「cve」の検索結果

Use whenever the user wants to find, shortlist, vet, or enrich US cybersecurity firms — pen-testing/red team, security audits, vCISO, SOC 2 readiness, incident response, managed SOC, IAM, cloud security, and AppSec. Triggers on "find me a pen-testing firm for our SOC 2 audit", "shortlist three vCISO services for our healthcare-tech startup", "we need an incident response retainer", or "pull contact info for these 8 security firm domains", even when described indirectly (we got breached, prepare us for the compliance audit, get us SOC 2 ready). Drives the ServiceGraph API (api.servicegraph.co) — a 100k+ US firm catalog filterable by industry, services, location, size, ratings. Skip in-house security hires, "how do I patch CVE-X" or "configure firewall Y" DIY questions, security-product reviews (CrowdStrike vs SentinelOne, etc.), generic security knowledge questions, consumer/personal security advice, non-US firms, individual freelancers and bug-bounty hunters.

日本語の概要は準備中です。原文の説明を表示しています。

Kubernetes and container exploitation: identity/RBAC, secrets, kubelet/etcd, managed-cloud workload identities, container-to-node escape including CVE-2026-31431 Copy Fail, and Kubernetes-native persistence. Use when already in a Pod/container or holding kubeconfig. Own the chain to cluster-admin, node root, or a usable cloud identity. Operator chooses next modules. Endpoint blocks after OS execution hand off to /edr-bypass then return.

日本語の概要は準備中です。原文の説明を表示しています。

Active Directory exploitation after domain credentials exist: Kerberos (AS-REP/Kerberoast including cracking the ticket then using the account), delegation, NTLM coercion/relay, lateral movement, ACL abuse, ADCS ESC1-ESC17 and CVE paths, dMSA/BadSuccessor, Kerberos reflection, identity confusion, management-plane, domain trust, and domain persistence. Own the current AD chain through crack-and-use to DA, equivalent domain control, or the targeted host SYSTEM. Do not stop after requesting TGS. Host C2 belongs to /post. Operator chooses next modules.

日本語の概要は準備中です。原文の説明を表示しています。

Hunt business logic flaws — race conditions, workflow state bypass, parameter pollution affecting logic, coupon/discount abuse, refund logic, multi-step process bypass, integer overflow, negative quantities, double-spend. Use when looking for non-CVE bugs that require understanding the app's intended workflow.

日本語の概要は準備中です。原文の説明を表示しています。

Set up nightly monitoring of subdomain changes, JS file diffs, new endpoints, and CVE matches against in-scope assets, with Discord/Slack/Telegram notifications. Use when the user has an active engagement and wants to be alerted to new attack surface without manual re-recon.

日本語の概要は準備中です。原文の説明を表示しています。

Use when writing an SELinux or AppArmor policy, a seccomp-bpf filter, enabling CET, PAC, or BTI, or triaging a kernel CVE. Not for KASAN report analysis: use kernel-debugging.

日本語の概要は準備中です。原文の説明を表示しています。

Use when dependency upgrades need batching for CVEs, a major release, forced compatibility, a scheduled or vulnerability-triggered sweep. Not for PR queue triage: use github-backlog-triage.

日本語の概要は準備中です。原文の説明を表示しています。

Audit dependency freshness — scan outdated deps and CVEs, classify severity, record update/defer/skip decisions in Atrium, gate PASS/WARN/FAIL. Use when checking for outdated packages or deciding whether to upgrade. Trigger on "outdated dependencies", "dependency audit", "are my deps up to date", "should I upgrade".

日本語の概要は準備中です。原文の説明を表示しています。

Detects code quality vulnerabilities in mobile apps (Android/iOS). Trigger on: SQL injection in SQLite, JavaScript injection in WebViews, intent injection, unsafe deserialization, NSKeyedUnarchiver, NSCoding, Java serialization, Parcelable, buffer overflow, JNI native code, PIE disabled, NX disabled, stack canary absent, RELRO, ARC disabled, third-party library CVE, vulnerable dependency, outdated SDK, targetSdkVersion, update enforcement missing, implicit Intent, URL loading in WebView, object persistence, memory corruption, OWASP dependency check. Covers MASVS-CODE-1/2/3/4.

日本語の概要は準備中です。原文の説明を表示しています。

Full penetration test using MCP tools — recon, scanning, exploitation, and reporting. Tailored for OpenCode (BYO LLM). Supports network/web targets and local codebases. Chains into analyze-cve, threat-modeling, and remediate skills automatically.

日本語の概要は準備中です。原文の説明を表示しています。

Java "Ghost Bits" / Cast Attack playbook (Black Hat Asia 2026). Use when attacking Java services where 16-bit char is silently narrowed to 8-bit byte to bypass WAF/IDS for SQL injection, deserialization RCE, file upload (Webshell), path traversal, CRLF injection, request smuggling, and SMTP injection. Affects Tomcat, Spring, Jetty, Undertow, Vert.x, Jackson, Fastjson, Apache Commons BCEL, Apache HttpClient, Angus Mail, JDK HttpServer, Lettuce, Jodd, XMLWriter and re-enables many "patched" CVEs through WAF bypass.

日本語の概要は準備中です。原文の説明を表示しています。

White-box source code security review structured around OWASP ASVS 5.0 (427 verification requirements across 16 chapters). Reads and understands application source code to build a security-aware knowledge base that enriches all downstream skills. Covers: tech stack identification, route/endpoint mapping, authentication and authorization architecture, dangerous function patterns, source-to-sink data flow tracing, IaC review, dependency analysis, ASVS compliance mapping, and LLM integration security (prompt injection, tool abuse, output handling, RAG poisoning, MCP server patterns). When LLM/AI framework usage is detected, automatically reviews OWASP LLM Top 10 patterns from source code and chains into /ai-redteam with white-box context for live endpoint testing. Chains into /pentester, /threat-modeling, /web-exploit, /api-security, /cloud-security, /analyze-cve, /credential-audit, and /ai-redteam — providing white-box context that transforms black-box testing into targeted, informed assessment.

日本語の概要は準備中です。原文の説明を表示しています。

Write a vulnerability report. Use when the user says "vulnerability report", "vuln report", "security finding", "write up this finding", "pentest finding", "bug bounty report", "security disclosure", "CVE writeup", "document this vulnerability", "how to report a security issue", or needs to formally document a security vulnerability with evidence, impact, and remediation guidance - even if they don't explicitly say "report".

日本語の概要は準備中です。原文の説明を表示しています。

Author, validate, test, and deploy YARA-L 2.0 detection rules and evaluate end-to-end detection coverage gaps in Google SecOps. Use when writing new detection rules, tuning existing rules, validating syntax, testing logic against historical telemetry, or evaluating detection coverage against threat intelligence blogs, CVE disclosures, and Threat Detection Opportunities (TDOs) using synthetic UDM events and long-running coverage analysis. Don't use for alert triage (use secops-triage), deep forensic event reconstruction on infected hosts (use secops-investigate), or case management operations (use secops-cases).

日本語の概要は準備中です。原文の説明を表示しています。

Scan code for security vulnerabilities, misconfigurations, and exposed secrets. Use when a user asks to audit security, find vulnerabilities, check for OWASP issues, scan for secrets, review dependencies for CVEs, detect SQL injection, find XSS vulnerabilities, or harden an application. Covers OWASP Top 10, dependency auditing, secrets detection, and generates fix recommendations with severity ratings.

日本語の概要は準備中です。原文の説明を表示しています。

Inventory and prioritize all technical debt in a codebase. Scans for TODO/FIXME/HACK markers and stale comments, outdated and deprecated dependencies with CVE detection, high-churn files and cyclomatic complexity hotspots, duplicated code blocks.

日本語の概要は準備中です。原文の説明を表示しています。

Analyze project dependencies for health, security, and bloat — audit outdated, deprecated, vulnerable, duplicate, heavy, and unused packages across npm, pip, cargo, go mod, and more. Produce a dependency health score, CVE inventory, license compatibility matrix, bundle size impact assessment, and a prioritized update plan with migration paths.

日本語の概要は準備中です。原文の説明を表示しています。

Discovers custom modules (>100 LOC), analyzes purpose, searches OSS alternatives via MCP Research, evaluates quality (stars, license, CVE), generates migration plan.

日本語の概要は準備中です。原文の説明を表示しています。

Checks outdated packages, unused deps, reinvented wheels, vulnerability scan (CVE/CVSS). Supports mode: full | vulnerabilities_only.

日本語の概要は準備中です。原文の説明を表示しています。

Monitor social platforms for security threats, vulnerability discussions, and breach intelligence using Xpoz. Use when asked to "find CVE discussions", "security threat monitoring", "OSINT social media", "vulnerability intelligence", "breach mentions", or "threat intel from Twitter/Reddit".

日本語の概要は準備中です。原文の説明を表示しています。

Security launch audit for a public web app BEFORE you ship or hand it to a client — "vibe coders are getting sued", systematized. An executable pipeline: classify (static / full-stack / AI) → run sections (secrets+supply-chain, DB, auth, infra+headers, legal, LLM/injection) orchestrating deterministic tools + manual checks → GO/NO-GO report. Adapted from Prajwal Tomar's playbook, extended with prompt-injection / supply-chain / secret-history / dependency-CVE layers. NOT the same as pre-push (that = clean push; this = is the product itself safe to launch). Triggers — "security checklist for the site", "audit before launch", "is the site safe", "check before handing to client".

日本語の概要は準備中です。原文の説明を表示しています。

Data structure for annotated matrices in single-cell analysis. Use when working with .h5ad files or integrating with the scverse ecosystem. This is the data format skill—for analysis workflows use scanpy; for probabilistic models use scvi-tools; for population-scale queries use cellxgene-census.

日本語の概要は準備中です。原文の説明を表示しています。

Audit project dependencies for known vulnerabilities (CVEs)

日本語の概要は準備中です。原文の説明を表示しています。

Before adding/installing any dependency the agent named — verify the package exists (slopsquatting: ~1 in 5 AI suggestions are hallucinated), isn't typo-adjacent, is pinned + locked, and CVE-scanned

日本語の概要は準備中です。原文の説明を表示しています。