3,610 件 ・ 関連度順
概要と使いどころ
Fetch a URL and return a concise markdown summary of its content. Read-only: no files are written; the summary is returned as output only. Use when asked to "fetch and summarize", "summarize this URL", "what does this page say", or "get the content of <url>". Proactively suggest when the user pastes a URL and asks what it contains. (munder-difflin)
日本語の概要は準備中です。原文の説明を表示しています。
Transforms vague UI ideas into polished, Stitch-optimized prompts. Enhances specificity, adds UI/UX keywords, injects design system context, and structures output for better generation results.
日本語の概要は準備中です。原文の説明を表示しています。
Background job management — start, monitor, wait, stop long-running commands. ALWAYS invoke this skill when the user asks to run background tasks, check job status, read job output, or manage long-running commands.
日本語の概要は準備中です。原文の説明を表示しています。
Workaround for write_file failures caused by special characters (apostrophes, backticks, template literals) using a Python heredoc script, plus a reliable TypeScript type-checking step that filters output to only the newly-written files to avoid being misled by pre-existing errors.
日本語の概要は準備中です。原文の説明を表示しています。
Unified workflow that delegates failed web searches to shell_agent for resilient data gathering, then applies anchored spreadsheet proof gates for verified Excel output
日本語の概要は準備中です。原文の説明を表示しています。
Verify output format, file coverage, and task alignment before completing
日本語の概要は準備中です。原文の説明を表示しています。
Generate documents via shell commands and locate nested outputs using find.
日本語の概要は準備中です。原文の説明を表示しています。
Use shell tools safely in sandboxed environments by discovering files from real workspace roots instead of assumed user folders, then explicitly verifying output artifacts after generation.
日本語の概要は準備中です。原文の説明を表示しています。
Use a deterministic Python/openpyxl inspection pass to verify workbook structure, counts, marked rows, and output-file existence when delegated spreadsheet summaries seem inconsistent.
日本語の概要は準備中です。原文の説明を表示しています。
Ensure all required output files are created and verified before marking a task complete
日本語の概要は準備中です。原文の説明を表示しています。
Debug Python script execution failures by capturing full output with exit codes and verifying working directory before file operations
日本語の概要は準備中です。原文の説明を表示しています。
Complete PDF workflow: verify, extract content, assemble reports, and generate output PDFs using command-line tools
日本語の概要は準備中です。原文の説明を表示しています。
Track completion status of all required deliverables and ensure ALL outputs are completed before stopping
日本語の概要は準備中です。原文の説明を表示しています。
Build complex Excel files through staged, verifiable steps with intermediate CSV outputs for debugging
日本語の概要は準備中です。原文の説明を表示しています。
Debug Python PDF generation errors by using unbuffered output and stderr inspection to reveal actual tracebacks
日本語の概要は準備中です。原文の説明を表示しています。
Report tool failures transparently and attempt minimal viable output with disclaimers
日本語の概要は準備中です。原文の説明を表示しています。
Audit generated Excel reports by enumerating populated output rows, exposing formulas, and checking that each subtotal range includes all visible detail rows.
日本語の概要は準備中です。原文の説明を表示しています。
Debug Python code execution failures by capturing partial traces, isolating failing functions, and incrementally verifying outputs
日本語の概要は準備中です。原文の説明を表示しています。
Measures and interprets what a fuzzing campaign actually reaches, using llvm-cov, lcov, or a fuzzer's own coverage output. Covers baselining a new campaign, reading coverage reports, and turning uncovered regions into harness, seed, or dictionary work. Use when a fuzzer plateaus, when judging whether a harness is effective, after changing a harness, or when asking why some code is never reached.
日本語の概要は準備中です。原文の説明を表示しています。
Measures timing side channels in cryptographic implementations by running them, using dudect for statistical analysis and Timecop over Valgrind for dynamic tracing. Covers the formal, symbolic, dynamic, and statistical tool categories and how to read a result. Use when testing whether a running implementation is constant-time, measuring timing variance on a compiled binary, or investigating a suspected timing attack. Not for statically inspecting compiler output — the constant-time-analysis plugin covers that.
日本語の概要は準備中です。原文の説明を表示しています。
Runs a Semgrep security scan over a codebase: detects languages, selects rulesets, presents the plan for explicit approval, then runs every approved ruleset through scripts/run-scans.sh, which batches the semgrep processes and writes scans.json, and merges the output to SARIF. Supports two scan modes, "run all" for full ruleset coverage and "important only" for security findings at medium-to-high confidence and impact. Uses Semgrep Pro for cross-file taint analysis when it is available. Use when asked to scan code for vulnerabilities, run a security audit with Semgrep, find bugs, or perform static analysis. For the same scan without the approval gate, use the /static-analysis:semgrep-scan workflow.
日本語の概要は準備中です。原文の説明を表示しています。
Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "deduplicate alerts", or "process sarif output". Handles filtering, deduplication, format conversion, and CI/CD integration of SARIF data. Does NOT run scans — use the Semgrep or CodeQL skills for that.
日本語の概要は準備中です。原文の説明を表示しています。
Systematic methodology for identifying and exploiting cryptographic implementation weaknesses in real-world applications. Covers padding oracle attacks against CBC-mode ciphers with PKCS7 padding (Vaudenay's original attack through modern padbuster automation), ECB mode exploitation including block cut-and-paste and byte-at-a-time decryption, hash length extension attacks against SHA1/SHA256/MD5-based MACs using HashPump, RSA vulnerabilities including small public exponent, common modulus, Bleichenbacher PKCS1v1.5 padding oracle, and Coppersmith's method for partial key recovery. Addresses weak PRNG exploitation targeting time-seeded generators and Mersenne Twister MT19937 state recovery from observed outputs, timing side-channel attacks against comparison operations, nonce reuse in AES-GCM leading to authentication key recovery, and key derivation weaknesses including insufficient iteration counts and missing salts. Primary tooling includes padbuster, RsaCtfTool, hashpump, and PyCryptodome for building custom exploit payloads. Maps to CWE-327 (Use of a Broken or Risky Cryptographic Algorithm), CWE-328 (Use of Weak Hash), and CWE-330 (Use of Insufficiently Random Values). Emphasizes black-box identification of vulnerable implementations before transitioning to targeted exploitation.
日本語の概要は準備中です。原文の説明を表示しています。
Comprehensive offensive methodology for software supply chain attacks covering the full kill chain from reconnaissance through exploitation. Addresses dependency confusion across npm, PyPI, and NuGet ecosystems where internal registry override allows an attacker to inject malicious packages that shadow private dependencies. Covers typosquatting techniques for popular packages, compromised package injection via maintainer account takeover or social engineering, and build system attacks through Makefile injection, setup.py install hooks, and npm postinstall scripts. Extends into CI/CD artifact tampering where build outputs are replaced or modified in transit, code signing abuse through stolen or self-signed certificates, upstream repository compromise via commit injection or force-push to trusted repos, and container image supply chain attacks including base image trojaning and registry confusion. Maps to MITRE ATT&CK T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools) and T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Integrates tooling such as confused for dependency confusion scanning and dependency-check for known vulnerable component detection. Each technique section provides reproducible proof-of-concept patterns, detection guidance for defenders, and engagement-safe execution notes for authorized red team operations.
日本語の概要は準備中です。原文の説明を表示しています。