. Use this skill to: - Write self-documenting, immutable-by-default value types with records. - Model closed type hierarchies with sealed classes and interfaces. - Handle optionality explicitly with Optional instead of returning null. - Write expressive pipelines with Stream API without performance footguns. - Lay out packages consistently (feature-first or layer-first) and keep class responsibilities tight. Do NOT use this skill for: - Framework-specific idioms (Spring annotations, JPA mappings — those live in framework plugin skills). - Build tooling (Maven/Gradle) — see java-foundation:build-tooling. - Testing patterns — see java-foundation:jvm-testing.
日本語の概要は準備中です。原文の説明を表示しています。
Create or revise a governed Proto UI spec entity after identity, ownership, lifecycle intent, semantic scope, relations, and evidence plan are fixed by current authority. Use for Contract, Prototype, Module, Adapter profile, Decision, Host Capability, Test, Version, or Knowledge entity work. Do not use to decide an unresolved admission or lifecycle promotion.
日本語の概要は準備中です。原文の説明を表示しています。
Use for ANY bug bounty, penetration test, or web/API/mobile security assessment: recon, testing endpoints, analyzing Burp traffic or any bug-bounty platform's MCP (HackerOne, Intigriti, Bugcrowd, YesWeHack, Immunefi), reviewing APKs, bypassing a WAF, enforcing scope, hunting a specific vuln class, validating findings, writing reports, or when you are stuck on a target and about to give up. Activates automatically for all bug-bounty and pentest sessions. Runs an autonomous, never-surrender predator methodology: refuses to conclude "secure", exhausts each vuln class to depth, proves a real attacker-path with impact and no false positives, tracks coverage so nothing is re-tested or skipped, diagnoses failed tooling from full logs, and hunts at maximum effort with intelligent token use until the goal is found. Activates and follows instructions in ANY language the operator writes in (the skill itself is English). Bundles a per-class web-exploitation KB, a writeup library, and PayloadsAllTheThings.
日本語の概要は準備中です。原文の説明を表示しています。
Build a persistent visual brand identity for image generation. Defines how the brand looks visually — aesthetic, lighting, composition, mood — and writes it to brand/creative-kit.md so /image-gen and other creative skills produce consistent on-brand visuals. Three modes: Extract (from website/URL), Build (interview), Reference (mood board/examples). Use when starting any project that needs images, when the user says "visual style", "brand aesthetic", "image style", "visual identity", "how should our images look", "build visual brand", "define our look", or when /image-gen outputs feel generic because no visual style exists yet.
日本語の概要は準備中です。原文の説明を表示しています。
Use when the user wants professional brand-quality product images via Higgsfield's mode-specific prompt enhancement pipeline. Entry point for any product visual with a specific format or platform target. Use whenever: "product photoshoot", "lifestyle product shots", "Pinterest pin", "hero banner", "ad pack", "virtual try-on", "studio shot", "carousel images", "Meta ads creative", "model wearing product", "levitating product", "splash shot", "CGI style product", "restyle product image", Shopify image, brand campaign visual. 10 modes: product_shot, lifestyle_scene, closeup_product_with_person, moodboard_pin, hero_banner, social_carousel, ad_creative_pack, virtual_model_tryout, conceptual_product, restyle. Backend assembles the prompt — never call gpt_image_2 directly for product shots. NOT for: one-off images without a product (use image-gen), branded video with avatars (use higgsfield-generate), Soul training (use higgsfield-soul-id). Requires Higgsfield CLI and authed account.
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill to integrate the Jetpack Compose Styles API into an Android project. This skill guides you through upgrading dependencies, setting up component themes, making custom components styleable, and migrating existing layout properties to use unified styles. Migrate custom design system components, replace hard coded parameters with Style attributes, and use Modifier.styleable for interaction states.
日本語の概要は準備中です。原文の説明を表示しています。
Executes authorized phishing simulation campaigns to assess an organization's susceptibility to email-based social engineering attacks. The tester designs realistic phishing scenarios, builds credential harvesting infrastructure, sends targeted phishing emails, and tracks open rates, click-through rates, and credential submission rates to measure human security awareness. Activates for requests involving phishing simulation, social engineering assessment, email security testing, or security awareness measurement.
日本語の概要は準備中です。原文の説明を表示しています。
Use when evidence needs grading before anyone reasons from it — the user asks "how reliable is this?", "grade this source", "check this report", "can I trust this article?", "is this corroborated?", or hands over a URL, a pasted report or a Liberty91 event ahead of an ACH or assessment. The Quality of Information Check from the CIA Tradecraft Primer, adapted for vendor and press CTI reporting. Resolves each document to its originating source, splits it into claims, and grades every claim on two written elements, access level (how the source knows) and claim support (what backs the statement), with a stated rationale, using a fixed rubric with hard caps. The grade is not an Admiralty rating. Five outlets citing one vendor report count as one source; anything that cannot be traced to a primary is capped, not guessed. Returns a graded claim table, gaps, a deception screen and JSON. /ach, /threat-assessment and /writing-assessments run it first by default.
日本語の概要は準備中です。原文の説明を表示しています。
Cybersecurity partner skill for acting as a practical security collaborator across architecture review, threat modeling, secure design, risk prioritization, defensive planning, vulnerability remediation, incident readiness, security roadmaps, and technical decision support. Use when the user wants an ongoing security advisor, reviewer, or second set of eyes.
日本語の概要は準備中です。原文の説明を表示しています。
Performs a white-box security review of Atlassian Forge apps using structured, Forge-specific security rules and evidence-driven reporting. Use when the user asks for a Forge security review, security audit, vuln assessment, pentest-style code review, authz review, tenant isolation analysis, web trigger hardening, or static analysis execution for a Forge app.
日本語の概要は準備中です。原文の説明を表示しています。
Turn any still image into a professional motion graphic through the Novoads API on Seedance 2.5. Covers how to read a reference image, motion vocabulary for any image type — UI, marketing hero, flat-lay, key art, collage, product, character — the prompt clauses that control camera, timing, frozen regions and text fidelity, and the upload mechanics. Use whenever the user supplies an image and wants it animated, moving, or turned into video — including "animate this", "turn this into a motion graphic", "make this move", "この画像動かして", "モーショングラフィックにして", "I want the cards to pop in", "I want the bars to slide up", or when they describe motion beats for a static image. Also use when asked to write a Seedance prompt for an existing image. Do NOT use for text-to-video with no source image, restyling existing footage (this skill takes no video input), cloning a reference video (use clone-video-ad), or a product photo that should seed a new scene rather than move as-is (use novoads-api).
Use when styling PyQt/PySide6 widgets with QSS - selectors and pseudo-states, stylesheet application, common style properties, widget-specific styling, or building a dark theme
日本語の概要は準備中です。原文の説明を表示しています。
Test Large Language Models for direct prompt injection vulnerabilities where user input overrides system instructions, extracts system prompts, bypasses safety filters, or causes unauthorized actions. Use this skill when assessing chatbots, AI assistants, LLM-powered tools, or any application that processes natural language input through an LLM. Covers role-playing attacks, instruction hierarchy exploitation, multi-turn manipulation, and context window abuse for comprehensive AI security testing.
日本語の概要は準備中です。原文の説明を表示しています。
Build production-grade Claude Code CLI skills with fallback architecture, TypeScript implementation, and creativity directives. Based on Critical Thinking Bug Bounty Podcast Episode 166 — "Building Claude Skills as a Bug Bounty Hunter."
日本語の概要は準備中です。原文の説明を表示しています。
Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every technique includes actual payloads, commands, and verification logic. Chains from /pentester or /codebase when API endpoints are discovered, chains into /web-exploit when classic injection points are found in API parameters, chains into /post-exploit when RCE is achieved, and chains into /ai-redteam when an LLM/AI endpoint is discovered (chat APIs, completion endpoints, RAG search, agentic tool-use, MCP servers).
日本語の概要は準備中です。原文の説明を表示しています。
Toggle the badges-page Honesty Mode build-time flag on or off. ON makes the README badge generator emit direct /badges/_assets/<handle>/<file>.svg URLs (no Cloudflare Worker, no ?repo= validation). OFF restores worker-validated URLs. Use when the user says "/honesty-mode on", "/honesty-mode off", "turn honesty mode on/off", or asks for the current honesty-mode state.
日本語の概要は準備中です。原文の説明を表示しています。
Style every matplotlib figure like the Stata 18/19 default (stcolor) scheme — Arial embedded as TrueType, white background, recessive light-gray grid below the data, no top/right spines, unframed legends, and the validated blue/red/gray palette. Use whenever a task generates or restyles charts, plots, or figures for papers, reports, or slides, even if the user doesn't mention Stata — this is the house style for all publication figures. Also use when asked to make figures "look like Stata", match the stcolor scheme, or restyle existing matplotlib output.
日本語の概要は準備中です。原文の説明を表示しています。
Generate Unity 6+ UI Toolkit Runtime Data Binding code using MVVM pattern with [CreateProperty], DataBinding, and PropertyPath. Use when creating UI screens, HUDs, menus, inventories, settings panels, or any data-bound UI elements with UI Toolkit. Triggers on requests like "create a health bar", "build the HUD", "make a settings screen", "bind data to UI", "create an inventory UI", "add a pause menu", "show player stats on screen", "build a shop UI", "create a dialogue box", or any task involving runtime UI layout, styling, or data display. Also use when the user mentions UXML, USS, ViewModel, or UI bindings. Only activates when ProjectConfig.yaml -> ui_system is "UIToolkit" or "Mixed". Requires Unity 6.0+.
日本語の概要は準備中です。原文の説明を表示しています。
Generate custom editor tooling including Custom Inspectors, PropertyDrawers, EditorWindows, Gizmos, and Handles. Use when building designer-facing tools, spatial visualization, batch operations, or custom component UIs. Triggers on requests like "create a custom inspector", "add gizmos", "build an editor window", "make this component designer-friendly", "add a debug visualization", "create a level editor tool", "add a property drawer", "make a batch rename tool", or any editor tooling work. Always uses SerializedProperty and Undo for safety.
日本語の概要は準備中です。原文の説明を表示しています。
Unity 6 platform targeting and build guide. Use when building for specific platforms, configuring build profiles, using platform scripting defines (#if UNITY_IOS, #if UNITY_ANDROID), optimizing for mobile, WebGL, or consoles, working with Addressables/asset bundles, or choosing between IL2CPP and Mono. Based on Unity 6.3 LTS documentation.
日本語の概要は準備中です。原文の説明を表示しています。
Unity 6 testing guide. Use when writing unit tests, integration tests, or doing TDD with Unity Test Framework. Covers Edit Mode and Play Mode tests, NUnit attributes ([Test], [UnityTest], [SetUp], [TearDown]), testing MonoBehaviours and coroutines, and CI/CD integration. Based on Unity 6.3 LTS documentation.
日本語の概要は準備中です。原文の説明を表示しています。
Unity 6 ECS/DOTS development guide. Use when working with Entity Component System, data-oriented design, Jobs system, or Burst Compiler. Covers Entities, IComponentData, ISystem, EntityManager, baking, Jobs, and Burst. Based on Unity 6.3 LTS documentation.
日本語の概要は準備中です。原文の説明を表示しています。
Unity 6 packages and services guide. Use when working with Package Manager, installing/updating packages, scoped registries, or Unity Gaming Services (Authentication, Cloud Save, Analytics, Leaderboards, Matchmaker). Covers essential packages list and version compatibility. Based on Unity 6.3 LTS documentation.
日本語の概要は準備中です。原文の説明を表示しています。