2,249 件 ・ 関連度順
概要と使いどころ
Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, HTTP/2 single-packet attacks, and CWE-362-style synchronization gaps.
日本語の概要は準備中です。原文の説明を表示しています。
SQL injection occurs when untrusted user input is interpolated directly into database queries, allowing attackers to alter query logic. Detect via single-quote errors, boolean-based blind responses (AND 1=1 vs AND 1=2), time-delay payloads (SLEEP, WAITFOR), UNION column enumeration, and error messages from MySQL, Oracle, MSSQL, PostgreSQL. Tools: sqlmap, sqlbftools, Burp Suite, wfuzz with SQLi fuzz strings.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit GraphQL API architectural features to execute highly efficient brute-force, Credential Stuffing, and Denial of Service (DoS) attacks. Utilize Query Batching and Alias injection to bypass rate limits by packing thousands of requests into a single HTTP POST request.
日本語の概要は準備中です。原文の説明を表示しています。
Audit and attack session cookies via missing Secure/HttpOnly/SameSite attributes, overly broad Domain/Path scope, non-expiring persistent cookies, absent __Host- and __Secure- prefixes, browser cache leakage (Cache-Control: no-store missing), session token predictability via Burp Sequencer analysis, server-side session not invalidated on logout, and SSO single-logout bypass. Tools: Burp Suite Repeater/Sequencer, OWASP ZAP, EditThisCookie, Tamper Data, Cookiebro.
日本語の概要は準備中です。原文の説明を表示しています。
AI/LLM red-team assessment using the OWASP LLM Top 10 (2025) + OWASP AI Testing Guide (AITG v1, Nov 2025) frameworks, plus OWASP MCP Top 10 runtime testing for agentic/MCP targets. Tests prompt injection, jailbreaks, system prompt leakage, sensitive data extraction, excessive agency, improper output handling, model extraction, content bias, evasion, membership inference, MCP token exposure, MCP command injection, and more. Uses four tools in combination: FuzzyAI (single-turn jailbreak fuzzing), PyRIT (multi-turn orchestrated attacks), Garak (probe-based vulnerability scanning), and promptfoo (plugin-based red-team evaluation). Each tool covers different OWASP categories; running them together gives systematic coverage. Includes a conditional MCP reconnaissance phase and a post-access AI infrastructure phase (chained from /post-exploit). Produces: OWASP LLM Top 10 + AITG + MCP coverage matrix, findings per category, architecture diagram of the AI system, PoCs for confirmed exploits. Chains into /gh-export for issue filing.
日本語の概要は準備中です。原文の説明を表示しています。
Implement a single Flutter task following this repository's Riverpod, Freezed, AutoRoute, DTO/entity, codegen, and verification conventions. Reads the task definition, PRD, and tech spec, then executes the implementation. When invoked standalone, verifies the change; when invoked by implement-tasks-sequence, writes code only and leaves verification to start-job/build-verify. Use when the user says "implement task X", "work on task X", or wants to execute a specific task from the task list.
日本語の概要は準備中です。原文の説明を表示しています。
Audit a spreadsheet for formula accuracy, errors, and common financial-model mistakes. Use for selected ranges, single sheets, or whole-workbook model checks including balance-sheet balance, cash tie-out, roll-forwards, and logic sanity.
日本語の概要は準備中です。原文の説明を表示しています。
One-line-prompt → cinematic, gorgeous, functional, well-tested, deployed website. Pre-hydrated SPA + full PWA kit + JSON-LD rich snippets + third-party integrations. React 19+Vite default (Angular optional). 100 concrete improvements grouped into 10 categories that EVERY single-prompt site build must satisfy before being marked done. Trigger whenever the user says 'make a website for X', 'build a site for X', 'rebuild X.com', or any equivalent one-liner.
日本語の概要は準備中です。原文の説明を表示しています。
Use when writing or reviewing error handling, floating-point math, concurrent code, remote calls, singletons/globals, hot-path data structures, or high-volume log statements
日本語の概要は準備中です。原文の説明を表示しています。
Biome v2 unified linter, formatter, and import organizer — single Rust-powered tool replacing ESLint + Prettier with 97% Prettier compatibility and 20x faster performance
日本語の概要は準備中です。原文の説明を表示しています。
Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn/ui). Use for complex artifacts requiring state management, routing, or shadcn/ui components - not for simple single-file HTML/JSX artifacts.
日本語の概要は準備中です。原文の説明を表示しています。
Tailor a resume to a job description with ATS keyword optimization, gap analysis, and rewritten bullets — zero fabrication. Use when the user wants /tailor for a single role, /batch for multiple JDs, career pivot reframing, or interview prep questions from a tailored application.
日本語の概要は準備中です。原文の説明を表示しています。
Generate web, mobile, and desktop prototypes, slides, dashboards, and editorial layouts from a single prompt using brand-grade design systems. Use when the user wants /web-prototype, /mobile-app, or /dashboard interactive HTML previews exportable to HTML, PDF, PPTX, or MP4 without Figma.
日本語の概要は準備中です。原文の説明を表示しています。
Procedure for controlled, human-gated outbound README badge provisioning PRs (Issue #1817). Preflights upstream repositories, ensures single-badge placement with deep links, and records campaign outcomes without automated retries or multi-badge noise.
日本語の概要は準備中です。原文の説明を表示しています。
Write Prisma Next queries for Postgres, SQLite, or Mongo — pick a lane (Postgres/SQLite `db.orm.<Model>` + `db.sql.<table>`; Mongo `db.orm.<root>` + `db.query.from(...)` pipeline builder), filter / project / sort / paginate, eager-load with `.include(...)`, Postgres/SQLite `db.transaction(...)`, Postgres/SQLite ORM `.aggregate(...)`, Mongo aggregations via query builder, namespace-aware accessors (`db.orm.<ns>.<Model>`, `db.sql.<ns>.<table>`). Triggers: query, where, match, select, project, orderBy, take, skip, include, lookup, first, all, count, aggregate, group, create, update, delete, upsert, returning, transaction, db.close, script teardown, variant, polymorphism, drizzle-style, kysely-style. Notes: `.all()` is a Thenable (just `await` it), iterators are single-use (`RUNTIME.ITERATOR_CONSUMED`), Postgres `count` is `number` while sum/avg/min/max are `number | null`, ranges use chained `.where()` or `and(...)` (no `.between(...)`).
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill when the user wants to turn code graph analysis into tracked GitHub issues — "audit the architecture", "find god nodes", "triage architectural debt", "run graphify and log issues", "what's over-coupled in this codebase", "create issues from graphify findings", "check for structural problems", "scan for architectural smells", or any request that combines codebase topology analysis with issue tracking. This skill runs graphify to build a dependency graph, parses GRAPH_REPORT.md for god nodes and structural patterns, converts findings into GitHub issue payloads, and optionally pushes them to the repo. It bridges static analysis and project management in a single automated pass. Requires graphify and gh CLI.
日本語の概要は準備中です。原文の説明を表示しています。
Fuse all of a contributor's named skills into a single fusion node (suite capstone) in the registry. Use when the user says "fuse <contributor>'s skills", "create a suite for <contributor>", "build a capstone for <user>", "fuse all of <user>'s named skills", "create a suite fusion", "consolidate <contributor> into one skill", or explicitly types /gaia-fuse-full-suite. Also triggers when a contributor has accumulated 3+ named skills and the user asks what to do next with them, or when someone asks "can we make a suite from these?". This skill: collects component IDs from registry/named/<contributor>/, verifies nodes exist, researches evidence and appraises Trust Magnitude, runs `gaia dev fuse` to write the fusion node and suite manifest, validates, and opens a PR on a review/meta/ branch.
日本語の概要は準備中です。原文の説明を表示しています。
Multi-agent exploration-to-PR pipeline for safely exploring, fixing, and shipping a feature or CLI. Use when the user says: "explore X", "test and ship X", "run the pipeline on X", "run /feature-pipeline on X", "let's properly investigate X", "stress-test X and file issues", or "take X through the full pipeline." Also triggers on: "find what's broken in X", "test X end-to-end", "do a sandbox review of X", "file issues for X and fix them." Do NOT use for single-file bug fixes or one-off edits — the overhead is only justified when exploration, planning approval, and CI watching all matter. Manages state via scripts/state.sh (jq required). Five phases: LIGHTER explores → ORCHESTRATOR drafts PR → HEAVIER plans (user approves first) → ORCHESTRATOR commits → HEAVIER sandbox review → LIGHTER iterates CI → LIGHTER drift check + summary. Four mandatory stop hooks (M1–M4) gate each phase transition.
日本語の概要は準備中です。原文の説明を表示しています。
End-to-end Gaia curation pipeline orchestrator. Routes each phase to its dedicated skill and keeps you on track from first discovery to closed intake. Use when starting a fresh curation run or when you want a single skill to hold the sequence together without duplicating each phase's instructions. Trigger phrases: "/gaia-full-pipeline", "run the full pipeline", "start a curation from scratch", "take this skill through the full pipeline", "curate end-to-end", "pipeline run", "full curation flow". Fused from: gaia-curate + gaia-curate-chain + gaia-curate-dynamic + gaia-curate-trending + gaia-bot-curate + gaia-draft-curate + ev-pipeline + gaia-ingest + gaia-intake-close.
日本語の概要は準備中です。原文の説明を表示しています。
Focused single-target audit of one Gaia skill, named skill, or real-skill catalog item. Use this skill when: auditing a specific skill by ID or name, a skill looks overpromoted, evidence feels thin or dead, a contributor's skill seems outdated or superseded, the rank doesn't match the source quality, evidence is mapped to the wrong Evidence Type, a skill at 3★+ is missing a working GitHub link, someone asks "does this skill deserve its stars?", or you want the smallest possible correction with validation — not a bulk sweep. This is NOT for bulk curation passes (use /gaia-curate for that) or meta-level registry sweeps (use /gaia-meta-audit). It is specifically for "fix this one skill, get it right."
日本語の概要は準備中です。原文の説明を表示しています。
Orchestrate a whole-registry sweep of Gaia — fan out 13 parallel audit agents across every skill, run adversarial verification, surface Semantic Fusion candidates, propose new generic skill references, and synthesize a publish-ready HTML report under docs/meta/reports/. Use this skill for broad, systemic analysis across many skills at once: "run a meta sweep", "sweep the meta", "full meta audit", "audit the whole registry against META.md", "widespread nomenclature issues", "find all skills missing a GitHub link", "produce a meta report", "check for evidence type mismatches across the registry", "find skills that document a third-party tool with no attribution", or explicitly types /gaia-meta-sweep. This is the registry-wide macro companion to /gaia-meta-audit (a prioritized queue, single-pass) and /gaia-audit (fixes one skill). Use it when you need the full surface — 13 audit dimensions, adversarial verification, fusion proposals, and a durable findings artifact — not just a queue.
日本語の概要は準備中です。原文の説明を表示しています。
Runs a single Copilot review check-fix cycle on a PR using gh CLI. Use this skill whenever the user wants to: check and fix Copilot review comments, request a Copilot code review on a PR, or iterate on PR feedback. Trigger on phrases like 'copilot review', 'fix PR comments', 'iterate on PR', 're-review', or when the user mentions 'gh pr' with 'copilot'. Combine with /loop for automated repeated cycles, e.g. '/loop 2m /copilot-review'.
日本語の概要は準備中です。原文の説明を表示しています。
Plan a feature before writing any code. Use this skill at the START of non-trivial feature work — when the user says they want to "add", "build", "implement", "create", "develop", or "ship" a feature, endpoint, component, page, service, or capability. Especially trigger when the user's prompt is short or under-specified ("add a dashboard", "build an auth flow", "let's do user activity reports") — those need planning, not direct execution. The skill walks through requirements clarification, codebase exploration, sketches a Mermaid architecture/flow diagram of the proposed design, and produces a plan.md document the user can hand off to a fresh AI session for execution. Skip only when the change is genuinely trivial (typo fixes, single-line tweaks, renames). When in doubt, plan.
日本語の概要は準備中です。原文の説明を表示しています。
Runs a single Codex (ChatGPT/OpenAI) review check-fix cycle on a PR using gh CLI. Use this skill whenever the user wants to: check and fix Codex review comments, request a Codex code review on a PR, or iterate on PR feedback from the chatgpt-codex-connector bot. Trigger on phrases like 'codex review', '@codex review', 'fix codex comments', 'iterate on PR', 're-review with codex', or when the user mentions 'gh pr' with 'codex'. Combine with /loop for automated repeated cycles, e.g. '/loop 2m /codex-review'.
日本語の概要は準備中です。原文の説明を表示しています。