「url」の検索結果

Use when testing JWT-based authentication for algorithm confusion, alg:none bypass, weak HMAC secrets, missing expiration, kid parameter injection, and token storage in localStorage. Trigger on: Authorization: Bearer tokens, JWTs in cookies, any base64url encoded header.payload.signature pattern, OAuth2 access tokens, API authentication tokens, SSO tokens, JWKS endpoints. Detects RS256→HS256 confusion, public key as HMAC secret, unverified kid values used in file reads or SQL queries, and JWT cracking with short secrets.

日本語の概要は準備中です。原文の説明を表示しています。

Exploit insecure handling of the HTTP Host header to poison password resets, generate cache poisoning vectors, or bypass internal routing restrictions. Use this skill when web applications dynamically generate URLs, links, or redirects based on the arbitrary Host header value supplied by the client rather than relying on a static, trusted server configuration.

日本語の概要は準備中です。原文の説明を表示しています。

HTTP Parameter Pollution (HPP): duplicate query/body keys parsed differently by servers, proxies, WAFs, and app frameworks. Use when filters and application layers disagree on which value wins, enabling bypass, SSRF second URL, logic abuse, or CSRF token confusion.

日本語の概要は準備中です。原文の説明を表示しています。

Use when hunting Client-Side Path Traversal (CSPT) vulnerabilities where attacker- controlled input is unsafely concatenated into the path component of a JavaScript fetch() or XHR request. Trigger on: "CSPT", "client-side path traversal", "fetch path traversal", "XHR path injection", "fetch concatenation", "../ in fetch", "user input in fetch URL", "path component injection", fetch redirect chaining, CSPT to XSS, open redirect fetch, "JavaScript fetch user input", DOM fetch injection.

日本語の概要は準備中です。原文の説明を表示しています。

Use when hunting Broken Object Level Authorization (BOLA) or Insecure Direct Object Reference (IDOR) vulnerabilities in APIs or web applications. Trigger on: "BOLA", "IDOR", "broken object level", "access other users", "object reference", numeric or UUID IDs in URLs or request bodies, user-scoped resources, horizontal privilege escalation, "change the ID in the request", second-order IDOR, blind IDOR, indirect reference, encoded ID, deprecated API version, JSON globbing.

日本語の概要は準備中です。原文の説明を表示しています。

Bypass authentication via forced browsing to protected URLs, parameter tampering (authenticated=yes, debug=true, fromtrustIP=true), session ID prediction from linear/incremental cookies, SQL injection on login forms, PHP unserialize() boolean type juggling (b:1 payload), and credential transport over HTTP. Detectable with Burp Suite, OWASP ZAP, WebGoat.

日本語の概要は準備中です。原文の説明を表示しています。

Use when customizing Django Admin - save_formset, get_search_results, formsets, queryset optimization, db_index, custom URLs

日本語の概要は準備中です。原文の説明を表示しています。

Use when configuring django-storages for cloud file storage - STORAGES setting, Amazon S3, Google Cloud Storage and Azure backends, signed URLs, CDN and caching, multipart uploads, or storage testing

日本語の概要は準備中です。原文の説明を表示しています。

Use when writing or reviewing code that parses user input, builds SQL/shell commands, handles secrets/credentials, hashes passwords, changes auth checks, deserializes untrusted data, or constructs paths/URLs from input

日本語の概要は準備中です。原文の説明を表示しています。

File upload patterns - drag-drop dropzones, chunked and resumable uploads, presigned URL flows, file validation (MIME type, magic bytes), progress tracking, accessibility (ARIA)

日本語の概要は準備中です。原文の説明を表示しています。

Client-side image handling - preview generation, Canvas API resizing, compression, EXIF orientation, format conversion, memory management with object URL cleanup

日本語の概要は準備中です。原文の説明を表示しています。

Review a PR or the current branch for a Lumen design-system change — routes each changed file to React (web/Tailwind) or React Native (useStyleSheet) guidelines, checks the Nx version plan, and reports a flat, severity-scored finding list. Use when the user asks to review a PR, review code changes, check a branch, do a local code review, or provides a GitHub PR URL.

日本語の概要は準備中です。原文の説明を表示しています。

Run this skill for Phase 3 of the evidence verification pipeline — the adversarial audit step. Use when you need to check the evidence data lake for bad data before ingestion: dead links, wrong URL formats (tree/ vs blob/), subjective wording ("elite", "high-quality"), stale migration notes, benchmark catalog misuse/vendor-claim leakage, or skills whose star evidence conflicts with classified evidence level. Triggers on phrases like: "audit the data lake", "adversarial check", "ev-adversarial-audit", "check for noise in evidence", "flag bad evidence", "run the audit phase", "quality check the by-type files", or any reference to Phase 3 of the pipeline.

日本語の概要は準備中です。原文の説明を表示しています。

Top-level orchestrator for the Gaia Skill Tree evidence verification pipeline. Run this when you want to do a full evidence pass — collecting raw sources, verifying live GitHub star counts, running Phase 2B benchmark-source verification, adversarially auditing for quality/formatting issues, and checking that every URL is reachable — all in one coordinated sequence. Trigger phrases: "run the evidence pipeline", "full evidence pass", "verify evidence", "evidence verification pipeline", "run ev-pipeline", "check all evidence", "audit the data lake", "evidence quality sweep", "refresh evidence", "validate evidence sources". Also aliased as /evidence-verification-pipeline. Use the individual sub-skills (ev-collection, ev-star-verification, ev-adversarial-audit, ev-link-validation) only when you need to re-run one phase in isolation; for end-to-end work, always start here.

日本語の概要は準備中です。原文の説明を表示しています。

Canonical entry point for the full Gaia evidence verification pipeline. Invoke as /evidence-verification-pipeline or /ev-pipeline — both names trigger this skill. Use whenever you need to run the evidence phases end-to-end: collecting raw evidence from the data lake, verifying live GitHub star counts, running Phase 2B benchmark-source verification, running adversarial auditing for noise and URL errors, and checking link health via Firecrawl. Also use when someone says "run the evidence pipeline", "verify the evidence lake", "audit evidence", "run ev-pipeline", "full evidence check", "pipeline run", "prepare evidence for ingestion", or "refresh the data lake". This is the pre-ingestion step — run it before importing any evidence into the registry.

日本語の概要は準備中です。原文の説明を表示しています。

Inspect or exercise the paused gaia curate orchestration scaffold for one source URL. The command currently persists an INITIALIZED run ledger and reports status; its 25 named workflow states and transition methods are a design skeleton, not an implemented automated curation or merge pipeline. Use only for scaffold development, status inspection, or dry-run contract work. For live curation, use gaia-full-pipeline or gaia-consult. Trigger phrases: "/gaia-quick-curate", "inspect gaia curate", "curate scaffold", "quick curate status". For batch/multi-page runs use gaia-curate-dynamic; for crawler branches use gaia-bot-curate; for pending intake proposals use gaia-draft-curate.

日本語の概要は準備中です。原文の説明を表示しています。

Build and maintain a persistent, interlinked markdown wiki (second brain / research notebook / personal knowledge base) from raw sources. Use this skill when the user wants to ingest an article / paper / note / URL / PDF into their wiki, ask a question against their wiki, lint/health-check their wiki, or set up a new wiki from a folder. Triggers include phrases like "add this to my wiki", "ingest this", "file this article", "update my notes with this", "what does my wiki say about X", "health-check my wiki", "find stale/orphan pages", or any workflow involving a `raw/` source folder, `wiki/` markdown folder, `index.md`, or `log.md`. Compatible with Obsidian vaults.

日本語の概要は準備中です。原文の説明を表示しています。

Ingest one new source into an existing persistent markdown wiki or established vault workflow. Use this when the user asks to add an article, PDF, note, URL, transcript, or other source into their wiki and wants the source filed, linked, indexed, and logged. If the wiki workflow does not exist yet, use $wiki-bootstrap first. This skill is for the ingest operation only.

日本語の概要は準備中です。原文の説明を表示しています。

Downloads a competitor's live ad creatives — the actual MP4s and JPEGs — from the Meta Ad Library into a local swipe folder, through the Novoads API. One sweep per competitor, priced by a live estimate before anything is charged, media pulled the moment the response lands because the CDN links expire, and every ad carried with its permanent Ad Library URL, the page running it, and how many audiences the creative is running against, closing with the three most established and why. Use when asked to spy on competitors, find what ads a brand is running, pull a competitor's video or static creatives, build or refresh a swipe file, check who is outspending you on Meta, or source a reference ad to recreate. It finds, ranks and files ads; it does not rebuild them — a static becomes your own ads, or a reusable template, via clone-image-ad. It writes no craft analysis and no creative brief. A sweep that finds nothing is a result, never an apology.

日本語の概要は準備中です。原文の説明を表示しています。

Builds a stylized 3D animated ad on the Novoads REST API as a STORYBOARD: four to six beats, each rendered from its own key frame, narration laid into the gaps, a music bed, captions burned on, assembled locally with ffmpeg. Carries the genre's beat formulas (anthropomorphized problem character, protagonist reveal, mascot mechanism scene, composited end card). Use for ANY Pixar-style, Disney-style, 3D animated or animated-film-look ad at ANY length: "Pixar style ad", "3D animated ad", "animated movie look", "cute 3D character ad", "a quick animated ad", "15 second animated ad", "30 second animated ad", "storyboard ad", "several scenes", "animated ad with a voice-over", "little mascots", or a product URL or photo for an emotional animated spot. No one-call tier, so ffmpeg is required. Not for stop-motion clay (use claymation-ad), talking-head UGC (novoads-api), video cloning, or static image ads.

日本語の概要は準備中です。原文の説明を表示しています。

This skill enables GitHub repository documentation exploration using DeepWiki API directly via curl. Use when researching repository structure, understanding library APIs, or asking questions about open-source projects. MCP server not required.

日本語の概要は準備中です。原文の説明を表示しています。

This skill enables web scraping and content extraction using Firecrawl API directly via curl. Use when scraping web pages, crawling websites, or extracting structured data. MCP server not required.

日本語の概要は準備中です。原文の説明を表示しています。

This skill provides guidance for using Firecrawl MCP for web scraping and content extraction. Use when scraping web pages, crawling websites, searching the web with content extraction, mapping site URLs, or extracting structured data from web pages.

日本語の概要は準備中です。原文の説明を表示しています。

This skill enables web searching using Brave Search API directly via curl. Use when searching for current information, news, articles, or web content. MCP server not required - calls API directly.

日本語の概要は準備中です。原文の説明を表示しています。