4,711 件 ・ 関連度順
概要と使いどころ
9 distinct paths. ATO is a destination class, not a single bug — each path below is a primitive that becomes Critical only when you demonstrate takeover of a SECOND account (test account B) you do not control, from attacker A's session/IP/device. A path that only locks you out of your own account, or only works when you already hold the victim's password AND session, is not a standalone ATO.
日本語の概要は準備中です。原文の説明を表示しています。
OpenClawのGatewayや設定、認証情報の参照、チャネル、ポートの不具合を読み取り専用の確認で調べ、根拠付きの診断結果と次の対応を整理するスキル。
Notionのローカル保存データを検索し、ページやデータベースの一覧・件数・同期状況を確認して、必要に応じてMarkdownを書き出すスキル。
Granolaのローカルアーカイブから会議メモや文字起こしを検索・取得するスキル。同期状態を確認し、必要な更新やSQLによる正確な件数集計も扱います。
TypeScriptのテストで使う型の強制指定を専用関数に置き換え、必要な項目だけのデータや意図的に型を外したデータを扱いやすくするスキル。
プロジェクト文書の整理依頼を適切な専門スキルへ振り分け、文書の役割、リンク、設計判断の索引、根拠への参照を、ファイルを変更せずに点検するスキルです。
Claudeのスキルやコマンドを棚卸しし、内容の重複、実用性、技術情報の古さを点検します。変更分だけの確認と全件レビューに対応し、改善や統合の判断材料をまとめます。
候補の探索や比較を繰り返し、試行の根拠と判断を追記型の台帳に残すスキル。前回との整合性や再検証の結果を確認し、実取引や本番操作へ進む条件を明確にします。
ネットワーク間で経路を交換するBGPの接続断や経路不足を、接続状態・到達性・経路の制御設定から調べ、設定を変えずに診断材料を集めるスキル。
Cisco IOS／IOS-XEの設定をレビューし、通信の許可・拒否ルールやインターフェースの確認、障害調査用コマンドの選定、変更前後の検証を支援します。
Integrate Firecrawl into application code whenever a product, agent, or workflow needs web data inside the app — web search, live search results, page scraping, structured extraction, or browser interaction. Use when building any feature that needs data from the web in code, even if the user does not mention Firecrawl explicitly and only describes wanting web data, website content, search, scraping, or interaction in an application. Trigger for Firecrawl requests, "fire girl" shorthand, and generic app-level web-data needs that should map to `/scrape`, `/search`, or `/interact`. Do not use this skill for one-off terminal-only web tasks during the current session; use `firecrawl/cli` for those.
日本語の概要は準備中です。原文の説明を表示しています。
Read-only repository explorer for cold-start orientation, broad cross-file localization, or when a direct search failed. Skip it when the exact file or symbol is already named. Returns path:line citations only; its reads stay out of main context.
日本語の概要は準備中です。原文の説明を表示しています。
Use when applies to XHTML documents and polyglot HTML documents that must parse correctly as both HTML5 and XML. For modern HTML5-only documents, only `lang` is needed and `xml:lang` is not required. Check when auditing documents served as application/xhtml+xml or documents that include both attributes.
日本語の概要は準備中です。原文の説明を表示しています。
Read-only GitHub triage for issues AND PRs. 1 item = 1 background task (category: quick). Analyzes all open items and writes evidence-backed reports to /tmp/{datetime}/. Every claim requires a GitHub permalink as proof. NEVER takes any action on GitHub - no comments, no merges, no closes, no labels. Reports only. Triggers: 'triage', 'triage issues', 'triage PRs', 'github triage'.
日本語の概要は準備中です。原文の説明を表示しています。
ACTIVATES ONLY on an explicit user request for the ulw-plan workflow: the user themselves saying ulw-plan, ulw plan, /skill:ulw-plan, or asking in their own words for a work plan before coding. NEVER self-activates: a bare ulw/ultrawork run, an agent-side routing decision, or reading this file is not a request, and the plan-gated reviewers (metis/momus) stay locked without a user request plus a written .omo/plans plan file. Explore-first planning consultant (Prometheus) that grounds in the codebase, asks only the forks exploration cannot resolve - or researches them to best practice when the intent is fuzzy - waits for explicit approval, then writes ONE decision-complete work plan a worker executes with zero further interview. Triggers: ulw-plan, ulw plan, plan this, make a plan, plan before coding, interview me, break this down, start planning, plan mode.
日本語の概要は準備中です。原文の説明を表示しています。
Load the body before the first implementation edit for a bug fix or behavior change, or when the user or governing specification makes reusable tests a deliverable. It keeps the smallest focused test with the delivered project and updates coverage when behavior changes. Do not load for greenfield work unless reusable tests are explicitly required, behavior-preserving refactors, verification-only work, plan/review/explanation/documentation/formatting/generated-output-only work, explicit no-change or no-tool work, or when the user declines tests.
日本語の概要は準備中です。原文の説明を表示しています。
Mandatory preflight for web frontend visual design. If available, call read_skill for bundled:taste before the first frontend create or edit tool call whenever creating or visually styling a human-viewed web page, component, app, dashboard, or interactive report. Do not load it for non-visual frontend logic or machine-only HTML. If unavailable, continue without warning. Negative constraints only; user requests and other explicit styles still win.
日本語の概要は準備中です。原文の説明を表示しています。
Clarify a material user-owned product decision before substantive implementation commitments. Use only when request and named/governing evidence still leave a choice that would materially change scope, platform support, user-facing surface, data/API contract, domain values, project placement, or cross-system architecture; also use when a truncated request omits such a choice. On the initial turn, inspect only named or governing requirements evidence, then ask directly without loading: prefer structured input; ask one blocking outcome question or at most three coupled questions; wait. After the answer, load the body before write or delegation. Do not use for implement/build/fix/debug/refactor work when expected behavior is settled, plan/design deliverables owned by Plan, complexity/greenfield/integration alone, agent-owned technical choices, locally discoverable facts, reversible defaults, permission to begin, or stop/no-tool turns. Never re-ask supplied facts or turn clarification into refusal.
日本語の概要は準備中です。原文の説明を表示しています。
Read this before the first Google Drive, Docs, Sheets or Slides connector call whenever the task creates or changes a Google file. Use this skill whenever the user wants to create or change a Google Doc, Sheet or Slides file in their Google Drive. Triggers include: a request that names Google Docs, Sheets, Slides or Drive and asks to make, edit, format, copy or rename a file; a docs.google.com link with a request to change that file, even a one-line fix or suggested edits; and any follow-up change to a Google file from earlier in the chat, even "change it" or "add a tab". Includes helper scripts for document positions, cell ranges and slide layout. However, if the user asks for a doc, deck or spreadsheet without naming Google, or gives a Google file only as source material for something new, use Claude's own output type instead. Do NOT use for read-only questions about a Google file, or for Word, Excel, PowerPoint or PDF files.
日本語の概要は準備中です。原文の説明を表示しています。
Reads, validates, and safely exports protocols.io data with current official REST/MCP contracts, or creates non-executing mutation plans. The bundled client makes bounded official-host GET requests only with explicit --execute. Use only for tasks explicitly targeting protocols.io or an exact protocols.io protocol version.
日本語の概要は準備中です。原文の説明を表示しています。
Start and persistently pursue a goal to babysit an SGLang pull request until selected GitHub Actions workflows pass on the latest PR head. Use when asked to monitor, babysit, retry, or fix PR CI for lint.yml, pr-test.yml, pr-test-extra.yml, AMD, or other named workflows; classify failures as PR-related versus flaky or infrastructural, auto-fix and push only small clean fixes, rerun failed jobs only up to 10 times, and ignore unselected workflows.
日本語の概要は準備中です。原文の説明を表示しています。
A short self-bias checklist to run at the START of any investment research task (stock screen / sector study / company deep-dive). Four biases that systematically warp AI research — leader-bias (only big caps), English-bias (miss JP/KR/TW players), narrative-bias (chase concept labels), confirmation-bias (only bullish evidence) — plus recency-bias. Load this first, then research with the corrections in mind. Not a workflow, just a 60-second attitude reset that materially improves coverage and honesty.
日本語の概要は準備中です。原文の説明を表示しています。
Deploy cloud-native deception across AWS, Azure, and GCP using decoy (honey) resources whose only purpose is to generate a high-fidelity alert the instant an attacker touches them: canary IAM access keys, permission-less decoy users/roles/service principals, honey object-storage buckets, and decoy secrets in Secrets Manager / Key Vault / Secret Manager. Wires detection through CloudTrail + EventBridge, Azure Sentinel honeytoken watchlists + Defender, and GCP Cloud Audit Logs, so any use of a decoy is routed to the SOC with near-zero false positives. Use when protecting cloud accounts and data stores, when an org has only on-prem honeypots and needs cloud coverage, when seeding fake AWS keys to catch credential theft and code-leak exposure, or when detecting cloud reconnaissance and lateral movement. Keywords: cloud deception, canary token AWS, honey S3 bucket, decoy IAM credentials, CloudTrail alert, GuardDuty, Sentinel honeytoken, decoy secret, honey service account, cloud honeypot, breach detection.
日本語の概要は準備中です。原文の説明を表示しています。
Turn your latest Granola call into next steps (owner, team, due date, and the Linear issue that already tracks each one) and post them to Slack, using cognee memory of your calls, Linear issues and Gmail inbox. Use when someone asks for the next steps or action items of their latest call. Runs locally; reads Gmail read-only; posts to Slack only when Slack is set up.
日本語の概要は準備中です。原文の説明を表示しています。