1.5万 件 ・ 関連度順
概要と使いどころ
Perform repository-aware code reviews focused on bugs, regressions, architectural violations, missing tests, and operational risks. Use when the user asks for review of diffs, pull requests, patches, or implementation quality.
日本語の概要は準備中です。原文の説明を表示しています。
Plan and sequence complex implementation work into deterministic, testable steps. Use when the user asks for planning, roadmap breakdown, execution strategy, effort estimation, or multi-step delivery coordination across domains.
日本語の概要は準備中です。原文の説明を表示しています。
Git commit, branch, and pull request conventions for create-vue-dsfr. Use before creating commits, branches, issues, or PRs. This skill has priority over other project skills for commit and PR work.
日本語の概要は準備中です。原文の説明を表示しています。
Git commit and pull request conventions. USE FOR: writing commit messages; checking Conventional Commits and gitmoji; branch naming; rebase workflow on develop; PR titles and target branch. PRIORITY: this skill overrides other rules when creating commits/PRs. DO NOT USE FOR: code implementation (use code-implementation skill); testing (use test-writing skill); general documentation (use documentation skill).
日本語の概要は準備中です。原文の説明を表示しています。
Remove a future phase from roadmap and renumber subsequent phases
日本語の概要は準備中です。原文の説明を表示しています。
Request cross-AI peer review of phase plans from external AI CLIs
日本語の概要は準備中です。原文の説明を表示しています。
Build, query, and inspect the project knowledge graph in .planning/graphs/
日本語の概要は準備中です。原文の説明を表示しています。
Query, inspect, or refresh codebase intelligence files in .planning/intel/
日本語の概要は準備中です。原文の説明を表示しています。
Discover and exploit mass assignment vulnerabilities in REST APIs to escalate privileges, modify restricted fields, and bypass authorization controls by injecting unexpected parameters in API requests.
日本語の概要は準備中です。原文の説明を表示しています。
Tests and exploits deep link (URL scheme and App Link) vulnerabilities in Android and iOS mobile applications to identify unauthorized access, data injection, intent hijacking, and redirect manipulation. Use when assessing mobile app attack surface through custom URI schemes, Android App Links, iOS Universal Links, or intent-based navigation. Activates for requests involving deep link security testing, URL scheme exploitation, mobile intent abuse, or link hijacking.
日本語の概要は準備中です。原文の説明を表示しています。
Tests APIs for excessive data exposure where endpoints return more data than the client application needs, relying on the frontend to filter sensitive fields. The tester intercepts API responses and analyzes them for leaked PII, internal identifiers, debug information, or sensitive business data that the UI does not display but the API transmits. This maps to OWASP API3:2023 Broken Object Property Level Authorization. Activates for requests involving API data leakage testing, excessive data exposure, response filtering bypass, or API over-fetching.
日本語の概要は準備中です。原文の説明を表示しています。
Executes comprehensive red team exercises that simulate real-world adversary operations against an organization's people, processes, and technology. The red team operates with stealth as a primary objective, employing the full attack lifecycle from initial reconnaissance through objective completion while testing the organization's detection and response capabilities. This differs from penetration testing by focusing on adversary emulation rather than vulnerability identification. Activates for requests involving red team exercise, adversary simulation, adversary emulation, or full-scope offensive security assessment.
日本語の概要は準備中です。原文の説明を表示しています。
Executes authorized phishing simulation campaigns to assess an organization's susceptibility to email-based social engineering attacks. The tester designs realistic phishing scenarios, builds credential harvesting infrastructure, sends targeted phishing emails, and tracks open rates, click-through rates, and credential submission rates to measure human security awareness. Activates for requests involving phishing simulation, social engineering assessment, email security testing, or security awareness measurement.
日本語の概要は準備中です。原文の説明を表示しています。
Identifies and exploits insecure local data storage vulnerabilities in Android and iOS mobile applications including unencrypted databases, world-readable files, insecure SharedPreferences, plaintext credential storage, and improper keychain/keystore usage. Use when performing mobile penetration testing focused on OWASP M9 (Insecure Data Storage) or assessing compliance with MASVS-STORAGE requirements. Activates for requests involving mobile data storage security, local storage exploitation, SharedPreferences analysis, or mobile data leakage assessment.
日本語の概要は準備中です。原文の説明を表示しています。
Executes authorized attack simulations against Active Directory environments to identify misconfigurations, weak credentials, dangerous privilege paths, and exploitable trust relationships that could lead to domain compromise. The tester uses BloodHound for attack path analysis, Mimikatz for credential extraction, and Impacket for protocol-level attacks including Kerberoasting, AS-REP Roasting, and delegation abuse. Activates for requests involving Active Directory pentest, AD attack simulation, domain compromise testing, or Kerberos attack assessment.
日本語の概要は準備中です。原文の説明を表示しています。
Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst interface, and total cost of ownership. Use when conducting a TIP procurement, migrating between TIP solutions, or assessing whether the current TIP meets program maturity requirements. Activates for requests involving ThreatConnect, MISP, OpenCTI, Anomali, EclecticIQ, or TIP procurement decisions.
日本語の概要は準備中です。原文の説明を表示しています。
Exploits JWT algorithm confusion vulnerabilities where the server's token verification library accepts the algorithm specified in the JWT header rather than enforcing a fixed algorithm. The tester manipulates the alg header to switch from RS256 to HS256 (using the RSA public key as the HMAC secret), sets alg to none to bypass signature verification, or exploits kid/jku/x5u header injection to supply attacker-controlled keys. Activates for requests involving JWT algorithm confusion, alg none attack, key confusion attack, or JWT signature bypass.
日本語の概要は準備中です。原文の説明を表示しています。
Detect unauthorized SaaS and cloud service usage (shadow IT) by analyzing proxy logs, DNS query logs, and netflow data using Python pandas for traffic pattern analysis and domain classification.
日本語の概要は準備中です。原文の説明を表示しています。
Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit misconfigured Active Directory Certificate Services (AD CS) ESC1 vulnerability to request certificates as high-privileged users and escalate domain privileges during authorized red team assessments.
日本語の概要は準備中です。原文の説明を表示しています。
Detect process injection techniques (T1055) including classic DLL injection, process hollowing, and APC injection by analyzing Sysmon events for cross-process memory operations, remote thread creation, and anomalous DLL loading patterns.
日本語の概要は準備中です。原文の説明を表示しています。
Detect and exploit race condition vulnerabilities in web applications using Turbo Intruder's single-packet attack technique to bypass rate limits, duplicate transactions, and exploit time-of-check-to-time-of-use flaws.
日本語の概要は準備中です。原文の説明を表示しています。
Identifying and exploiting SSRF vulnerabilities to access internal services, cloud metadata, and restricted network resources during authorized penetration tests.
日本語の概要は準備中です。原文の説明を表示しています。
Identifying and exploiting Insecure Direct Object Reference vulnerabilities to access unauthorized resources by manipulating object identifiers in API requests and URLs.
日本語の概要は準備中です。原文の説明を表示しています。