2,094 件 ・ 関連度順
概要と使いどころ
Reviews GitHub Actions workflow diffs for script injection of untrusted input, pull_request_target with untrusted checkout, over-broad GITHUB_TOKEN permissions, and unpinned third-party actions.
日本語の概要は準備中です。原文の説明を表示しています。
Audit OpenClaw frontend code and rendered interfaces for Carapace drift, token misuse, primitive reimplementation, accessibility problems, responsive defects, and off-brand copy. Use for design reviews, compliance checks, or scheduled audit-and-fix workflows.
日本語の概要は準備中です。原文の説明を表示しています。
Route OpenClaw design work to canonical brand, Carapace product-interface, marketing-page, or design-audit guidance. Use when a task touches OpenClaw visual identity, shared CSS tokens, product UI, public web pages, or Carapace compliance.
日本語の概要は準備中です。原文の説明を表示しています。
Compatibility alias for existing OpenClaw installations that now applies Carapace semantic tokens, themes, shared CSS foundations, consumer adapters, and established local primitives.
日本語の概要は準備中です。原文の説明を表示しています。
Shared types, SKILL.md renderer, and token budgeting for skillit plugins
日本語の概要は準備中です。原文の説明を表示しています。
在授权渗透测试中挖掘不安全反序列化（insecure deserialization）。当目标把用户可控数据交给 unserialize/Marshal/pickle/ObjectInputStream/BinaryFormatter/YAML.load 等还原成对象时使用——典型场景：cookie/token/viewstate/隐藏字段里出现序列化数据、导入文件触发对象还原、想借 gadget chain 拿 RCE。适用目标类型 Web / REST API（PHP/Ruby/Python/Java/.NET）。触发场景包括用户说"测下反序列化""这个 cookie 是不是序列化对象""能不能 gadget chain 打 RCE""phar/Marshal/pickle 打一下"。输出：识别出的序列化落点 + gadget 可用性判定 + 带外/回显证据的 finding（含 killed 记录）。
日本語の概要は準備中です。原文の説明を表示しています。
在授权渗透测试中挖掘认证/授权绕过（authentication & authorization bypass）。当目标的登录、SSO/OAuth/SAML、2FA、会话、密码重置、邮箱验证等鉴权环节可能被逻辑缺陷或解析差异绕过时使用——典型场景：SAML 签名/entityId 绕过、OAuth `response_type`/`redirect_uri` 篡改窃取 token、邮箱规范化/预验证绕过、2FA 可预测/可跳过、会话类型混淆。适用目标类型 Web / REST API / SSO。触发场景包括用户说"测下认证绕过""这个 SAML/OAuth 有没有问题""能不能跳过 2FA""邮箱验证能绕吗"。输出：绕过路径 + 越权访问证据的 finding（含 killed 记录）。
日本語の概要は準備中です。原文の説明を表示しています。
Social authentication and OAuth/SSO for Flutter supporting Google Sign-In, Apple Sign-In, Facebook Login, and LINE Login. Use when implementing social login, OAuth flows, sign-in with Google/Apple/Facebook/LINE, SSO integration, third-party authentication, platform credential configuration (SHA-1 fingerprint for Android, Service ID for Apple, App ID for Facebook, Channel ID for LINE), native auth flows, minimal viable examples, error handling patterns, or troubleshooting authentication failures, token handling, and sign-in errors (ApiException, PlatformException).
日本語の概要は準備中です。原文の説明を表示しています。
SharedPreferences (v2.5.5) for Flutter providing simple persistent key-value storage for non-sensitive user settings and app preferences. Use this skill when storing user preferences (theme mode, language selection, font size), app settings and configuration, feature flags or A/B test assignments, simple cache data, onboarding completion status, last selected values (filters, sort options), user consent flags, or any non-sensitive data that survives app restarts. Supports String, int, double, bool, and StringList types. NOT suitable for storing tokens, passwords, API keys, or any sensitive/encrypted data (use flutter_secure_storage instead). Ideal for quick persistent storage without database overhead.
日本語の概要は準備中です。原文の説明を表示しています。
Map and attack the authentication, authorization, session, tenant, federation, and machine-identity boundaries of a system, proving whether access controls actually hold rather than whether they appear to. Use whenever work touches login, sessions, tokens, roles, permissions, multi-tenancy, password reset, invitations, OAuth/OIDC/SAML, API keys, service accounts, webhooks, admin impersonation, or any question of "can this actor do or see this thing." Prefer this over a generic security pass for identity-heavy surfaces. Part of the audit suite; inherits the shared constitution while its own job is proving or disproving access boundaries.
日本語の概要は準備中です。原文の説明を表示しています。
Code-native UI design lifecycle engine (Figma alternative) with Contextual Decision Layer (CDL). Supports all 7 design stages with zero per-page CSS/JS and pluggable CSS foundations (Native, Tailwind, daisyUI, Pico, Hybrid). Trigger on commands 'brief', 'study', 'init', 'brand', 'tokens', 'palette', 'layout', 'components', 'page', 'dashboard', 'motion', 'i18n', 'audit', 'deploy', or design system requests.
日本語の概要は準備中です。原文の説明を表示しています。
TidyFactor Design track — code-native UI design lifecycle engine (Figma alternative). Supports all 7 stages of UI design (Discovery, Foundation, Architecture, Components, Motion, Quality, Delivery) with zero per-page CSS/JS and zero build step. Pluggable CSS foundations (Native, Tailwind utility-first, daisyUI, Hybrid, shadcn, Pico, Bootstrap, Alpine) and full Arabic/RTL support (El Messiri/Tajawal, never Amiri above 24px). Trigger on commands "study", "brief", "init", "brand", "typography", "school", "tokens", "palette", "assets", "layout", "nav-footer", "components", "page", "dashboard", "motion", "states", "flow", "i18n", "perf", "audit", "clone", "retrofit", "handoff", "deploy", or requests like "build a design system", "UI design lifecycle", "prototype this website", "Figma alternative", "نموذج أولي تفاعلي", "صمّم لوحة تحكم".
日本語の概要は準備中です。原文の説明を表示しています。
Send a box of Krispy Kreme donuts (doughnuts) to someone by mail, paid with your own credit card via Stripe Link — driven entirely from the terminal. Use when the user wants to send donuts, doughnuts, treats, or a thank-you gift to a lead, prospect, customer, colleague, or friend — e.g. "send donuts to Jane at Acme", "mail a dozen glazed to our new customer", "send a thank-you gift to the team". Orders are placed and shipped through the Zinc API; payment is a Stripe Link Shared Payment Token via the create-payment-credential (link-cli) skill.
日本語の概要は準備中です。原文の説明を表示しています。
Send a box of Krispy Kreme donuts (doughnuts) to someone by mail, paid with your own credit card via Stripe Link — driven entirely from the terminal. Use when the user wants to send donuts, doughnuts, treats, or a thank-you gift to a lead, prospect, customer, colleague, or friend — e.g. "send donuts to Jane at Acme", "mail a dozen glazed to our new customer", "send a thank-you gift to the team". Orders are placed and shipped through the Zinc API; payment is a Stripe Link Shared Payment Token via the create-payment-credential (link-cli) skill.
日本語の概要は準備中です。原文の説明を表示しています。
Reviews mobile security across Flutter, native Android, native iOS, React Native and Kotlin Multiplatform using OWASP MASVS. Covers credential storage, secrets, transport, deep links, WebViews, logging and platform implementations of shared KMP contracts. Use for security audits, auth/token handling, pentest findings or release hardening.
日本語の概要は準備中です。原文の説明を表示しています。
Use tsift for token-efficient repository navigation, code search and reading, call graphs, diffs, logs, tests, session context, and workspace memory. TRIGGER: exploring or changing a codebase with tsift installed, or working on the tsift repo. SKIP: plain file-level glob, non-code web search. VERSION CHECK: compare `tsift --version` against tsift-version below before trusting any command text copied from this file.
日本語の概要は準備中です。原文の説明を表示しています。
Use when you need code research over an indexed codebase with minimal context: structural graph queries (who calls X, call chains, architecture overview, dead code, cross-service HTTP routes) instead of file-by-file grep/read cycles. Also trigger to minimise token spend on repetitive code exploration.
日本語の概要は準備中です。原文の説明を表示しています。
Azure Identity SDK for Python authentication. Use for DefaultAzureCredential, managed identity, service principals, and token caching.
日本語の概要は準備中です。原文の説明を表示しています。
Azure Identity SDK for Rust authentication. Use for DeveloperToolsCredential, ManagedIdentityCredential, ClientSecretCredential, and token-based authentication.
日本語の概要は準備中です。原文の説明を表示しています。
Tools are how AI agents interact with the world. A well-designed tool is the difference between an agent that works and one that hallucinates, fails silently, or costs 10x more tokens than necessar...
日本語の概要は準備中です。原文の説明を表示しています。
Use for Nauthilus Redis client, Redis Cluster/Sentinel/topology behavior, Redis-backed token/session/flow/cache/bruteforce state, Lua Redis scripts, `NOSCRIPT` recovery, script upload/retry behavior, redismock tests, local cache coordination, and fail-closed runtime state changes.
日本語の概要は準備中です。原文の説明を表示しています。
Use for Nauthilus authentication and identity-provider work touching OIDC, OAuth2, SAML, MFA, TOTP, WebAuthn, recovery codes, LDAP-backed identity, browser login and consent flows, token/session/flow state, `private_key_jwt`, introspection, discovery metadata, endpoint-specific client authentication, and security-sensitive auth tests.
日本語の概要は準備中です。原文の説明を表示しています。
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.
日本語の概要は準備中です。原文の説明を表示しています。
Per-screen design spec generator for AI design tools (Stitch / Figma AI / Claude artifacts). Consumes per-feature PRDs from kta-prd-pipeline. Emits tool-agnostic markdown specs. Triggers — design spec, AI design prompt, screen mockup brief, Figma AI input, Stitch prompt, design system tokens, post-PRD design phase, generate design specs, design brief, mockup spec. DOES NOT generate Compose code, Kotlin code, or @Preview stubs.
日本語の概要は準備中です。原文の説明を表示しています。