6,442 件 ・ 関連度順
概要と使いどころ
Exploit Time-of-Check to Time-of-Use (TOCTOU) race conditions in web applications and APIs. Use this skill when testing transactional operations (e.g., applying coupons, transferring funds, redeeming rewards, or purchasing items) to bypass business logic and duplicate actions before the server updates its database state.
日本語の概要は準備中です。原文の説明を表示しています。
Detects insecure platform interaction in mobile apps (Android/iOS). Trigger on: exported Activity, exported Service, exported BroadcastReceiver, Content Provider, Intent injection, deep link hijacking, WebView JavaScript enabled, JavascriptInterface, addJavascriptInterface, setJavaScriptEnabled, intent:// scheme, file:// scheme, WKWebView, WKScriptMessageHandler, UIPasteboard, URL scheme hijacking, Universal Links, PendingIntent, FLAG_IMMUTABLE, overlay attack, tapjacking, screenshot prevention, FLAG_SECURE, Broadcast sniffing, IPC data exposure. Covers MASVS-PLATFORM-1/2/3.
日本語の概要は準備中です。原文の説明を表示しています。
Extract sensitive training data (PII, API keys, intellectual property, or code) directly from a deployed Large Language Model (LLM). This AI Red Teaming skill focuses on forcing models to regurgitate memorized, unredacted data from their massive internet-scraped datasets through repetition attacks, prefix continuation, and context window manipulation.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit AI applications using Indirect Prompt Injection. This skill focuses on hiding malicious instructions within data sources (web pages, documents, emails) that the LLM processes, causing the AI to execute unintended actions or leak data without direct user interaction.
日本語の概要は準備中です。原文の説明を表示しています。
Use when hunting CI/CD bot comment command vulnerabilities where issue_comment or pull_request_review_comment triggers invoke privileged workflows without verifying the commenter's identity or authorization. Trigger on: "bot command injection", "issue_comment trigger", "@github-actions", "slash command CI", "CI bot command", "comment triggered workflow", "unauthenticated bot", "github-actions publish", "comment dispatch", no authorization check on workflow_dispatch from comment, chatops CI/CD, supply chain via PR comment.
日本語の概要は準備中です。原文の説明を表示しています。
AI/LLM red-team assessment using the OWASP LLM Top 10 (2025) + OWASP AI Testing Guide (AITG v1, Nov 2025) frameworks, plus OWASP MCP Top 10 runtime testing for agentic/MCP targets. Tests prompt injection, jailbreaks, system prompt leakage, sensitive data extraction, excessive agency, improper output handling, model extraction, content bias, evasion, membership inference, MCP token exposure, MCP command injection, and more. Uses four tools in combination: FuzzyAI (single-turn jailbreak fuzzing), PyRIT (multi-turn orchestrated attacks), Garak (probe-based vulnerability scanning), and promptfoo (plugin-based red-team evaluation). Each tool covers different OWASP categories; running them together gives systematic coverage. Includes a conditional MCP reconnaissance phase and a post-access AI infrastructure phase (chained from /post-exploit). Produces: OWASP LLM Top 10 + AITG + MCP coverage matrix, findings per category, architecture diagram of the AI system, PoCs for confirmed exploits. Chains into /gh-export for issue filing.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit AI assistants equipped with web-browsing capabilities or internal API plugins to perform Server-Side Request Forgery (SSRF). This skill details injecting prompts that force the LLM to request sensitive internal endpoints, such as underlying cloud metadata services or internal networks.
日本語の概要は準備中です。原文の説明を表示しています。
Configure Claude as a "Pair Hunter" — autonomous overnight hacking, context management via per-target .claudemd files, sub-agent compaction avoidance, and scope enforcement. Based on Critical Thinking Bug Bounty Podcast Episode 166.
日本語の概要は準備中です。原文の説明を表示しています。
Test AI agent systems for tool abuse, unauthorized actions, privilege escalation through tool chaining, and safety bypass via agentic workflows. Use this skill when assessing autonomous AI agents that use tool-calling (function calling, plugins, actions) to interact with external systems. Covers multi-step attack chains, implicit trust exploitation, and capability boundary testing for AI agents.
日本語の概要は準備中です。原文の説明を表示しています。
Screening for drug-drug interactions — mechanistic prediction, database checks, and clinical risk assessment.
日本語の概要は準備中です。原文の説明を表示しています。
Continuously monitor a GitHub PR for merge conflicts, CI failures, and CodeRabbit review comments, then automatically fix any issues found. Polls every 5 minutes and loops until every check is green. Use this skill whenever a PR has just been created or code has been pushed to a PR branch — it should be the default follow-up action after any PR creation or push. Also trigger on: "watch this PR", "guard this PR", "monitor CI", "keep fixing until green", "PRを監視して", "CIが通るまで 直して", /pr-guardian. When a PostToolUse hook reports that a push or PR creation just happened, proactively invoke this skill to start monitoring without waiting for the user to ask.
This skill provides guidance for using Firecrawl MCP for web scraping and content extraction. Use when scraping web pages, crawling websites, searching the web with content extraction, mapping site URLs, or extracting structured data from web pages.
日本語の概要は準備中です。原文の説明を表示しています。
Locates candidate encryption keys in a binary by finding high-entropy fixed-size regions (16/24/32 bytes) near cryptographic constants or crypto API references, and surfacing printable key/passphrase strings. Activates for requests to extract encryption keys, find an AES key in a sample, or recover hardcoded crypto material.
日本語の概要は準備中です。原文の説明を表示しています。
Builds reusable malware configuration extractors by applying a declarative JSON spec (offsets, decode layers, field definitions) to a sample to produce structured, defanged config. Activates for requests to build a config extractor, write a reusable family config parser, or run a spec-driven configuration extraction.
日本語の概要は準備中です。原文の説明を表示しています。
Three.js interaction - raycasting, controls, mouse/touch input, object selection. Use when handling user input, implementing click detection, adding camera controls, or creating interactive 3D experiences.
日本語の概要は準備中です。原文の説明を表示しています。
After architecture is complete, produces a flat actionable rules sheet for programmers — what you must do, what you must never do, per system and per layer. Extracted from all Accepted ADRs, technical preferences, and engine reference docs. More immediately actionable than ADRs (which explain why).
日本語の概要は準備中です。原文の説明を表示しています。
Unity New Input System correctness patterns. Catches common mistakes with action reading (triggered vs IsPressed vs WasPressedThisFrame), action map switching, rebinding persistence, InputValue lifetime, PassThrough vs Value, local multiplayer device assignment, and control scheme auto-switching. PATTERN format: WHEN/WRONG/RIGHT/GOTCHA. Based on Unity 6.3 LTS.
日本語の概要は準備中です。原文の説明を表示しています。
Unity 6 Input System guide. Use when handling player input, controls, gamepad, keyboard, mouse, touch, or XR controllers. Covers the new Input System package (recommended), Input Actions, Action Maps, Control Schemes, PlayerInput component, and input debugging. Based on Unity 6.3 LTS documentation.
日本語の概要は準備中です。原文の説明を表示しています。
Unity NPC behavior design-to-code translation. Perception system architecture, decision layer patterns, action execution pipeline, faction & relationship systems, NPC memory & forgetting, crowd & squad coordination. DESIGN INTENT format: INTENT/WRONG/RIGHT/SCAFFOLD/DESIGN HOOK. Based on Unity 6.3 LTS.
日本語の概要は準備中です。原文の説明を表示しています。
Use when designing, implementing, or reviewing frontend interaction motion, page transitions, scroll animation, Framer Motion, GSAP, Lottie, CSS animation, motion intensity, animation performance, reduced-motion behavior, or cinematic but accessible UI motion. Do not use for SVG-only path drawing, Canvas/WebGL rendering, or ordinary hover states; Chinese triggers include motion design, interactive effects, page transitions, scroll animation, Framer Motion, GSAP.
日本語の概要は準備中です。原文の説明を表示しています。
Use when a task needs the judgment of an Equal Opportunity Representative or Officer — running an adverse-impact analysis on hiring or promotion selection rates, conducting an availability analysis to set affirmative action placement goals, evaluating a compensation-equity regression for unexplained pay gaps, or preparing an affirmative action plan (AAP) for an OFCCP audit.
日本語の概要は準備中です。原文の説明を表示しています。
Use when a task needs the judgment of an Aviation Inspector — determining whether an air carrier's fleet is in compliance with an Airworthiness Directive across a maintenance-records sample, deciding where the FAA's compliance-and-enforcement ladder places a finding (compliance action vs. Letter of Correction vs. civil penalty vs. certificate action), auditing a Safety Management System for a functioning safety-assurance loop rather than paperwork completeness, scoping a records-sampling strategy across a fleet under surveillance, or deciding whether to ground an aircraft pending an AD compliance finding.
日本語の概要は準備中です。原文の説明を表示しています。
Assess the scientific integrity and trustworthiness of publications before relying on their findings. Use this skill whenever evaluating a paper for a workflow, citing a study, building an analysis on published methods, or when a user asks about the reliability of a study. Checks for formal retractions, corrections, expressions of concern, and — critically — informal contradictions where subsequent studies failed to reproduce key findings. Integrates with PubMed, bioRxiv, and Consensus to provide a trust assessment. Use this skill for ANY publication evaluation, retraction checking, author reliability assessment, or when a user says "can I trust this paper", "is this study reliable", "has this been refuted", or "check this publication".
日本語の概要は準備中です。原文の説明を表示しています。
Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to "open a website", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction.
日本語の概要は準備中です。原文の説明を表示しています。