XSS playbook. Use when user-controlled content reaches HTML, attributes, JavaScript, DOM sinks, uploads, or multi-context rendering paths.
日本語の概要は準備中です。原文の説明を表示しています。
3,968 件 ・ 関連度順
概要と使いどころ
XSS playbook. Use when user-controlled content reaches HTML, attributes, JavaScript, DOM sinks, uploads, or multi-context rendering paths.
日本語の概要は準備中です。原文の説明を表示しています。
SQL injection playbook. Use when input reaches SQL queries, authentication logic, sorting, filtering, reporting, or DB-specific blind and out-of-band execution paths.
日本語の概要は準備中です。原文の説明を表示しています。
JNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code path reaching InitialContext.lookup().
日本語の概要は準備中です。原文の説明を表示しています。
Command injection playbook. Use when user input may reach shell commands, process execution, converters, import pipelines, or blind out-of-band command sinks.
日本語の概要は準備中です。原文の説明を表示しています。
CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content.
日本語の概要は準備中です。原文の説明を表示しています。
Guided journey from a live website that underperforms to a prioritized, evidence-backed backlog of conversion, usability, message, and speed fixes - each shipped as a testable experiment. Orchestrates eight skills phase by phase - cro-methodology, ux-heuristics, refactoring-ui, web-typography, storybrand-messaging, high-perf-browser, made-to-stick, design-everyday-things - asking the user questions at every decision point and recording results in the project docs/ folder (WEBSITE.md, DESIGN.md, IMPROVE-WEBSITE-PLAN.md) so the journey resumes across sessions. Use when the user wants to fix a landing page that isn't converting, diagnose why visitors leave, audit for clarity and usability, or says 'the homepage feels off but a redesign didn't help'. No site yet, create-website; converts but needs traffic, grow-website; if the friction is in a product app, not the marketing site, improve-app; if one specific flow leaks, conversion-optimization. For one framework in isolation, invoke that skill directly.
日本語の概要は準備中です。原文の説明を表示しています。
Guided journey from a leaking conversion flow - landing page, signup, checkout, or in-app onboarding - to a measured, tested funnel. Orchestrates six skills phase by phase - lean-analytics, cro-methodology, storybrand-messaging, hundred-million-offers, influence-psychology, design-everyday-things - each phase carries its full method inline so it runs standalone, asking the user questions at every decision point and recording results in the project docs/ folder (FUNNEL.md, METRICS.md, EXPERIMENTS.md, CONVERSION-OPTIMIZATION-PLAN.md) so the journey resumes across sessions. Use when the user wants to raise conversion on a specific flow, fix checkout or signup abandonment, diagnose onboarding drop-off, or says 'people start but never finish'. With no site yet, use create-website; for a whole-site look, message, and speed audit, improve-website; if the flow converts but needs traffic, grow-website; for in-product engagement and retention, improve-app. For one framework in isolation, invoke that skill directly.
日本語の概要は準備中です。原文の説明を表示しています。
Guided journey from raw idea to a validated, positioned, priced business with a chosen beachhead. Orchestrates ten skills phase by phase - jobs-to-be-done, mom-test, design-sprint, lean-startup, good-strategy-bad-strategy, blue-ocean-strategy, obviously-awesome, hundred-million-offers, monetizing-innovation, crossing-the-chasm - asking the user questions at every decision point and recording results in the project docs/ folder (CUSTOMER.md, POSITIONING.md, OFFER.md, CREATE-BUSINESS-PLAN.md) so the journey resumes across sessions. Use when the user wants to start a new business, validate a startup idea, find product-market fit before building, or says 'I have an idea for a company'. Do not use once the business has paying customers: use grow-business to add revenue and customers, or improve-business to fix strategy and operations. For building the product itself use create-app or create-website. For one framework in isolation, invoke that skill directly.
日本語の概要は準備中です。原文の説明を表示しています。
Apply the seven principles of ethical persuasion (reciprocity, commitment, social proof, authority, liking, scarcity, unity) to product design, copy, and sales. Use when the user mentions "social proof", "persuasive copy", "why users dont convert", "ethical persuasion", "reciprocity", "scarcity tactics", "commitment and consistency", "shared identity", "in-group", "make my copy more persuasive", "increase trust", or "get more people to say yes". Also trigger when designing testimonial sections, crafting urgency messaging, or improving trust signals on landing pages. Covers the principles, when each applies, and ethical limits. For deal negotiation tactics, see negotiation. For viral word-of-mouth, see contagious.
日本語の概要は準備中です。原文の説明を表示しています。
Navigate the technology adoption lifecycle from early adopters to mainstream market. Use when the user mentions "crossing the chasm", "beachhead segment", "whole product", "early adopters vs mainstream", "tech go-to-market", "bowling pin strategy", "technology adoption lifecycle", "pragmatist buyers", "growth stalled after early adopters", or "our go-to-market plan". Also trigger when planning go-to-market for a technical product. Covers the D-Day analogy, bowling-pin strategy, the tornado, and positioning against incumbents. For product positioning, see obviously-awesome. For new market creation, see blue-ocean-strategy.
日本語の概要は準備中です。原文の説明を表示しています。
Break down each shot and turn the analysis into a storyboard reference. Use when the user wants shot-by-shot film analysis, director logic, cinematography breakdown, or a storyboard-style reference from a video.
日本語の概要は準備中です。原文の説明を表示しています。
Delegate a coding task to Aider (`aider`) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to hand implementation work to Aider - phrasings like "have Aider do X", "delegate this to aider", "run it through Aider", or "use Aider to implement/fix/refactor" - or wants to run a queue of coding tasks through Aider while staying the reviewer. This includes asking Aider to drive a local or self-hosted OpenAI-compatible endpoint ("have Aider use my local model", "run Aider against llama.cpp / Ollama / vLLM / LM Studio"), which Aider reaches via `--api-base`. DO NOT USE for local-model or coding requests that do not name Aider, for tasks small enough to do inline, or when the user wants the code written directly without delegating.
日本語の概要は準備中です。原文の説明を表示しています。
Repurpose blog posts for social media, email, video, podcast, and community channels. Generates Twitter/X threads, LinkedIn posts and articles, Threads, Bluesky, TikTok, Instagram, YouTube Shorts and long-form scripts, Reddit, newsletter, podcast, Discord, and Slack variants. Adapts tone for each platform. Use when user says "repurpose", "blog repurpose", "share blog", "social media", "twitter thread", "linkedin post", "youtube script", "reddit post".
日本語の概要は準備中です。原文の説明を表示しています。
Read research outline, launch independent agent for each item for deep research. Disable task output.
日本語の概要は準備中です。原文の説明を表示しています。
Migrate a whole ArcGIS Hub site into a PortalJS Arc portal end-to-end. Harvests the Hub /data.json (DCAT-US) inventory, exports every FeatureService layer through the ArcGIS REST query API with resultOffset paging, converts each to the serverless dual tier (PMTiles render + GeoParquet query) with tabular items to Parquet, pushes everything to Cloudflare R2 via Git LFS, appends dual-tier datasets.json entries, and writes a source-vs-derived parity report. Use to move a City or sector ArcGIS Hub open-data portal onto PortalJS with no server-side compute.
日本語の概要は準備中です。原文の説明を表示しています。
Ensures configuration and code changes are released correctly. Use PROACTIVELY whenever you edit config.json, change any setting, or fix a configuration bug in this project, so the change reaches production.
日本語の概要は準備中です。原文の説明を表示しています。
Verify a WordPress plugin's Abilities API registrations: enumerate abilities, check that callback behavior matches each annotation's claim (the adversarial readonly-but-writes detection), validate permissions and schemas, and validate audit documents produced by wp-abilities-audit.
日本語の概要は準備中です。原文の説明を表示しています。
When the user wants to plan, brief, source, or measure organic creator / influencer / UGC marketing for their app — including TikTok creators, Instagram Reels, YouTube Shorts, micro-influencers, paid creator briefs, UGC ad creative for Meta/TikTok, affiliate programs, and seeding strategy. Use when the user mentions "creators", "influencers", "TikTok marketing", "UGC", "user-generated content", "creator briefs", "creator outreach", "influencer marketing", "Reels", "Shorts", "creator gifting", "seeding", "affiliate", "Whop", "TikTok Spark Ads", "Instagram collab posts", or "I want my app to go viral on TikTok". For paid social ad campaigns (Meta/TikTok ad accounts), see ua-campaign. For PR / press, see press-and-pr. For viral in-app loops, see referral-program.
日本語の概要は準備中です。原文の説明を表示しています。
Add file-based observability, tracing, and run analysis to LLM/agent experiments — per-turn transcripts, tool calls and results, reasoning traces, token/cost accounting, per-episode artifacts, plus terminal viewers and a run-comparison report. Platform-agnostic: one small adapter covers OpenAI, Gemini/Vertex, Anthropic, LiteLLM, Tinker, vLLM, or any custom inference stack, and the same tooling then works unchanged. Use this skill whenever the user wants observability, tracing, logging, or run tracking for model experiments; asks why an agent failed a task or wants to replay/debug/diff an episode; wants to compare models, arms, or ablations; wants to instrument a new folder, repo, or platform ("add observability here", "do the same for Tinker/Gemini/OpenAI"); wants to import or tie in existing experiment results so old runs show up alongside new ones; or wants eval runner scripts where many models share one protocol. Reach for this even when they only say "log what the model is doing", "I can't tell what happened in this run", or "set up traces for this experiment".
日本語の概要は準備中です。原文の説明を表示しています。
Train and run models on Tinker (Thinking Machines) — LoRA and full fine-tuning, SFT with correct loss masking, RL/RFT with group-relative advantages and importance sampling, agentic RL over multi-turn tool-using agents, inference via the SamplingClient or the OpenAI-compatible endpoint, checkpoint management and export, every hyperparameter, and cost estimation from the live price table. Use this skill whenever the user mentions Tinker, tinker://, TINKER_API_KEY, console.tinker.ai, or the tinker CLI; wants to fine-tune, SFT, RFT, or RL a model on Tinker; asks about Tinker models, context windows, LoRA rank, sampling params, loss functions (cross_entropy, importance_sampling, ppo, cispo, dro), Datum construction, forward_backward or optim_step; wants to sample from, download, resume, merge, or export a Tinker checkpoint; or asks what a Tinker run will cost. Whenever Tinker work is initialized in a project, this skill also creates a TINKER_PRICING.md there so prices sit next to the training code. Reach for it even on vague asks like "train a model on this data" or "get inference working" when Tinker is the platform in play.
日本語の概要は準備中です。原文の説明を表示しています。
Standards and audits for writing academic papers, especially ML/NLP submissions to NeurIPS, ICML, ICLR, ACL, EMNLP, NAACL. Covers the author's house prose rules (zero em dashes, zero fluff, every sentence earns its place), verification of hallucinated claims and hallucinated or malformed bibliography entries, the ACL policy on AI writing assistance and what must be disclosed, and best practices for paper structure, experiments, reproducibility checklists, and rebuttals. Use this skill whenever the user is drafting, editing, polishing, restructuring, or reviewing a paper, abstract, intro, related work, rebuttal, or camera-ready; whenever they ask to "clean up" or "tighten" academic writing; whenever citations or a .bib file need checking; and whenever they ask what has to be disclosed about AI assistance. Reach for it even when the user only says "make this section better", "check my references", or "is this ready to submit".
日本語の概要は準備中です。原文の説明を表示しています。
Write and distribute launch and publicity content across LinkedIn, X/Twitter, Instagram, Discord, Medium, Substack, and YouTube. Produces per-platform copy that does not read as AI-written (no em dashes, no "thrilled to announce", no engagement-bait), plus the exact image/video specs and character limits each platform wants. Use this skill whenever the user wants to announce, launch, publicize, promote, cross-post, or share anything - a product, a feature, an open-source release, a research paper, a blog post, a demo video, a milestone, a job opening, or a conference talk. Trigger it on phrases like "post this on LinkedIn", "write a launch tweet", "announce this", "share this in Discord", "turn this into a thread", "what should I post", "write a Medium article about", "help me with distribution", "draft a YouTube description", "make this sound less like AI", or "de-slop this post". Also use it when the user has just finished shipping something and asks how to get it in front of people.
日本語の概要は準備中です。原文の説明を表示しています。
Build, run, debug and ship 3D city games in Godot 4 — procedurally generated cities (block grids, districts, weighted building typologies, MultiMesh batching, facade shaders, terrain, day/night, landmarks), first-person controllers, headless verification, Blender-generated .glb assets, rigged character and animation packs, real OpenStreetMap-derived cities, WebAssembly export, and cloud GPU streaming on GCP. Use this skill whenever the work involves Godot or a .gd/.tscn/.gdshader/project.godot file; whenever someone wants to start, set up, clone onto a new machine, or stand up a 3D game or city generator; whenever they mention procedural city, city generator, block grid, building typology, MultiMesh, facade shader, terrain heightmap, navmesh, Godot export templates, export presets, headless Godot, .glb pipeline, Blender asset generation, character rigs or borrowed animations; and whenever they want to deploy or share a game — web export, SharedArrayBuffer/COOP/COEP, Selkies, pixel streaming, GPU VM, or "let people play this without installing anything." Reach for it even on vague asks like "get this running", "why is my city slow", "my model faces backwards", "make it work on a cloud machine", or "set this up somewhere else too" when a Godot 3D project is in play.
日本語の概要は準備中です。原文の説明を表示しています。
One person, one look, a handful of places. A head-to-toe appearance lock carries the whole clip, and each scene gets one location, one gesture and one kind of light. Use when the user wants a Seedance 2.5 / 2.0 video prompt for this kind of clip (Fashion lookbook and portrait film; 中文触发词: 时尚 lookbook 与人像写真片, 时尚, 穿搭, 人像, 写真), or asks how published cases of this type were prompted. Read references/cases.md before drafting.
日本語の概要は準備中です。原文の説明を表示しています。