297 件 ・ 関連度順
概要と使いどころ
Attack Tree Construction workflow skill. Use this skill when the user needs Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.
日本語の概要は準備中です。原文の説明を表示しています。
Attack Tree Construction workflow skill. Use this skill when the user needs Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.
日本語の概要は準備中です。原文の説明を表示しています。
Use this skill whenever reasoning about immunology, host-pathogen interactions, innate immunity, Toll-like receptors (TLRs), or experimental design in molecular biology. It is also highly relevant for scientific career strategy, particularly when discussing independence, pivoting research domains, or using reverse genetics (like knockout mice) for discovery. Channel Shizuo Akira, immunologist and pioneer of pattern-recognition receptors, to apply rigorous experimental standards (e.g., demanding chemically synthesized mimics over purified extracts) and to view innate immunity as a highly specific, compartmentalized system rather than a primitive defense.
日本語の概要は準備中です。原文の説明を表示しています。
Drafts structured insurance coverage opinions analyzing duty to defend and duty to indemnify for carriers. Applies eight corners rule, policy exclusion analysis, and state-specific law. Use when a carrier receives a claim or lawsuit, needs a coverage determination, reservation of rights analysis, or defense obligation assessment.
日本語の概要は準備中です。原文の説明を表示しています。
Expert guide for defending AI applications against prompt injection, jailbreak attacks, indirect injection via tool outputs, and data exfiltration through tool calls — input sanitization, output filtering, canary token detection, and layered defense architecture / Panduan ahli pertahanan aplikasi AI terhadap prompt injection, serangan jailbreak, injeksi tidak langsung via output tool, dan eksfiltrasi data melalui tool calls — sanitasi input, filtering output, deteksi canary token, dan arsitektur pertahanan berlapis.
日本語の概要は準備中です。原文の説明を表示しています。
Expert guide for Prompt Engineering, Chain-of-Thought, few-shot prompting, structured output, prompt injection defense, and automated AI evaluations & regression benchmarking (Promptfoo, DeepEval) / Panduan ahli rekayasa prompt dan evaluasi otomatis AI.
日本語の概要は準備中です。原文の説明を表示しています。
Go-based security techniques from "Black Hat Go" extended with macOS, Cloud, Mobile, IoT, Supply Chain, API, Web3, AI/ML, Red Team, ATT&CK, and LLM chapters. 186 techniques, 36 tools, 33 defenses across 37 chapters. Includes adversarial bisimulation games with Ungar (order-dependent) and join-semilattice structures. AAIF-compatible multiplayer agent games for human-agent security exercises.
日本語の概要は準備中です。原文の説明を表示しています。
Use whenever the user wants to find, shortlist, vet, or enrich US B2B law firms — corporate, IP/patent, M&A and securities, employment, commercial litigation, regulatory/compliance, data privacy/cyber, real estate, and tax. Triggers on "find three boutique IP law firms in California", "shortlist M&A counsel for a Series-B fundraise", "patent prosecution for our hardware startup", or "pull contact info for these 10 law firm domains", even when described indirectly (outside counsel, cap-table review, GDPR/SOC2 oversight). Drives the ServiceGraph API (api.servicegraph.co) — a 100k+ US firm catalog filterable by industry, services, location, size, ratings. Skip personal/consumer legal services where the user is the end client (divorce, personal injury, criminal defense, family law, estate planning, wills) — the catalog is B2B-only. Also skip in-house GC hires, "is this NDA enforceable" DIY questions, non-US firms, individual freelancers.
日本語の概要は準備中です。原文の説明を表示しています。
Endpoint defense evasion after an operator-selected chain already has a valid execution path but AV/EDR/AMSI/WDAC/PPL/memory/kernel telemetry blocks the intended action. Originating modules include /web-attack /ad-attack /cloud-attack /k8s /cicd /service-attack /phishing /privesc-win /privesc-linux /creds /post /shell. Success is the blocked action becoming executable, then resume the originating module — not obtaining a shell here.
日本語の概要は準備中です。原文の説明を表示しています。
Use when the user explicitly asks EZ_math_model to create defense slides, academic presentation slides, Beamer slides, or PPT after the modeling paper has been packaged.
日本語の概要は準備中です。原文の説明を表示しています。
Adversarial, security-first review of a pull request from an EXTERNAL or untrusted contributor — a fork PR, a first-time or unknown author, anyone without write access — before a maintainer merges it. Use this whenever you're reviewing, triaging, or deciding whether to merge a PR opened against tbh-meter by someone outside the maintainer team: 'review PR #123', 'someone opened a PR — is it safe to merge?', 'check this contributor's changes', 'can we take this fork PR?', 'is this contribution legit?'. This is supply-chain DEFENSE, not ordinary code review: every merged PR auto-updates onto every user's machine and ships a memory-reading .exe plus an unsandboxed Electron app, so the author and the PR description are UNTRUSTED and the diff is the only evidence. It posts its verdict as a real GitHub review — an inline comment pinned to each problematic line (via the pulls/reviews API), not just one summary comment. NOT for your own or a fellow maintainer's branch (use self-review for that), and prefer this over the generic review flow for anything coming from outside the team.
日本語の概要は準備中です。原文の説明を表示しています。
Conduct structured insect behavior observations using sampling protocols, ethogram categories, event recording, interaction logging, environmental context, and summary analysis. Covers focal animal sampling, scan sampling, all-occurrences sampling, and instantaneous sampling methods. Defines a standard insect ethogram with locomotion, feeding, grooming, mating, defense, communication, and rest categories. Includes timestamped event recording, intraspecific and interspecific interaction logging, environmental covariate documentation, and time budget analysis. Use when studying insect behavior for ecological research, documenting behavioral repertoires for a species, observing pollinator activity or predator-prey dynamics, or supporting conservation assessments with behavioral data.
日本語の概要は準備中です。原文の説明を表示しています。
Extract data from web pages using the scrapling Python library — select the appropriate fetcher tier (HTTP, stealth Chromium, or full browser automation) based on target site defenses, configure headless browsing, and extract structured data with CSS selectors. Use when WebFetch is insufficient for JS-rendered pages, anti-bot-protected sites, or structured multi-element extraction requiring DOM traversal.
日本語の概要は準備中です。原文の説明を表示しています。
Validate at every layer data passes through to make bugs impossible
日本語の概要は準備中です。原文の説明を表示しています。
Executes structured recovery from a ransomware incident following NIST and CISA frameworks, including environment isolation, forensic evidence preservation, clean infrastructure rebuild, prioritized system restoration from verified backups, credential reset, and validation against re-infection. Covers Active Directory recovery, database restoration, and application stack rebuild in dependency order. Activates for requests involving ransomware recovery, post-encryption restoration, or disaster recovery from ransomware.
日本語の概要は準備中です。原文の説明を表示しています。
"M&A integration playbook covering eight modules: strategic rationale, target screening, due diligence (financial/legal/commercial), valuation with valuation bridge, synergy analysis, deal structuring (stock vs. asset, cash vs. equity, earn-out), SPA key clauses, and post-merger integration (PMI). Use for deal evaluation, valuation disputes, structure design, earn-out design, synergy breakdown, integration risk, or hostile takeover defense. Triggers: 『併購』『收購』『M&A』『盡職調查』『DD』『估值橋』『綜效』『earn-out』『換股比例』『PMI』『買殼』『借殼上市』『敵意併購』『交易結構』. For Taiwan EMBA 財管組 case studies and term reports (台大／政大／陽交). Complements Asgard `biz-dcf` and `fin-modeling` (valuation tools) plus `biz-corporate-governance` (governance layer) by providing the transaction-layer framework.".
日本語の概要は準備中です。原文の説明を表示しています。
"Corporate-governance practice playbook: board composition, three lines of defense, audit/compensation/nomination committee operations, independent-director governance, stakeholder communication, IPO governance upgrade, and family-business professionalization. Use for board-structure design, independent-director selection, three-lines implementation, IPO governance preparation, major governance incidents (fraud, scandal, insider trading), or family-business corporatization. Triggers: 『董事會組成』『獨董沒發揮功能』『三道防線』『上櫃治理補強』『家族法人化』『委員會分工』『ESG 治理』『審計委員會』『薪酬委員會』『提名委員會』. For Taiwan EMBA corporate-governance/finance/law/ESG cases. Focuses on listed-company and IPO practice; governance theory: use Asgard `grad-governance`; 9-box/繼任規劃/接班人才盤點: use `ops-talent-strategy`; COSO ERM/風險地圖/風險委員會運作: use `biz-erm`.".
日本語の概要は準備中です。原文の説明を表示しています。
Execute advanced evasion by injecting malicious code into the memory space of a legitimate, suspended process (Process Hollowing). This skill details techniques to bypass static and dynamic analysis by masking malicious activity behind trusted processes like svchost.exe or explorer.exe.
日本語の概要は準備中です。原文の説明を表示しています。
LLM prompt injection playbook. Use when testing AI/LLM applications for direct injection, indirect injection via RAG/browsing, tool abuse, data exfiltration, MCP security risks, and defense bypass techniques.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit CVE-2023-36884, a critical Remote Code Execution vulnerability in Windows and Office associated with the Storm-0978 APT. This skill covers the weaponization of malicious Word documents to achieve code execution upon opening, bypassing Mark-of-the-Web (MotW) defenses.
日本語の概要は準備中です。原文の説明を表示しています。
CSRF testing playbook. Use when reviewing state-changing web flows, anti-CSRF defenses, SameSite behavior, JSON CSRF, login CSRF, and OAuth state handling.
日本語の概要は準備中です。原文の説明を表示しています。
Utilize the native Windows binary `certutil.exe` to download malicious payloads and optionally decode Base64 encoded files as a Living-off-the-Land (LotL) technique. This skill details how attackers bypass application whitelisting and fetch stage-2 implants.
日本語の概要は準備中です。原文の説明を表示しています。
Create and implement Malleable C2 profiles in Cobalt Strike to evade network intrusion detection systems (NIDS/IPS) and endpoint detection architectures. This skill focuses on molding the Beacon's HTTP/HTTPS traffic to resemble legitimate network traffic like Amazon, Google, or jQuery.
日本語の概要は準備中です。原文の説明を表示しています。
Bypass AI safety filters by encoding malicious prompts using ciphers and obfuscation techniques (e.g., Base64, ROT13, Leetspeak, Morse code). This skill exploits the gap where the LLM can decode the request, but intermediate keyword-based safety classifiers cannot.
日本語の概要は準備中です。原文の説明を表示しています。