2,704 件 ・ 関連度順
概要と使いどころ
Cloud control-plane exploitation for AWS, Azure/Entra, GCP, and Alibaba Cloud: IAM/RAM privilege escalation, impersonation, cross-account trust, serverless/compute control, and cloud-native persistence. Host OS persistence/C2 after root/SYSTEM belongs to /post. K8s RBAC belongs to /k8s. Operator chooses next modules; new identities default to /cloud-recon first.
日本語の概要は準備中です。原文の説明を表示しています。
通用网络与资产信息收集。面向 IP、CIDR、主机名、企业/域名等尚未明确攻击面的目标，完成资产扩展、主机发现、TCP/UDP端口发现、服务/版本/协议识别、只读服务枚举、网络设备识别和漏洞候选研判。Recon only：不执行漏洞利用、口令爆破、服务配置修改或持久化。
日本語の概要は準備中です。原文の説明を表示しています。
Linux local privilege escalation from a low-privilege shell to root. Covers quiet vs loud enumeration, sudo/GTFOBins, CVE-2025-32463 chwoot and CVE-2025-32462 host bypass, polkit/udisks CVE-2025-6018/6019, SUID/capabilities, systemd timers/units, cron/PATH/LD_PRELOAD, dangerous groups and docker.sock, host-local container escape, and version-gated kernel LPE including Copy Fail CVE-2026-31431. Use when the operator has a Linux foothold and needs root. Kubernetes RBAC stays in /k8s. Endpoint blocks hand off to /edr-bypass then return here.
日本語の概要は準備中です。原文の説明を表示しています。
Endpoint defense evasion after an operator-selected chain already has a valid execution path but AV/EDR/AMSI/WDAC/PPL/memory/kernel telemetry blocks the intended action. Originating modules include /web-attack /ad-attack /cloud-attack /k8s /cicd /service-attack /phishing /privesc-win /privesc-linux /creds /post /shell. Success is the blocked action becoming executable, then resume the originating module — not obtaining a shell here.
日本語の概要は準備中です。原文の説明を表示しています。
Active Directory reconnaissance with or without credentials: user/group/computer enumeration, ACL/delegation, ADCS, modern Windows LAPS, BloodHound, Server 2025/dMSA/Ghost SPN candidates, and trust mapping. Recon only — do not exploit Kerberoast-to-DA, DCSync, or change passwords. Operator may select /ad-attack after cards are ready.
日本語の概要は準備中です。原文の説明を表示しています。
Cloud control-plane reconnaissance for AWS, Azure/Entra, GCP, and Alibaba Cloud: identity, IAM/RAM, trust, resources, metadata, and managed-Kubernetes cloud-side boundary. Recon only — no policy changes, no privilege escalation. Operator may select /cloud-attack or /k8s.
日本語の概要は準備中です。原文の説明を表示しています。
Kubernetes and container exploitation: identity/RBAC, secrets, kubelet/etcd, managed-cloud workload identities, container-to-node escape including CVE-2026-31431 Copy Fail, and Kubernetes-native persistence. Use when already in a Pod/container or holding kubeconfig. Own the chain to cluster-admin, node root, or a usable cloud identity. Operator chooses next modules. Endpoint blocks after OS execution hand off to /edr-bypass then return.
日本語の概要は準備中です。原文の説明を表示しています。
直连网络服务攻击链。用于已经识别/枚举的非专门领域服务，从数据库、数据存储、文件/远程访问、基础设施、消息队列、DNS/网络服务、打印机/MFP/NAS/BMC/网络设备等服务入口继续利用到凭据、代码执行、主机控制、横向能力或新的独立身份。由操作者选择具体攻击链；不自动切换模块。
日本語の概要は準備中です。原文の説明を表示しています。
Credential operations: secret discovery, classification, extraction, conversion, offline cracking of hashes the operator already has as a credential job, policy-aware spraying, NetNTLM capture, generic SMB relay, and Windows/Linux harvest. Do not hijack an in-progress /ad-attack Kerberoast/AS-REP chain (that module cracks and uses the ticket itself). Do not DCSync, read LAPS LDAP, or escalate cloud IAM. Usable credentials are recorded; the operator chooses the next module.
日本語の概要は準備中です。原文の説明を表示しています。
HTTP/Web exploitation until a server shell or equivalent OS execution. Use after /web-recon has mapped the application. Covers injection, upload, LFI, SSRF/XXE, SSTI, deserialization, JWT/SAML, API logic, desync/cache/parser, and Web-controlled backend abuse. WAF stays here. Endpoint blocks after OS execution hand off to /edr-bypass then return. Direct non-HTTP service ports belong to /recon or /service-attack.
日本語の概要は準備中です。原文の説明を表示しています。
OS post-exploitation after a stable host foothold: quiet host recon, host-native persistence (Windows Run/tasks/services/COM/WMI and Linux SSH/cron/systemd/SUID), long-term C2 (Sliver primary, Mythic/Havoc optional), targeted collection and exfil, and engagement cleanup. Does not own AD/cloud/K8s native persistence, Ligolo pivoting, LSASS dumping, or EDR bypass. Operator selects objectives; success is a live callback, verified persistence, delivered loot, or restored host — not generating an unused implant.
日本語の概要は準備中です。原文の説明を表示しています。
Active Directory exploitation after domain credentials exist: Kerberos (AS-REP/Kerberoast including cracking the ticket then using the account), delegation, NTLM coercion/relay, lateral movement, ACL abuse, ADCS ESC1-ESC17 and CVE paths, dMSA/BadSuccessor, Kerberos reflection, identity confusion, management-plane, domain trust, and domain persistence. Own the current AD chain through crack-and-use to DA, equivalent domain control, or the targeted host SYSTEM. Do not stop after requesting TGS. Host C2 belongs to /post. Operator chooses next modules.
日本語の概要は準備中です。原文の説明を表示しています。
CI/CD pipeline and software-supply-chain exploitation: Jenkins, GitHub Actions, GitLab CI/CD, Azure DevOps, Gitea/Forgejo, self-hosted runners/agents, poisoned pipeline execution, artifact/cache abuse, dependency confusion, third-party Action trust, GitOps/registry poisoning, workload identity/OIDC, and emerging agentic CI/CD. Use this skill when the operator has access to a CI/CD system, source repository, build/deploy configuration, runner/agent, artifact/package/registry path, or software delivery trust chain.
日本語の概要は準備中です。原文の説明を表示しています。
Use when the user dumps a batch of inputs at once — a pile of emails, a backlog of Slack/Teams messages, a list of asks, meeting action items, a notes brain-dump — and needs it sorted into action. Classifies each item, assigns owner + next step + priority, and flags which need a full /structure brief or a /decide call. Trigger on "/triage", "triage this", "process my inbox", "sort these asks", "clear my backlog", "what do I do with all this".
日本語の概要は準備中です。原文の説明を表示しています。
Template skill for a leadership-transition / executive cockpit — when someone steps into or covers a leadership role and needs to not drop anything. Produces a handoff doc + decision-rights map, an "open loops" tracker, a team-comms cadence, and a recurring report/update drafter. Trigger on "/exec-cockpit", "handoff doc", "decision-rights map", "open loops tracker", "cover for <role>", "interim <role>". Customize the placeholders to your situation.
日本語の概要は準備中です。原文の説明を表示しています。
First-run guided setup for a fresh gAIOS clone. Interviews the user (identity, role, priorities, voice, connections, team, pain, guardrails) and fills the templates — CLAUDE.md, context/, references/voice.md, connections.md — then introduces the WAT / wiki / workflows / experiments features. Trigger on "/setup", "set me up", "get started", "onboard me", or a fresh clone where CLAUDE.md still has {{placeholders}}.
日本語の概要は準備中です。原文の説明を表示しています。
Use when the user asks to create a custom post type, build a portfolio, set up case studies, add team members, events, or podcast episodes, or says 'scaffold a CPT'. Creates the post type plus supporting taxonomies, an ACF field group, sample entries, and a builder-specific single template suggestion.
日本語の概要は準備中です。原文の説明を表示しています。
Apply MCAF agile-delivery guidance for backlog quality, roles, ceremonies, and engineering feedback. Use when defining how the team plans, tracks work, and turns feedback into durable improvements.
日本語の概要は準備中です。原文の説明を表示しています。
Push the LLM to reconsider, refine, and improve its recent output. Use when user asks for deeper critique or mentions a known deeper critique method, e.g. socratic, first principles, pre-mortem, red team
日本語の概要は準備中です。原文の説明を表示しています。
Explores codebases to find relevant files, trace execution paths, and map architecture with team communication capabilities for collaborative analysis (converted from agent)
日本語の概要は準備中です。原文の説明を表示しています。
Deep exploration and synthesis workflow using agent teams with dynamic planning and hub-and-spoke coordination. Use when asked for "deep analysis", "deep understanding", "analyze codebase", "explore and analyze", or "investigate codebase".
日本語の概要は準備中です。原文の説明を表示しています。
Guides discovery and application of project-specific conventions including code patterns, naming, structure, and team practices. Use when exploring a codebase or implementing features to match existing patterns.
日本語の概要は準備中です。原文の説明を表示しています。
Deep exploration and synthesis workflow using Agent Teams with dynamic planning and hub-and-spoke coordination. Use when asked for "deep analysis", "deep understanding", "analyze codebase", "explore and analyze", or "investigate codebase".
日本語の概要は準備中です。原文の説明を表示しています。
Convert Claude Code plugins into generic, platform-agnostic format. Supports full conversion (skills, agents, hooks), flatten mode (skills only — agents converted to skills, hooks absorbed), or nested mode (agents nested as pure markdown within parent skills, hooks absorbed). Full mode supports per-group or unified output layouts — unified merges all groups into a single directory organized by component type. Strips Claude Code-specific implementation details to produce clean markdown files preserving only the intent and instructions. Use when asked to "make this portable", "convert to generic format", "export plugin", "create universal skills", "strip platform dependencies", "make harness-agnostic", "decouple from Claude Code", "flatten to skills only", "nest agents in skills", or when the user wants their plugin content usable outside Claude Code. Also use when the user wants to share skills with teams using different agent frameworks.
日本語の概要は準備中です。原文の説明を表示しています。