「credential」の検索結果

Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed CloudFront origin, public Lambda function URL, public RDS snapshot, IAM credentials in JS bundles, AWS metadata accessible via SSRF. GCP: public GCS buckets, exposed Cloud Run services, leaked service account JSON. Azure: public blob containers, exposed Function App. (Kubernetes/Docker exposure is owned by hunt-k8s; CI/CD pipeline attacks by hunt-cicd; post-credential IAM escalation by cloud-iam-deep.) Detection: targeted dorking, certificate transparency, JS bundle secret extraction, port scan for known service ports. Validate: actual data read / write / RCE. Use when hunting cloud-native storage and compute misconfig (S3/GCS/Blob, IMDS-via-SSRF, serverless, public managed services).

日本語の概要は準備中です。原文の説明を表示しています。

Post-setup credential manager. Shows current integration status (configured/missing/expired) and lets you update individual credentials without re-running the full setup wizard. Runs a smoke test after each update.

日本語の概要は準備中です。原文の説明を表示しています。

Instructions for handling API keys and credentials safely, verifying their presence, and prompting the user to add them if missing using a safe protocol.

日本語の概要は準備中です。原文の説明を表示しています。

Azure Identity library for Rust. Microsoft Entra ID authentication for all Azure SDK clients. Triggers: "azure identity rust", "DeveloperToolsCredential", "authentication rust", "managed identity rust", "credential rust", "Entra ID rust".

日本語の概要は準備中です。原文の説明を表示しています。

Configures EC2 instances to securely call AWS services by creating and attaching IAM roles via instance profiles, eliminating hardcoded credentials. Use when an EC2 instance needs permissions to access AWS services like S3, DynamoDB, SQS, or CloudWatch through temporary credentials.

日本語の概要は準備中です。原文の説明を表示しています。

Organization-grade cloud and supply-chain attack-surface discovery: S3/GCS/Azure Blob bucket discovery via observed-name mining (CNAME/cert-SAN/Wayback) and bounded two-class permutation (6 prefixes x 15 suffixes on trusted tokens, bounded target-bound expansion on subdomain stems), existence (HEAD/GET) vs public-listing confirmation, object-key triage into 9 value tiers (database dumps, credentials, IaC state, kubeconfig, VCS dirs, config, archives, PII, logs), dangling-CNAME bucket-takeover detection, and the ownership-gated severity model that stops an unattributable public bucket from becoming a false CRITICAL; the fully offline AWS-account-ID recovery from a leaked AKIA/ASIA/AROA access key (base32 decode, runnable stdlib Python, canonical test vector, AWS-documentation-example-ID screening); dependency-confusion confirmation for npm/PyPI (internal-signal classifier -- private-registry binding vs org-namespace match -- paired with a read-only public-registry 404 check and the npm scope-claimability nuance the public search API misses); and passive cloud-native/container/Kubernetes/CI control-plane fingerprinting (Lambda URLs, API Gateway, Cloud Run, App Service, kubelet/etcd/K8s API/dashboard, Jenkins/GitLab/Argo CD) as an org-attribution and exposure surface. Passive/discovery only -- no exploitation, no credential submission, no active control-plane confirmation (a stage-6 validate_cloud active tier is described but out of scope). Use when enumerating a target's cloud storage footprint, recovering an AWS account ID from a leaked key, confirming a supply-chain dependency-confusion vector, or fingerprinting cloud-native/K8s/CI infrastructure for an authorized external recon engagement.

日本語の概要は準備中です。原文の説明を表示しています。

Designs and audits who can reach what — authentication, authorization models, privileged access, service credentials, and joiner-mover-leaver process. Use this to design a permissions model, run an access review, reduce standing privilege, handle offboarding, set up SSO or MFA, manage service and machine credentials, or diagnose why permissions have sprawled.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user wants to provision infrastructure or third-party services using Stripe Projects. Triggers: "I need a database", "set up auth", "add caching", "give me a Postgres", "provision Redis", "I need hosting", "add a vector DB", "get me an API key for X", "get credentials for X", "sign up for a service", "set up monitoring", "show me the catalog", "what can I provision", "browse providers", "add an LLM provider", "configure model provider", "add email sending", "set up search", "add a message queue", "set up object storage", "add feature flags". Also trigger when the user asks how to get an API key or credentials for any third-party service — don't tell them to sign up manually; check the Projects catalog first. Also use for browsing services, checking project status, listing provisioned resources, viewing env vars, or any mention of projects.dev or adding/provisioning/connecting a cloud service.

日本語の概要は準備中です。原文の説明を表示しています。

Get foreign qualifications, degrees, or professional licenses recognised in a new country — figure out whether recognition is even needed, which body assesses it, what evidence they want, and the bridging route if there's a gap. Use when someone says 'get my degree recognised abroad', 'is my foreign license valid here', 'credential evaluation', or 'can I work as a [nurse/engineer/teacher] in [country] with my qualifications'. Produces a recognition roadmap, the assessing body, an evidence checklist, and the bridging options. Routes to official assessment bodies; requirements are country- and profession-specific.

日本語の概要は準備中です。原文の説明を表示しています。

Run the pre-flight checklist before an agent drives a browser — the untrusted-web-content threat (every page is attacker-controllable), the credential and session-cookie exposure, the action-confirmation gates for purchases and posts, and the sandboxing that limits the damage. Use when asked let my agent browse safely, is it safe to give the agent computer/browser use, guardrails before the agent uses my browser, or review my browser agent's setup. Produces the sandbox decision, the content-injection defenses, the action gates, and the credential-isolation rules.

日本語の概要は準備中です。原文の説明を表示しています。

Live SEO data via DataForSEO API credentials. SERP analysis (Google, Bing, Yahoo, YouTube, Google Images), keyword research (volume, difficulty, intent, trends), backlink profiles, on-page analysis (Lighthouse, content parsing), competitor analysis, content analysis, business listings, AI visibility (ChatGPT scraper, LLM mention tracking), and domain analytics. Uses DataForSEO credentials from the selected project `.env`; MCP tools are optional adapters when already available. Use when user says "dataforseo", "live SERP", "keyword volume", "backlink data", "competitor data", "AI visibility check", "LLM mentions", "image SERP", "google images", "image rankings", or "real search data".

日本語の概要は準備中です。原文の説明を表示しています。

Implement iOS authentication flows with AuthenticationServices and LocalAuthentication. Use when building Sign in with Apple, passkey/WebAuthn registration or sign-in with ASAuthorizationPlatformPublicKeyCredentialProvider, ASAuthorizationController credential state and revocation handling, ASWebAuthenticationSession OAuth or third-party login, Password AutoFill, identity-token server validation, or local biometric re-authentication with LAContext.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user wants to provision infrastructure or third-party services using Stripe Projects. Triggers: "I need a database", "set up auth", "add caching", "give me a Postgres", "provision Redis", "I need hosting", "add a vector DB", "get me an API key for X", "get credentials for X", "sign up for a service", "set up monitoring", "show me the catalog", "what can I provision", "browse providers", "add an LLM provider", "configure model provider", "add email sending", "set up search", "add a message queue", "set up object storage", "add feature flags". Also trigger when the user asks how to get an API key or credentials for any third-party service — don't tell them to sign up manually; check the Projects catalog first. Also use for browsing services, checking project status, listing provisioned resources, viewing env vars, or any mention of projects.dev or adding/provisioning/connecting a cloud service.

日本語の概要は準備中です。原文の説明を表示しています。

Finds secrets, tokens, passwords, and API keys that can leak through generated serialization: Python dataclass repr and asdict, attrs, pydantic model_dump, NamedTuple, JavaScript JSON.stringify and util.inspect, structured logs, tracing spans, and error reports. Use when asked to "check for secret serialization", "credential in repr", "repr=False audit", "secret in spans", "token in logs", or when a change adds a credential field to a dataclass, model, or config object, or adds code that stringifies whole objects or every kwarg into telemetry.

日本語の概要は準備中です。原文の説明を表示しています。

Implement Terraform provider ephemeral resources with the Plugin Framework: the Open/Renew/Close lifecycle, ephemeral schema design, registration via EphemeralResources, renewal for expiring credentials, and how ephemeral values flow into write-only attributes and provider configuration. Use when adding an ephemeral resource, exposing secrets/tokens/certificates that must never persist in state or plan, deciding between an ephemeral resource and a data source, or wiring short-lived credentials from one provider into another.

日本語の概要は準備中です。原文の説明を表示しています。

Switch the active credential profile to another client, validating keys first, approval-gated. "activate Acme's API keys"

日本語の概要は準備中です。原文の説明を表示しています。

Managing secrets (API keys, database credentials, certificates) with Vault, cloud providers, and Kubernetes. Use when storing sensitive data, rotating credentials, syncing secrets to Kubernetes, implementing dynamic secrets, or scanning code for leaked secrets.

日本語の概要は準備中です。原文の説明を表示しています。

Find leaked secrets in source code, Git history, build artifacts, and infrastructure — and audit the secrets-management posture preventing future leaks. Use when the user mentions 'secrets audit,' 'secret scanning,' 'leaked credentials,' 'API key in code,' 'gitleaks,' 'trufflehog,' 'git history scan,' 'secrets management,' 'vault audit,' 'rotation policy,' 'AWS Secrets Manager,' 'HashiCorp Vault,' 'Doppler,' '1Password Secrets Automation,' 'sealed-secrets,' 'External Secrets Operator,' or needs to find or prevent credential exposure.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user wants to provision infrastructure or third-party services using Stripe Projects. Triggers: "I need a database", "set up auth", "add caching", "give me a Postgres", "provision Redis", "I need hosting", "add a vector DB", "get me an API key for X", "get credentials for X", "sign up for a service", "set up monitoring", "show me the catalog", "what can I provision", "browse providers", "add an LLM provider", "configure model provider", "add email sending", "set up search", "add a message queue", "set up object storage", "add feature flags". Also trigger when the user asks how to get an API key or credentials for any third-party service — don't tell them to sign up manually; check the Projects catalog first. Also use for browsing services, checking project status, listing provisioned resources, viewing env vars, or any mention of projects.dev or adding/provisioning/connecting a cloud service.

日本語の概要は準備中です。原文の説明を表示しています。

AWS Bedrock AgentCore comprehensive expert for deploying and managing AI agents at scale. Use when working with any AgentCore service including Gateway, Runtime, Memory, Identity, Code Interpreter, Browser, Observability, Agent Registry, or Evaluations. Covers agent deployment, MCP tool integration, credential management, agent discovery, governance workflows, and automated quality assessment. Essential when user mentions AgentCore, agent runtime, agent registry, agent evaluation, MCP gateway, deploy agent, register MCP server, discover agents, evaluate agent quality, agent credentials, or wants to build, deploy, catalog, or monitor AI agents on AWS.

日本語の概要は準備中です。原文の説明を表示しています。

ai-agent-campの環境変数・認証情報を安全に管理するスキル。 「APIキーを設定」「.envを管理」「環境変数の設定」「credential managerを使いたい」「秘密情報の管理」等のリクエストで発動。

Google Cloud Platform (GCP) の Application Default Credentials 認証を実行するスキル。 「GCP認証して」「Google Cloud認証」「gcloud login」等のリクエストで発動。 BigQuery や Cloud Storage 等の GCP サービス利用前の認証手順をガイド。

Real-world Active Directory environment constraints that silently break attacks when ignored: NTLM disabled (Kerberos fallback), AES-only KDCs (RC4 blocked by GPO), LDAP signing and channel binding requiring LDAPS on 636, Kerberos clock skew (KRB_AP_ERR_SKEW), SPNs that must be FQDNs never short names or IPs (the misleading invalidCredentials), Protected Users / LAPS / gMSA / MachineAccountQuota, LDAP 1000-object paging, and VPN latency. Use this whenever a bind, TGT request, LDAP query, or SMB negotiation fails in a way that looks like bad credentials but is really hardening, or before running any AD tooling against a domain you have not fingerprinted. Standard-tooling knowledge (netexec, impacket, certipy, bloodyAD, kerbrute), no vendor-specific engine.

日本語の概要は準備中です。原文の説明を表示しています。

健身私教 — 为客户设计、指导和推进个性化训练方案的专业工艺, 有别于团课教练、物理治疗师或运动队教练: (a) 训练方案设计与周期化 (线性 / 波动 / 板块周期化 Bompa & Haff; NSCA《力量训练与体能训练精要》行业圣经; Schoenfeld 肌肥大机制; Helms/Valdez/Morgan 肌肉与力量金字塔; 共轭训练法 Simmons/Westside; Starting Strength 线性渐进 Rippetoe; Renaissance Periodization 训练量地标 Israetel); (b) 动作评估与筛查 (FMS 功能性动作筛查 Gray Cook; NASM CEx 纠正性训练连续体 抑制-拉伸-激活-整合; 关节逐级方法 Cook/Boyle; 姿势与代偿模式识别; PAR-Q+ 与 ACSM 运动前筛查指南); (c) 教学与指令 (外部 vs 内部注意焦点 Wulf; 差异化学习 Schöllhorn; 约束导向方法 Davids/Renshaw; RIR/RPE 自动调节 Zourdos/Helms; 动机访谈在健身中的应用 Rollnick/Miller); (d) 营养指导的执业边界 (宏量营养素周期化; Precision Nutrition / ISSN 立场声明的循证建议; 边界: 私教提供一般性指导, 医学营养治疗需 RD/RDN 资质; 能量可用性与 RED-S Mountjoy IOC 共识); (e) 商业与客户管理 (客户留存与方案依从; 咨询与销售伦理; 线上教练平台与规模化 Goodman PTDC; 方案交付工具 TrueCoach/Trainerize/TrainHeroic; 课时定价模型; 独立教练 vs 健身房雇员); (f) 专项方向 (运动表现 CSCS; 纠正性训练 CES; 老年健身 SFN; 产前产后; 青少年 YSCA; 适应性 / 无障碍健身; 健美 / 形体; 力量举; 耐力运动 S&C)。诚实处理: 兄弟科学 vs 循证之争, 补剂行业利益冲突, 合成代谢激素使用现状 (诚实但不推广: 匿名调查约 30% 有经验男性健身者使用过 — 业内估, Kanayama/Pope/Hudson 记录健康风险, WADA 禁用清单用于竞技语境), 体型焦虑与进食障碍风险 (男性私教肌肉变形症, 正食症倾向, NEDA 负责任语言指南), 健身房掠夺性销售 (高压推销、误导性对比照、长约锁定), 执业边界违规 (私教诊断伤病或超范围开饮食处方), 线上教练认证造假 (周末速成、未经认可的认证)。不含: 物理治疗 / 康复治疗 (持照医疗职业), 不含: 团课教练 (Les Mills/Zumba/CrossFit 分馆教练 — 相邻但不同), 不含: 精英竞技运动教练 (团队项目周期化, 不同职业路径), 不含: 营养作为主业 (临床营养学需单独资质)。 (Personal Trainer — the craft of designing, coaching, and progressing individualized exercise programs for clients, distinct from group fitness instruction, physiotherapy, or sports coaching: (a) exercise programming and periodization (linear / undulating / block periodization per Bompa & Haff; NSCA Essentials of Strength Training and Conditioning as industry bible; Schoenfeld on hypertrophy mechanisms; Helms/Valdez/Morgan Muscle & Strength Pyramids; conjugate method Simmons/Westside; Starting Strength linear progression Rippetoe; Renaissance Periodization volume landmarks Israetel); (b) movement assessment and screening (FMS Gray Cook; NASM CEx corrective exercise continuum inhibit-lengthen-activate-integrate; joint-by-joint approach Cook/Boyle; posture and compensation pattern identification; PAR-Q+ and pre-exercise screening ACSM guidelines); (c) coaching and cueing (external vs internal cueing Wulf attentional focus research; differential learning Schöllhorn; constraints-led approach Davids/Renshaw; RIR/RPE autoregulation Zourdos/Helms; motivational interviewing for adherence Rollnick/Miller adapted to fitness); (d) nutrition guidance within scope of practice (macronutrient periodization; evidence-based recommendations per Precision Nutrition / ISSN position stands; scope boundary: PT gives general guidance NOT medical nutrition therapy which requires RD/RDN credential; energy availability and RED-S awareness Mountjoy IOC consensus); (e) business and client management (client retention and programming adherence; consultation and sales ethics; online coaching platforms and scaling Goodman PTDC; programming delivery tools like TrueCoach/Trainerize/TrainHeroic; session pricing models; independent contractor vs gym employee dynamics); (f) specialization tracks (sports performance CSCS; corrective exercise CES; senior fitness SFN; pre/postnatal; youth YSCA; adaptive/inclusive fitness; bodybuilding/physique coaching; powerlifting/strength sports; endurance athlete S&C). Evidence-based practice as the core ethos: Schoenfeld/Krieger meta-analyses on volume-response, Helms systematic reviews on protein/resistance training, Brad Schoenfeld's MASS journal bridging research to practice, Menno Henselmans and Eric Helms as practitioner-researchers, Greg Nuckols Stronger By Science as translation layer. Chinese fitness industry context: rapid growth of personal training in commercial gyms (Keep/Lefit/Megafit chains), NSCA-CPT and ACE-CPT as dominant certifications alongside local CSFA (China Sport and Fitness Association) credential, '体适能' (physical fitness) as formal term, online coaching boom post-COVID, PT business models in tier 1-3 cities diverge sharply. Honest treatment of: bro science vs evidence-based d

日本語の概要は準備中です。原文の説明を表示しています。