「nsf」の検索結果

Identify and exploit HTTP Request Smuggling (HTTP Desync) vulnerabilities caused by discrepancies in how front-end proxies (load balancers, CDNs) and back-end servers parse the Content-Length and Transfer-Encoding headers. Use this to bypass security controls, hijack user sessions, and poison web caches.

日本語の概要は準備中です。原文の説明を表示しています。

HTTP request smuggling exploits disagreements between a front-end proxy and back-end server on where one HTTP request ends and the next begins, using conflicting `Content-Length` and `Transfer-Encoding: chunked` headers (CL.TE, TE.CL, TE.TE variants). Enables bypassing access controls, cache poisoning, session hijacking, and capturing other users' requests. Detect via timing attacks, differential responses, and tools like Burp's HTTP Request Smuggler extension.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user wants to extract reusable offensive security knowledge from any source and generate a SKILL.md file. Trigger on: "distill this", "extract skill from", "turn this into a skill", "generate skill from", "convert this report/blog/book/walkthrough into a skill", or when the user pastes raw security content (bug report, pentest report, CTF writeup, blog post, ezine, book chapter) and wants it transformed into structured hunting methodology.

日本語の概要は準備中です。原文の説明を表示しています。

White-box source code security review structured around OWASP ASVS 5.0 (427 verification requirements across 16 chapters). Reads and understands application source code to build a security-aware knowledge base that enriches all downstream skills. Covers: tech stack identification, route/endpoint mapping, authentication and authorization architecture, dangerous function patterns, source-to-sink data flow tracing, IaC review, dependency analysis, ASVS compliance mapping, and LLM integration security (prompt injection, tool abuse, output handling, RAG poisoning, MCP server patterns). When LLM/AI framework usage is detected, automatically reviews OWASP LLM Top 10 patterns from source code and chains into /ai-redteam with white-box context for live endpoint testing. Chains into /pentester, /threat-modeling, /web-exploit, /api-security, /cloud-security, /analyze-cve, /credential-audit, and /ai-redteam — providing white-box context that transforms black-box testing into targeted, informed assessment.

日本語の概要は準備中です。原文の説明を表示しています。

Utilize the native Windows binary `certutil.exe` to download malicious payloads and optionally decode Base64 encoded files as a Living-off-the-Land (LotL) technique. This skill details how attackers bypass application whitelisting and fetch stage-2 implants.

日本語の概要は準備中です。原文の説明を表示しています。

Identify and exploit Clickjacking (UI Redressing) vulnerabilities where a malicious website iframes a target application, tricking victims into performing unintended actions (e.g., transferring funds, deleting accounts, or granting permissions) via hidden layers.

日本語の概要は準備中です。原文の説明を表示しています。

Systematically discover hidden Application Programming Interfaces (APIs), uncover undocumented endpoints (Shadow APIs), and fuzz parameters. Use this skill as the pivotal first step in API Bug Hunting, transforming a basic frontend application into a vast mapped attack surface.

日本語の概要は準備中です。原文の説明を表示しています。

Extensible text editor framework by Meta. Use when building a rich text editor on Lexical — editor setup, custom nodes, commands, transforms, and serialization.

日本語の概要は準備中です。原文の説明を表示しています。

Zod schema validation patterns for TypeScript - schema definitions, type inference, refinements, transforms, discriminated unions

日本語の概要は準備中です。原文の説明を表示しています。

Transform git commit history into polished user-facing changelogs and release notes. Use when the user wants a CHANGELOG.md from a version tag or date range, weekly product updates, app store release notes, or Keep a Changelog formatted output with internal noise filtered out.

日本語の概要は準備中です。原文の説明を表示しています。

Guide users through a structured workflow for co-authoring documentation. Use when user wants to write documentation, proposals, technical specs, decision docs, or similar structured content. This workflow helps users efficiently transfer context, refine content through iteration, and verify the doc works for readers. Trigger when user mentions writing docs, creating proposals, drafting specs, or similar documentation tasks.

日本語の概要は準備中です。原文の説明を表示しています。

Update Pharos funding donations by reconciling inbound transfers, rejecting wallet self-activity and spam, pricing receipt-time value, and appending user-approved rows.

日本語の概要は準備中です。原文の説明を表示しています。

Builds a hand-sculpted stop-motion CLAY ad on the Novoads REST API as a STORYBOARD: five to eight beats, each rendered from its own key frame, a storyteller narration laid into the gaps, a music bed, captions burned on, assembled locally with ffmpeg. Carries the genre's arc (named protagonist, inciting moment, social beat, quiet despair, sculpted clay infographic, discovery, transformation, resolution card), and also recreates a found clay ad by reading the reference video locally with ffmpeg and Whisper. Use for ANY clay or stop-motion ask at ANY length: "claymation ad", "stop-motion ad", "clay ad", "a quick clay ad", "plasticine characters", "make an ad like this clay one", or a reference video with sculpted clay characters in it. There is no one-call tier here, so ffmpeg is required. Not for the smooth 3D animated look (use pixar-ad, which covers every Pixar-style length), talking-head UGC (novoads-api), or a static image ad.

日本語の概要は準備中です。原文の説明を表示しています。

This skill provides expert-level guidance for refactoring VS Code extension code. Use when extracting classes or functions, reducing code duplication, improving type safety, reorganizing module structure, applying design patterns, or optimizing performance. Covers systematic refactoring workflows, code smell detection, safe transformation techniques, and VS Code-specific patterns.

日本語の概要は準備中です。原文の説明を表示しています。

Establishes safe practices for acquiring, storing, transferring, and disposing of malware samples: password-protected archives, neutralized extensions, hashing for identity, and chain-of-custody. Activates for requests about safely storing or sharing malware, sample handling hygiene, or defanging artifacts.

日本語の概要は準備中です。原文の説明を表示しています。

Hunts for pre-exfiltration data staging and archiving by detecting archive-tool execution (rar, 7z, zip, tar), large compressed files written to staging directories, and collection into a single location before transfer. Activates for requests to hunt data staging, detect pre-exfil archiving, or find collection and compression before exfiltration.

日本語の概要は準備中です。原文の説明を表示しています。

Three.js scene setup, cameras, renderer, Object3D hierarchy, coordinate systems. Use when setting up 3D scenes, creating cameras, configuring renderers, managing object hierarchies, or working with transforms.

日本語の概要は準備中です。原文の説明を表示しています。

Unity 3D math correctness patterns. Catches common mistakes with coordinate spaces, Quaternion, Vector3, Plane, Bounds, Transform hierarchies, raycasting projection, and floating-point precision. PATTERN format: WHEN/WRONG/RIGHT/GOTCHA. Based on Unity 6.3 LTS documentation.

日本語の概要は準備中です。原文の説明を表示しています。

Unity 6 core concepts and architecture guide. Use when working with GameObjects, Components, Transforms, Scenes, Prefabs, ScriptableObjects, or Unity project structure. Covers the entity-component architecture, object hierarchy, tags, layers, and project conventions. Based on Unity 6.3 LTS documentation.

日本語の概要は準備中です。原文の説明を表示しています。

用于将昂贵的浏览器工作移出主线程，涉及 Web Workers、SharedWorker、worker 池、Comlink、transferable objects、Vite/Webpack worker 集成或 UI 响应性修复。不要用于轻量同步工作或 DOM 操作；中文触发词包括 Web Worker、后台线程、主线程阻塞。

日本語の概要は準備中です。原文の説明を表示しています。

Use when moving expensive browser work off the main thread with Web Workers, SharedWorker, worker pools, Comlink, transferable objects, Vite/Webpack worker integration, or UI responsiveness fixes. Do not use for lightweight synchronous work or DOM manipulation; Chinese triggers include Web Worker, background thread, main thread blocking.

日本語の概要は準備中です。原文の説明を表示しています。

Use when diagnosing structural maintainability problems in existing frontend code before deciding how to refactor it, especially when evidence, false-positive checks, and candidate transformations are needed without editing business code.

日本語の概要は準備中です。原文の説明を表示しています。

Use when selecting or composing behavior-preserving refactoring techniques after structural evidence is known, especially when multiple candidate transformations, preconditions, or ordering choices must be compared.

日本語の概要は準備中です。原文の説明を表示しています。

Master orchestrator for B2B SaaS marketing campaigns using the CATALYST framework (Coordinated Agents for Targeted, Analytics-Led, Year-round SaaS Transformation). Coordinates 90 specialist agents across 17 marketing disciplines. Use this skill for ANY large-scale marketing initiative: full GTM launches, annual marketing plans, multi-channel campaigns, quarterly planning, or any task requiring coordination across content, SEO, paid media, social, email, design, sales enablement, product marketing, analytics, project management, and client operations. Also triggers on: marketing strategy, campaign plan, GTM launch, quarterly plan, marketing ops, full-funnel campaign, marketing audit, growth plan.

日本語の概要は準備中です。原文の説明を表示しています。