222 件 ・ 関連度順
概要と使いどころ
Exploit modern Windows environments that prefer IPv6 by using mitm6 to intercept and spoof DHCPv6 and DNS traffic. This skill covers how to poison DNS resolution for the local network, forcing NTLM authentication to a rogue server for credential capture or relay.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit GraphQL API vulnerabilities by leveraging Introspection queries to dump the entire database schema, performing query batching to bypass rate limits (brute forcing), and extracting deeply nested unauthorized data via graph relationship abuse.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit Cross-Origin Resource Sharing (CORS) misconfigurations. Use this skill when auditing APIs or web applications that share sensitive data across domains, forcing victims' browsers to inadvertently leak private information (e.g., API keys, PII, CSRF tokens) to an attacker-controlled website.
日本語の概要は準備中です。原文の説明を表示しています。
Application-level business logic security testing for any domain. Takes an understanding-first approach: map the intended workflows before probing them. Covers: value/quantity logic abuse (negative, zero, overflow, rounding on any numeric field), workflow and state machine bypass (skipping required steps, forcing illegal state transitions, reusing one-time tokens), trust boundary violations (BOLA horizontal/vertical, BFLA, cross-tenant access, negative ownership attacks), idempotency and replay attacks (duplicate submissions, double-spend, same-reference reuse), multi-step flow integrity (checkout, registration, approval, verification), quota and rate limit bypass, time/date manipulation, and authorization code / reference number predictability. Domain-agnostic — applies to SaaS, e-commerce, banking, gaming, social platforms, APIs, or any multi-user application with stateful workflows. Chains from /pentester; chains into /param-fuzz when boundary violations or mass assignment are confirmed.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit flaws in API rate limiting enforcement. Use this skill when encountering HTTP 429 Too Many Requests errors during password brute-forcing, OTP validation, credential stuffing, or enumeration attacks. These bypasses leverage IP spoofing, parameter manipulation, and edge-case application logic.
日本語の概要は準備中です。原文の説明を表示しています。
Coordinate a Pharos stablecoin addition or pre-launch promotion by enforcing pre-edit runtime admission, routing specialist research and authorized edits, and owning the integrated generation/check handoff.
日本語の概要は準備中です。原文の説明を表示しています。
Uses symbolic execution (angr) to solve constraint-based malware problems — finding inputs that reach a target branch, recovering keys/passwords from a check routine, and brute-forcing opaque predicates — by generating a ready-to-edit angr harness. Activates for requests to use symbolic execution, solve a malware unlock check with angr, or recover an input that reaches a code path.
日本語の概要は準備中です。原文の説明を表示しています。
Resolves dynamically hashed Windows API names by brute-forcing observed hash constants against a wordlist of API/DLL names using common malware hashing algorithms (ROR13, djb2, FNV, CRC32). Activates for requests to resolve API hashes, identify hashed imports, or reverse an API hashing routine.
日本語の概要は準備中です。原文の説明を表示しています。
Use when a task needs the judgment of a Data Engineer — designing an idempotent pipeline operation so retries and backfills don't corrupt data, choosing event-time over processing-time partitioning for time-series aggregation, enforcing schema compatibility rules before an upstream change propagates downstream, adding automated data quality checks to a pipeline, or deciding between batch and streaming architecture for a specific freshness requirement.
日本語の概要は準備中です。原文の説明を表示しています。
Spring Modulith 2.0 implementation for bounded contexts in Spring Boot 4. Use when structuring application modules, implementing @ApplicationModuleListener for event-driven communication, testing with Scenario API, enforcing module boundaries, externalizing events to Kafka/AMQP, building a modular monolith, defining module dependencies, managing inter-module events, or organizing DDD modules as packages. Covers package-based module boundaries, named interfaces, event publication, and Scenario API testing. For architecture decisions, see domain-driven-design skill.
日本語の概要は準備中です。原文の説明を表示しています。
Validate markdown files against formatting standards. Auto-detects and installs markdownlint-cli if missing. Checks project config or falls back to sensible defaults. Supports auto-fix mode. Use when creating or modifying markdown files, validating documentation, or enforcing markdown conventions.
日本語の概要は準備中です。原文の説明を表示しています。
Validate commit messages against the Conventional Commits specification. Auto-detects and installs commitlint CLI if missing. Checks project config or falls back to sensible defaults. Use when validating commit messages, preparing PRs, or enforcing commit conventions.
日本語の概要は準備中です。原文の説明を表示しています。
Stages and commits the current changes onto a safe working branch, enforcing branch discipline and optionally pushing upstream. TRIGGER when: the user wants to commit, save, or check in the current changes. DO NOT TRIGGER when: opening a pull request → pr.
日本語の概要は準備中です。原文の説明を表示しています。
Scope a milestone to a fixed time window with variable scope. Use when the user says "scope this milestone", "what fits in the sprint", "cut scope for the release", "define the MVP for this milestone", "we need to ship by [date] what do we cut", "shape the work to fit the cycle", or needs to make hard scope decisions under a time constraint - even if they don't explicitly say "milestone scoping". Based on "Shape Up" by Ryan Singer (appetite, shaping, betting table) and "The Art of Project Management" by Scott Berkun (milestones as forcing functions, scope as a variable).
日本語の概要は準備中です。原文の説明を表示しています。
Email consent management in Marketing Cloud: configuring Subscription Centers, building Preference Centers on CloudPages, enforcing CAN-SPAM and GDPR requirements, and handling opt-out propagation. Trigger keywords: unsubscribe handling, CAN-SPAM compliance, GDPR consent tracking, publication lists, subscription center, preference center, opt-out, double opt-in, Privacy Center, MC consent. NOT for subscriber key and suppression lists — use data/subscriber-data-management. NOT for the CRM consent data model or MC-to-CRM sync — use architect/marketing-consent-architecture.
日本語の概要は準備中です。原文の説明を表示しています。
Detects feature patterns that require a higher age rating than commonly submitted, enforcing Guideline 2.3.6 which requires age ratings to accurately reflect the app's content and social features.
日本語の概要は準備中です。原文の説明を表示しています。
Detects apps that abuse iOS background execution modes — particularly silent audio used to keep the app alive, location background mode used for non-navigation purposes, and background task implementations that do excessive work — enforcing Guideline 2.5.4.
日本語の概要は準備中です。原文の説明を表示しています。
Detects screenshot submission issues including launch-screen-only assets and cross-platform UI references, enforcing Guideline 2.3.3 which requires screenshots to show the app in actual use.
日本語の概要は準備中です。原文の説明を表示しています。
Detects usage of private Apple APIs, undocumented frameworks, and runtime introspection patterns that bypass the public SDK, enforcing Guideline 2.5.1. Private API usage causes automated binary rejection at upload.
日本語の概要は準備中です。原文の説明を表示しています。
Detects mismatches between features claimed in App Store metadata and features actually implemented in the codebase, enforcing Guideline 2.3.1 which prohibits misleading app descriptions.
日本語の概要は準備中です。原文の説明を表示しています。
Detects loot box, gacha, and randomized reward purchase mechanics that lack odds disclosure before purchase, enforcing Guideline 3.1.1's requirement to disclose item drop rates.
日本語の概要は準備中です。原文の説明を表示しています。
Detects apps built with outdated Xcode SDKs or deprecated iOS deployment targets, enforcing Guideline 2.5.10 which requires apps to be built with the current SDK from Xcode.
日本語の概要は準備中です。原文の説明を表示しています。
Detects data collection patterns that exceed what is necessary for the app's stated functionality, enforcing Guideline 5.1.1(iii) data minimization requirements.
日本語の概要は準備中です。原文の説明を表示しています。
Detects analytics or tracking SDKs present without the required App Tracking Transparency prompt, enforcing Guideline 5.1.2(i) which requires user consent before any cross-app or cross-site tracking.
日本語の概要は準備中です。原文の説明を表示しています。