317 件 ・ 関連度順
概要と使いどころ
Use when attacking or auditing a CI/CD pipeline or software supply chain — pwn requests, poisoned pipeline execution, compromised/mutable-tag actions, dependency confusion, registry worms, runner backdoors, OIDC trust abuse, SLSA/provenance
日本語の概要は準備中です。原文の説明を表示しています。
Guide to Sonner, the React toast library — install and wire up the Toaster, pick the right toast() call, promise and loading toasts, updating, dismissing and persisting toasts, styling, theming and icons, positioning and multiple toasters. Use when working with Sonner or troubleshooting it — toasts that don't appear, appear twice, lose their styles, ignore Tailwind classes, sit behind a modal, or don't follow dark mode.
日本語の概要は準備中です。原文の説明を表示しています。
根据主题、正文或已有标题生成并筛选小红书标题，提供改写和 A/B 方案，同时检查账号调性、真实性以及正文能否兑现标题承诺。用户要起标题、改标题、套用标题模式或检查标题时使用。 English: Generate and filter Xiaohongshu titles from a topic, draft, or existing title, offering rewrites and A/B options while checking voice, truthfulness, and whether the content fulfills the promise. Use to write, improve, pattern-match, or review titles.
日本語の概要は準備中です。原文の説明を表示しています。
在短视频正文完成后，检查并生成前五秒开头，让开场更抓人、可信，并与正文承诺一致。用户要求优化视频开头、降低开头流失、写口播 Hook 或增强第一句话时使用。 English: Diagnose and write the first five seconds of a short video after the main script is ready, making the opening engaging, credible, and consistent with the video's promise. Use to improve retention, create a spoken hook, or strengthen the first line.
日本語の概要は準備中です。原文の説明を表示しています。
Triage acc's open promises and close them with honest real-world verdicts via acc_act(runtime="outcome").
日本語の概要は準備中です。原文の説明を表示しています。
Detect known malicious npm package versions and install-time supply-chain indicators in repositories, lockfiles, and node_modules. Use when a user mentions an npm compromise, Shai-Hulud, the Keyv/cacheable incident, suspicious preinstall scripts, credential-stealing packages, or asks whether a JavaScript project was exposed to a package supply-chain attack. Do not use as a general CVE or license audit.
日本語の概要は準備中です。原文の説明を表示しています。
Fix Cloudflare Workers Error 1101 "Worker threw exception" caused by Hono sub-app route handlers returning undefined instead of a Response. Use when: (1) Error 1101 on a specific hostname but not others sharing the same worker, (2) "the Promise did not resolve to 'Response'" in wrangler dev logs, (3) Hono sub-app route handler uses bare `return` to skip handling for non-matching hostnames or conditions. The fix is to add `next` parameter and call `return next()` instead of bare `return` in route handlers that conditionally skip.
日本語の概要は準備中です。原文の説明を表示しています。
Fix NDK (Nostr Dev Kit) operations hanging indefinitely when relay connections stall. Use when: (1) App freezes during fetchEvents or publish calls, (2) No timeout errors despite network issues, (3) Relay connection appears stuck, (4) Using NDK with unstable or slow relays. NDK operations have no built-in timeout - wrap with Promise.race.
日本語の概要は準備中です。原文の説明を表示しています。
Abusing Active Directory object ACLs (DACL/ownership) for privilege escalation and lateral movement (GenericAll, GenericWrite, WriteDACL, WriteOwner, AddMember, ForceChangePassword, and replication rights via DS-Replication-Get-Changes-All). Use when BloodHound CE shows an outbound control edge from a principal you own toward a higher-value object, and you want the exact bloodyAD/impacket command to weaponize that ACE, plus detection and remediation. DCSync is covered here strictly as a post-compromise technique, not a user entry path.
日本語の概要は準備中です。原文の説明を表示しています。
Plan and scope production work with Odyssey's real-time interactive video world models (odyssey.ml — Odyssey-1/Odyssey-2/Starchild-1/Agora-1). Use when a request involves generating video that a user steers live with keyboard, text, speech, or controller input (streamed frames that respond in the moment), or when someone must decide between Odyssey-style interactive generation and offline clip generators (Sora/Veo/Kling) or downloadable 3D / game engines. Covers what is verified versus announced, current access routes, latency and coherence limits, feasible-now versus speculative use cases, pricing/access terms, and content/rights considerations. This is a fast-moving research-stage product; the skill teaches honest scoping, not a promise of production reliability.
日本語の概要は準備中です。原文の説明を表示しています。
Plan, produce, adapt, finish, deliver, and improve platform-ready short vertical social videos from a brief, script, transcript, or source media. Use for TikTok videos, Instagram or Facebook Reels, YouTube Shorts, LinkedIn vertical clips, and cross-platform social cutdowns when the work requires audience and objective definition, an honest hook and promise, short-form beat or shot planning, UI-safe layout, captions and accessibility, speech/music/SFX mixing, platform-specific exports, rights and AI or sponsorship disclosure, analytics-led retention iteration, or final QA and repair. Do not use as a provider-specific image, video, voice, or music generation guide.
日本語の概要は準備中です。原文の説明を表示しています。
World-class brand positioning expertise combining David Ogilvy's direct response wisdom, Emily Heyward's obsessive brand strategy (Red Antler), and Al Ries/Jack Trout's positioning classics. This skill answers: "What space do we own in the customer's mind, and why does it matter?" Brand isn't what you say about yourself - it's what others say when you're not in the room. Positioning isn't about creativity - it's about claiming territory in an overcrowded mind. Use when "brand positioning, positioning statement, brand strategy, category design, competitive positioning, how should we position, brand differentiation, value proposition, what makes us different, brand platform, brand values, brand personality, brand promise, brand manifesto, tagline, unique selling proposition, usp, category creation, own a word, mind share, brand, positioning, strategy, differentiation, category, competitive, values, identity" mentioned.
日本語の概要は準備中です。原文の説明を表示しています。
影视编剧 (Scriptwriting / Screenwriting) — 为电影 / 电视 / 流媒体剧集写戏剧蓝本的从业者认知操作系统: 决定「讲什么故事、人物是谁为何转变、场景如何被戏剧化、主题为何重要」的学科 —— 区别于导演 (调度 / 视觉实现)、制片 (融资 / 排期)、小说 (无格式 / 场景 / 视觉动作约束)。覆盖 (a) 故事与结构理论 (亚里士多德《诗学》情节 / 人物 / 思想 + 突转 peripeteia / 发现 anagnorisis + 净化 catharsis; Syd Field 范式 / 三幕 / 情节点; Freytag 金字塔; Egri 前提; McKee《故事》掌控性理念 / 鸿沟 / 价值正负转变 / 激励事件 / 渐进式复杂化; Truby《故事剖析》22 步 + 道德论证; Vogler/Campbell 英雄之旅; Blake Snyder《救猫咪》15 拍节拍表; Dan Harmon 故事环; John Yorke 五幕《进入森林》; Frank Daniel 八序列法; 起承转合东亚戏剧结构), (b) 人物 (想要 vs 需要 / 外在目标 vs 内在缺失, 人物弧光 正 / 负 / 平, flaw-wound-ghost 创伤背景, 主动 vs 被动主角的能动性, Egri 三维人物 生理 / 社会 / 心理, 反派是主角的镜子, 群像与关系网, 人物在压力下的选择中显形), (c) 对白 (潜台词 subtext, 对白即动作与冲突而非信息, 避免太直白 on the nose, 人物独特声口, 信息植入 exposition, Mamet/Sorkin 意图-阻碍式对白, 展示而非告知, 中文剧台词工艺), (d) 场景与序列工艺 (场景是有目标 / 冲突 / 转折的微型故事, 场景价值充能与转折点, 晚进早出, 八序列法, set piece, 转场, 场景头 / 动作行 / 括号提示 格式工艺), (e) 主题与前提 (掌控性理念 / 前提, 主题是被戏剧化的论证而非说教, 道德论证 Truby, 主题统一性, 这到底在讲什么), (f) 类型 (类型惯例是对观众的承诺, Snyder 10 类故事, 颠覆 vs 尊重套路, 类型片 vs 文艺片, 中国类型 主旋律 / 古装 / 年代 / 悬疑 / 甜宠 / 都市 / 军旅 / 历史正剧), (g) 格式与工业流程 (好莱坞剧本格式与 Final Draft, logline 一句话故事, treatment 故事大纲, 节拍表, 分场 / 分集大纲, spec 原创剧本 vs 委托, pitch, coverage, 美剧编剧室与 showrunner 制; 中国 大纲→人物小传→分集大纲→剧本, 长剧集 40 集结构, 网络电影 / 网大, 分账剧, 平台定制剧, 微短剧竖屏短剧), (h) 改稿与开发 (写作就是改写, 改稿 / 润色 / 推倒重写, 处理意见 / 改稿意见, 片方与平台 notes, 杀死你的宝贝, 围读, 开发地狱), (i) 改编 (IP改编 小说 / 漫画 / 游戏改编, 忠于精神而非字句, 压缩, 中国网文 IP 热), (j) 中国影视编剧产业现实 (审查 / 广电总局约束, 备案 / 立项, 平台定制剧 爱优腾芒, 分账, 编剧维权 署名权 / 欠薪 / 枪手, 注水剧, 流量 + 大IP 资本逻辑 vs 原创工艺, 导演中心制 vs 编剧话语权), (k) 编剧职业与工艺生涯 (spec vs 委托, 编剧 vs 编审 / 策划, 单兵 vs 编剧室, 在开发链条中的位置, WGA 与署名仲裁规范, 入行, 中国编剧地位与权益)。跨 电影 / 美剧流媒体 / 中国电影与长剧集。不含 导演 / 摄影 / 制片 / 融资 / 表演 / 电影理论批评为终点 / 泛小说写作 / 纪录片 / 新闻 —— 本 skill 是「戏剧化编剧」工艺: 故事 / 人物 / 场景 / 对白 / 主题 / 结构 / 格式 与围绕它们的产业流程。 (Scriptwriting / Screenwriting for film & TV (影视编剧) — the cognitive operating system of practitioners who write the dramatic blueprint of films, television, and streaming series: the discipline of deciding WHAT story is told, WHO the characters are and why they change, HOW the scenes are dramatized, and WHY it matters thematically — distinct from directing (staging/visual realization), producing (financing/scheduling), and prose fiction (which has no format/scene/visual-action constraints). Covers (a) story & structure theory (Aristotle's Poetics — plot/character/thought + reversal peripeteia/recognition anagnorisis + catharsis; Syd Field's paradigm/three-act/plot points; Freytag's pyramid; Lajos Egri's premise; Robert McKee's Story — controlling idea/the gap/value charge/inciting incident/progressive complications; John Truby's 22 steps & moral argument; Christopher Vogler/Joseph Campbell hero's journey; Blake Snyder's Save the Cat 15-beat sheet; Dan Harmon's story circle; John Yorke's 5-act Into the Woods; Frank Daniel's 8-sequence method; 起承转合 East-Asian dramatic structure), (b) character (want vs need/external goal vs internal lack, character arc positive/negative/flat, 人物弧光, flaw-wound-ghost backstory, agency active vs passive protagonist, Egri's 3-dimensional character physiology/sociology/psychology, antagonist as the protagonist's mirror, ensemble & relationship webs, character revealed through choice under pressure), (c) dialogue (subtext 潜台词, dialogue as action & conflict not information, 'on the nose' avoidance, distinct character voice, exposition handling, Mamet/Sorkin intention-obstacle dialogue, show-don't-tell, 台词 craft in Chinese drama), (d) scene & sequence craft (scene as a mini-story with goal/conflict/turn, scene value charge & turning point, enter-late-leave-early, the 8-sequence method, set pieces, transitions, slug line/action line/parenthetical format craft), (e) theme & premise (controlling idea/premise/前提, theme as dramatized argument not message, moral argument Truby, thematic unity, 'what is this really about'), (f) genre (genre conventions as audience promise, Snyder's 10 story types, subverting vs honoring tropes, 类型片 vs 文艺片, Chinese genres 主旋律/古装/年代/悬疑/甜宠/都市/军旅/历史正剧), (g) format & industry process (Holly
日本語の概要は準備中です。原文の説明を表示しています。
红队渗透 / 攻防 — 受授权的红队作业者 + 渗透测试工程师 + 攻击型安全顾问的认知操作系统 (侦察 OSINT / 外网渗透 / 内网 AD 渗透 BloodHound + Kerberoasting + ADCS 利用 + 横向移动 / Web 应用渗透 OWASP WSTG / 移动 OWASP MASTG / 云渗透 AWS Azure GCP IAM 路径 + 容器逃逸 + K8s / C2 操作 Cobalt Strike Sliver Mythic Havoc + OPSEC / 初始访问 + AV EDR 绕过 (仅授权场景) / 无线 RF / 物理社工 / 报告与整改 / 框架 MITRE ATT&CK + D3FEND + PTES + OSSTMM + NIST 800-115 + Kill Chain / 法律伦理 CFAA + 网络安全法 + 刑法 285 286 + 数据安全法 + GDPR + 授权书 + 范围 + 交战规则 — 不含 黑产 / 未授权攻击 / 大规模 exploitation / 供应链投毒 / 未授权 DoS — 这是 重罪 + 行业封杀 + 律师吊销, 本 skill 严守 authorized-only 边界 — 也不含 蓝队 SOC + 恶意软件 即服务 / 僵尸网络 / 勒索软件作者 — 这是 cybercrime 不是 红队) (Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasion (phishing infrastructure, payload development, AV / EDR evasion, BYOVD, AMSI / ETW bypass — strictly for authorized engagements), (i) wireless / RF (WPA2/3, evil twin, Wi-Fi pivots), (j) physical / social engineering (badge cloning, pretexting, vishing — under engagement letter), (k) reporting & remediation (executive summary, technical findings, CVSS, MITRE ATT&CK mapping, retest), (l) frameworks & methodology (MITRE ATT&CK, MITRE D3FEND, PTES, OSSTMM, NIST SP 800-115, OWASP WSTG / MASTG, Cyber Kill Chain, Unified Kill Chain, Diamond Model), (m) law & ethics (CFAA US, Computer Misuse Act UK, 中国 刑法 285/286 + 网络安全法 + 数据安全法, GDPR for tested EU systems, engagement letter, scope, rules of engagement, safe harbor for bug bounty); NOT criminal hacking / 黑产 / unauthorized targeting / mass exploitation / supply-chain compromise / DoS against unconsented systems (这是 重罪 + 业内开除 + 律师执照吊销, 本 skill 严守 authorized-only 边界), NOT pure defensive blue team / SOC analyst tradecraft (是 平行学科, 仅做 边界标注 + ATT&CK 反推方向), NOT malware-as-a-service development / botnet ops / ransomware authoring (是 cybercrime 不是 红队), NOT 'ethical hacking' 在 'just curious 看看' 自我合理化的灰色操作 (违反 authorization 原则即不是 红队).) Master OS — automated mastery of Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasi
日本語の概要は準備中です。原文の説明を表示しています。
Apply David Ogilvy's advertising principles when writing or reviewing copy, headlines, product descriptions, landing pages, ads, emails, or any persuasive text. Use when the goal is copy that sells, not copy that wins awards. Covers positioning, headlines, promises, brand voice, long-form copy, and visual logic. Source: How to Create Advertising That Sells (1972) + Ogilvy on Advertising.
日本語の概要は準備中です。原文の説明を表示しています。
Build a long-form X (Twitter) thread (tweetstorm) using a 2026 thread formula (listicle-thread, story thread, curiosity-gap opener, how-I teardown), picked by goal (bookmarks, likes, reposts, replies). Structures tweet 1 as a promise plus open loop, paces one beat per tweet, and closes for the repost. Publishes via Publora, which auto-splits long content into a numbered (1/N) thread. Not for single tweets (use x-post-writer) or auditing a draft (use x-humanizer --mode audit).
日本語の概要は準備中です。原文の説明を表示しています。
Suede Labs skill that prepares a song for sync pitching: scene and emotional angles, a supervisor-facing one-sheet, an exists/missing/unknown asset checklist covering master, instrumental, clean, and stems, screened lyric flags, mood tags, and the open clearance questions kept in their own labeled pile. Use when a track is headed for film, TV, ads, games, trailers, or creator campaigns; when a music supervisor, sync agent, or brand asks what a song is and whether it can be used; or when someone asks for a one-sheet, pitch email, or sync package for a release. Prepares review-ready materials only: never claims clearance, promises placement, or sends outreach. NOT FOR: finding and organizing the rights gaps behind an open clearance question (use suede-rights-audit); building the rights transfer package (use suede-rights-passport); linting the release folder itself (use suede-release-linter); a full rollout campaign (use suede-campaign-in-a-box).
日本語の概要は準備中です。原文の説明を表示しています。
Suede-owned recovery discipline for recurring charges billed outside Amazon: App Store, Google Play, PayPal, direct-bill streaming, gyms, news, and SaaS. Use when the user wants to find, audit, cancel, or dispute a subscription they may have forgotten, is being charged for twice, or no longer uses. Every cancellation and dispute requires the user to name the service first. Never enters payment credentials and never promises a refund. Requires Claude in Chrome for browser actions. NOT FOR: Amazon returns, restocking fees, or Amazon-billed Prime Video Channels, Audible, Kindle Unlimited, or Prime (use amazon-returns-recovery); merchant-side dunning and cancel-flow design (use suede-churn-prevention).
日本語の概要は準備中です。原文の説明を表示しています。
Suede-affiliated Amazon money-recovery audit for restocking fees, short or denied refunds, and Amazon-billed subscriptions. Use when the user mentions a restocking fee, a short or denied Amazon refund, or a forgotten Prime Video Channel, Audible, Kindle Unlimited, or Prime charge, or asks whether Amazon still owes or bills them. Read-only discovery; no chat, cancellation, or dispute without the account owner's per-item confirmation, and never a promise of recovery. Requires an authenticated Claude in Chrome session. NOT FOR: bank chargebacks, marketplace A-to-z seller claims, price-protection claims, or subscriptions billed outside Amazon (use subscription-recovery).
日本語の概要は準備中です。原文の説明を表示しています。
Audit JS/TS projects against NPM Security Guidelines covering project setup, dependency hygiene, CI/CD pipeline, Dependabot, and incident response. Use when reviewing package.json or lockfiles, adding or upgrading npm dependencies, setting up CI security gates, hardening a new repo, or responding to a compromised package.
日本語の概要は準備中です。原文の説明を表示しています。
What to do the moment a secret is exposed — pasted into chat, committed, logged, shown in a transcript or a screenshot. The secret is compromised; only revoking and rotating it helps. Turns it into one tracked task with an escalation, not a reminder repeated every session. Use when you see a key, token, password or private key anywhere it should not be ("ключ в чате", "токен в логах", "закоммитил .env"). Loaded by security-officer, l3-support, devops.
日本語の概要は準備中です。原文の説明を表示しています。
What the desk does when something goes wrong on Hyperliquid - unknown send results, unexpected fills or positions, unprotected positions, stuck or orphaned orders, API outages, rate limiting, and suspected API wallet compromise. Contain first, reconcile from the exchange record, act only through approved tickets, then review. Use the moment anything does not match the ticket.
日本語の概要は準備中です。原文の説明を表示しています。
Auditing skill/plugin/MCP supply chains and live package compromise: manifests, hidden injection, IoC scans, persistence-first eradication, and gated credential rotation. Not for app SAST (Sentinel).
日本語の概要は準備中です。原文の説明を表示しています。
把缠论分析变成先定级别、再认结构、先写失效点的可执行研究流程。Use for A-share, HK-stock, ETF, index, or futures analysis with 中枢、分型、笔、线段、背驰、区间套、三类买卖点 and multi-level recursion, or for converting Chan theory into reproducible backtest rules. Research and study only; never issue stock tips or promise returns.
日本語の概要は準備中です。原文の説明を表示しています。