2,648 件 ・ 関連度順
概要と使いどころ
Generates CVE request packages from pentest findings. Reads cve-candidates.json (auto-generated at pentest completion) or findings.json directly, then produces for each qualifying vulnerability: MITRE CVE form data, GitHub Security Advisory draft, full disclosure report, and vendor notification email. Invoke manually after a pentest engagement when you have true-positive findings that warrant CVE IDs.
日本語の概要は準備中です。原文の説明を表示しています。
CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content.
日本語の概要は準備中です。原文の説明を表示しています。
Java "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026). Use when attacking Java services where 16-bit char is silently narrowed to 8-bit byte to bypass WAF/IDS for SQL injection, deserialization RCE, file upload (Webshell), path traversal, CRLF injection, request smuggling, and SMTP injection. Affects Tomcat, Spring, Jetty, Undertow, Vert.x, Jackson, Fastjson, Apache Commons BCEL, Apache HttpClient, Angus Mail, JDK HttpServer, Lettuce, Jodd, XMLWriter and re-enables many "patched" CVEs through WAF bypass.
日本語の概要は準備中です。原文の説明を表示しています。
Arbitrary write to RCE playbook. Use when you have an arbitrary write primitive (from heap exploitation, format string, or OOB write) and need to convert it into code execution by targeting GOT, hooks, _IO_FILE vtable, exit_funcs, TLS_dtor_list, modprobe_path, .fini_array, or C++ vtables.
日本語の概要は準備中です。原文の説明を表示しています。
What every delivered app must DO — anti-placeholder, complete features, working forms, psnotify notifications, feature flags, embarrassingly-easy UX, the feature catalog.
日本語の概要は準備中です。原文の説明を表示しています。
TanStack Form patterns - useForm, form.Field, validators, arrays, linked fields, createFormHook, type safety
日本語の概要は準備中です。原文の説明を表示しています。
VeeValidate v4 patterns - useForm, useField, defineField, useFieldArray, schema validation with Composition API
日本語の概要は準備中です。原文の説明を表示しています。
React Hook Form patterns - useForm, Controller, useFieldArray, validation resolver, performance optimization
日本語の概要は準備中です。原文の説明を表示しています。
End-to-end plan → implement → review pipeline that takes one triaged Gaia issue to a merged-ready PR, with Kill Criteria on the issue and zero follow-up debt. Use when someone says: "resolve this issue", "take #N end-to-end", "work the P0 queue", "fix and ship this issue", "run the resolver", "close out this issue properly", or /gaia-issue-resolver. Works any gaia-research org repo — gaia-skill-tree, gaia-research, gaia-skill-heaven — while the issue itself lives on the headquarters tracker, gaia-research/gaia-skill-tree. Assumes the issue is already triaged and carries a P0–P4 label; if it does not, run /gaia-triage first.
日本語の概要は準備中です。原文の説明を表示しています。
Audit and repair Gaia user-tree timelines so every skill's current rank is explained by a chain of Hero's Journey events. Trigger this skill when: a contributor's profile chart shows a stale rank (e.g. still shows 3★ after a demotion to 1★); someone asks to "trace what happened" to a skill's rank; `validate_timelines.py` is failing in CI; you need to backfill missing `demote` or `rank_up` events before cutting a release; a skill was reclassified or Star-Bar-reset and the user tree was never updated; or any time the registry node and user tree disagree on a skill's current level. Uses `scripts/trace_timeline.py` (dry-run + apply) and `scripts/validate_timelines.py` (CI gate). Do NOT hand-edit `timeline[]` arrays — the script synthesises properly labelled events with `previousValue`/`newValue` so the rank chart plots correctly.
日本語の概要は準備中です。原文の説明を表示しています。
Replaces the voice in a video or audio file with one from the Novoads voice catalog, over the REST API. Converts the SPEECH in the source to a voice you pick, keeps the original timing so lip-sync survives, and returns audio that gets muxed back over the untouched picture locally. Casts by MEASURING the source voice against auditioned candidates instead of reading labels, refuses a source with no speech before anything is charged, fences sound effects and music so they survive from the original track, and verifies the finished file by transcribing it. Use when an actor's voice sounds robotic, flat, thin or simply wrong, and for "change the voice", "voice swap", "swap the voice on this ad", "re-voice my ad", "the actor's voice sounds bad", "make him sound human", "different voice for this video", "speech to speech", "same video better voice". Not for narrating a silent clip (that is a voice-over), not translation, and it changes neither pronunciation nor accent.
日本語の概要は準備中です。原文の説明を表示しています。
Updates this skill pack from upstream, and owns the consent that decides whether it ever updates on its own. Checks whether the clone is behind, asks the user — update now, always keep me up to date, not now, or never ask again — and carries out the answer: applies the update through ./scripts/update.sh, records the consent flag the SessionStart hook already reads, snoozes on an escalating ladder, or turns the check off for good. Summarizes what changed between the two commits from the CHANGELOG. Use when the user asks to update or upgrade the pack, get the latest skills or the newest version, when the session banner reports that updates are available, when they ask whether their clone is current, when they want unattended updates switched on or off, or when they want to stop being asked. It never applies an update without an answer, and notify-only is the default.
日本語の概要は準備中です。原文の説明を表示しています。
Downloads a competitor's live ad creatives — the actual MP4s and JPEGs — from the Meta Ad Library into a local swipe folder, through the Novoads API. One sweep per competitor, priced by a live estimate before anything is charged, media pulled the moment the response lands because the CDN links expire, and every ad carried with its permanent Ad Library URL, the page running it, and how many audiences the creative is running against, closing with the three most established and why. Use when asked to spy on competitors, find what ads a brand is running, pull a competitor's video or static creatives, build or refresh a swipe file, check who is outspending you on Meta, or source a reference ad to recreate. It finds, ranks and files ads; it does not rebuild them — a static becomes your own ads, or a reusable template, via clone-image-ad. It writes no craft analysis and no creative brief. A sweep that finds nothing is a result, never an apology.
日本語の概要は準備中です。原文の説明を表示しています。
Hunts for domain fronting and CDN abuse by detecting TLS SNI versus HTTP Host header mismatches and high-reputation CDN domains carrying anomalous traffic in network telemetry. Activates for requests to hunt domain fronting, detect SNI/Host mismatch, or find CDN abuse used to mask C2.
日本語の概要は準備中です。原文の説明を表示しています。
Detects command-and-control beacons in network logs by analyzing connection timing: measuring inter-arrival intervals, accounting for jitter, and scoring regularity per source/destination pair to surface periodic callbacks. Activates for requests to hunt C2 beaconing, find periodic callbacks, or analyze connection-interval regularity.
日本語の概要は準備中です。原文の説明を表示しています。
Deobfuscates malicious JavaScript from droppers, web pages, and HTA/scriptlets: unrolling string-array and char-code encodings, resolving eval/Function chains, and statically recovering payloads and URLs without executing untrusted code. Activates for requests to deobfuscate JavaScript, decode obfuscated JS, or analyze a malicious script dropper.
日本語の概要は準備中です。原文の説明を表示しています。
VST3 format adapter for Pulp — SingleComponentEffect wiring, bus arrangement negotiation, parameter / MIDI event routing, state round-trip, and the pitfalls discovered while wiring the adapter against Steinberg's SDK.
日本語の概要は準備中です。原文の説明を表示しています。
Keep a plugin/demo repo's screenshots in sync with its UX. When editor / UI / design-token code changes in an opted-in repo (one carrying .pulp/screenshots.toml), re-capture and refresh every place each shot is consumed — README images, web-demo Open Graph (og.png) images, and gallery thumbnails — consistently across the WAM and WCLAP demo sites. Two capture routes: native headless (render_to_png / pulp-screenshot, Skia) for README / native-editor shots, and live-web headless Chrome (playwright-core) for WAM/WCLAP demo OG + gallery images. Backfills demos missing OG images. This is a PORTING / consistency tool — it re-shoots a repo's OWN UI, it never clones another product's art.
日本語の概要は準備中です。原文の説明を表示しています。
LV2 format adapter for Pulp — the Turtle manifest the build emits by asking the module to describe itself, port indices as a saved-session wire format with one shared layout, host transport arriving as a time:Position atom on the MIDI port, the optional buf-size feature that is a hint and not a guarantee, state:interface versus control ports, and the real-time rules run() has to keep.
日本語の概要は準備中です。原文の説明を表示しています。
Pulp timeline transport, immutable compiled playback programs, bounded arrangement audio rendering, block-level publication latches, stable shells, and ProcessContext projection.
日本語の概要は準備中です。原文の説明を表示しています。
Maintainer side of an outside contribution — find what has arrived (fork PR, issue, or patches sent out-of-band), adopt it into an in-repo branch with authorship intact, review it against the repo's bar, and ship it through the normal merge path. Use when landing work from someone without write access or without the CI fleet.
日本語の概要は準備中です。原文の説明を表示しています。
DNA methylation analysis — array and bisulfite-seq processing, DMP/DMR calling, and epigenetic clocks.
日本語の概要は準備中です。原文の説明を表示しています。
Create comics and graphic narratives with panel flow, lettering, pacing, and visual storytelling.
日本語の概要は準備中です。原文の説明を表示しています。
Copy-number variant analysis — detection from sequencing/arrays, segmentation, and clinical interpretation.
日本語の概要は準備中です。原文の説明を表示しています。