「strict」の検索結果

Hunt SAML / SSO attacks. Patterns: XML Signature Wrapping (XSW) — modify Assertion while keeping Signature valid by relocating signed element, comment injection in NameID (admin@target.com<!--evil-->@attacker.com → some parsers see admin@target.com), signature stripping (remove Signature element entirely, server should reject but doesn't), key confusion (signed by attacker's IdP, accepted by SP), audience-restriction not validated, replay attack (same Assertion accepted twice within validity window). Tools: SAML Raider Burp extension, samlmagic, manual XML manipulation. Detection: any /saml endpoint, /Shibboleth.sso, /sso/saml/, Microsoft ADFS endpoints. Validate: account takeover via altered NameID, admin role injection via altered AttributeStatement. Use when hunting SSO flows, when SAML AssertionConsumerService is reachable, when chaining IdP-trust to SP-impersonation.

日本語の概要は準備中です。原文の説明を表示しています。

This skill should be used when the user asks to "write an experiment report", "summarize experimental results", "do experiment retrospection", "write a results report", "写实验总结报告", "写实验复盘", or mentions turning completed experiment artifacts into a structured, decision-oriented research report. It assumes strict analysis should come from `results-analysis` first.

日本語の概要は準備中です。原文の説明を表示しています。

APSA style checker for Quarto (.qmd) files. Checks numbers, capitalization, abbreviations, italics, in-text citations, titles of works, neutral and unbiased language, and APSA-specific terminology against the APSA Style Manual for Political Science (2018, updated 2023). Produces a structured markdown report organized by document section — never modifies the source file. Use when asked to check APSA style, fix citations, review capitalization, check number formatting, or flag biased language in a .qmd document. For grammar, spelling, and punctuation, use the proofread skill instead. Supports an optional output-file argument and an optional @sec-label argument to restrict checking to one section.

日本語の概要は準備中です。原文の説明を表示しています。

Prose quality checker for Quarto (.qmd) files, grounded in William Zinsser's *On Writing Well* (30th Anniversary Edition). Checks for clutter, weak verbs, hollow qualifiers, clichés, inflated academic voice, poor leads and endings, pronoun and tense inconsistency, and unclear explanation. Produces a structured markdown report organized by document section — never modifies the source file. Use when asked to improve prose quality, tighten writing, reduce clutter, or apply Zinsser's writing principles to a draft. For grammar and punctuation, use the proofread skill. For APSA style rules, use the apsa-style skill. Supports an optional output-file argument and an optional @sec-label argument to restrict checking to one section.

日本語の概要は準備中です。原文の説明を表示しています。

Takes a proofread or apsa-style report file (or any markdown file using **Original:** / **Recommended:** syntax) and rewrites the original source file with git merge conflict markers so the user can accept or reject each suggested edit using VS Code or Positron's built-in merge conflict UI. Branch names are "original" and "claude-edits". Use when asked to apply edits, insert conflict markers, or set up merge resolution for a copy-edit report. Supports an optional @sec-label argument to restrict markers to one section.

日本語の概要は準備中です。原文の説明を表示しています。

Expert copy editor for Quarto (.qmd) files. Checks grammar, spelling, punctuation, and academic writing quality. Produces a structured markdown report organized by document section — never modifies the source file. Use when asked to proofread, check grammar, fix typos, or review prose in a .qmd document. For APSA style rules (numbers, citations, capitalization, abbreviations, neutral language), use the apsa-style skill instead. Supports an optional output-file argument and an optional @sec-label argument to restrict checking to one section.

日本語の概要は準備中です。原文の説明を表示しています。

This skill covers formal identification arguments and proofs in structural and reduced-form econometrics. Use when the user needs to prove or formalize that a parameter is identified — including writing identification propositions, stating regularity conditions, deriving rank conditions, or showing observational equivalence fails. Triggers on "identification proof", "identification argument", "identify the parameter", "show identification", "identification condition", "exclusion restriction proof", "rank condition", "order condition", "identification strategy formal", "nonparametric identification", "parametric identification", "local identification", "global identification", "observational equivalence", "identification at infinity", "completeness condition", "regularity conditions", "Rothenberg", "proof of identification", "identification result", "identified parameter", "point identified", "set identified", "partial identification".

日本語の概要は準備中です。原文の説明を表示しています。

This skill covers causal inference methods in observational and quasi-experimental settings. Use when the user is implementing, choosing between, or debugging causal identification strategies — including instrumental variables, difference-in-differences, regression discontinuity, synthetic control, or matching estimators. Triggers on "causal effect", "identification strategy", "instrumental variable", "2SLS", "GMM", "difference-in-differences", "DiD", "staggered treatment", "regression discontinuity", "RDD", "synthetic control", "matching", "propensity score", "IPW", "AIPW", "doubly robust", "LATE", "ATT", "ATE", "parallel trends", "exclusion restriction", "first stage", "weak instruments", or "endogeneity".

日本語の概要は準備中です。原文の説明を表示しています。

Upgrade of chinese-ppt for Chinese Beamer decks (xelatex + ctex + fandol, CUFE template). Same 7-section outline and X→M→Y framework, but adds (a) mandatory 1.3 line-spacing + 3pt paragraph spacing, (b) overflow-prevention line budget + balanced split-frame rules, (c) prose rewrites that strip AI-ish "关键比较/理论映射" labels and redundant 章节括号注释, (d) stricter CJK-space + middle-dot rules, (e) retrofit workflow for existing chinese-ppt decks, (f) mandatory local linespread reset inside TikZ / table / fixed-geometry frames. Use for "做中文学术PPT 2 版"、"中文 Beamer 改进版"、"答辩 PPT chinese-ppt2"、"防越界 PPT"等请求。用户在 Overleaf 编译，只产出 .tex + figures/，不要附加 compile 脚本。

日本語の概要は準備中です。原文の説明を表示しています。

Guide users through writing a systematic literature review (SLR) following the PRISMA 2020 framework. Use this skill whenever the user mentions 'systematic review', 'systematic literature review', 'SLR', 'PRISMA', 'PRISMA 2020', 'PRISMA flow diagram', 'PRISMA checklist', or asks for help writing, structuring, or auditing a literature review that follows reporting guidelines. Also trigger when the user asks about inclusion/exclusion criteria for a review, search strategies for databases like Scopus/WoS/PubMed, study selection processes, risk of bias assessment, or narrative synthesis for a review paper. This skill covers the full PRISMA 2020 checklist (27 items), produces a Word document manuscript in strict journal article format, generates an annotated PRISMA flow diagram, and enforces APA 7th Edition referencing throughout. It does NOT cover meta-analysis or statistical pooling. By Chuah Kee Man.

日本語の概要は準備中です。原文の説明を表示しています。

Analyzes performance by day of week and hour of day across your campaigns. Identifies when your ads perform best and worst, recommends ad schedule adjustments with estimated savings, and tells you exactly what you'd give up by restricting hours. Platform: Google and Meta.

日本語の概要は準備中です。原文の説明を表示しています。

Write or rewrite text in plain, layman-readable English in the spirit of ASD-STE100 Simplified Technical English: short sentences, active voice, simple tenses, one word one meaning, condition before command, every technical term defined at first use, no AI slop. Default mode is Plain. Strict mode applies full STE vocabulary compliance when the user names STE, ASD-STE100, or compliance. Use for documentation, READMEs, runbooks, procedures, error messages, release notes, incident reports, API guides, and explanations for readers outside the field. Also use when the user says "STE", "Simplified Technical English", "ASD-STE100", "plain English", "layman's terms", "explain it simply", "no jargon", "de-slop", "make this readable", "write for non-native readers", or asks for docs that translate well. The same rules govern the reply: answer first, prose only.

日本語の概要は準備中です。原文の説明を表示しています。

Applies strict, modern language practice (typed errors, exhaustive match, tests that can fail) for Python, Rust, TypeScript, and Go. Use for work on .py, .rs, .ts, or .go files.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks how to build with OpenAI products or APIs and needs up-to-date official documentation with citations (for example: Codex, Responses API, Chat Completions, Apps SDK, Agents SDK, Realtime, model capabilities or limits); prioritize OpenAI docs MCP tools and restrict any fallback browsing to official OpenAI domains.

日本語の概要は準備中です。原文の説明を表示しています。

Check the live status of the Strait of Hormuz from the Hormuz Strait Monitor dashboard: open, restricted, or closed status, tanker transits vs normal, stranded vessels, Brent price impact, war-risk insurance levels, cargo throughput, tanker freight rates, diplomatic developments, and global trade impact. Use this skill whenever the user asks about the Strait of Hormuz or the Persian Gulf in the context of oil, shipping, or geopolitical risk — whether Hormuz is open, chokepoint or transit disruption, Gulf tanker traffic, war-risk premiums, Middle East shipping routes, or energy supply-chain risk.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks to process, triage, fetch, view, count, list, or resolve review feedback in a GitHub PR. Supports both CodeRabbit and Codex review workflows. In this workflow, “real review feedback” is strictly defined as actionable inline comments; for CodeRabbit, exclude review summaries and nitpicks, and for Codex, exclude review summary cards and use PR main-thread reactions only as status signals.

日本語の概要は準備中です。原文の説明を表示しています。

Govern Azure costs with budgets, alerts, tags, and policy restrictions. WHEN: "Azure budget health", "configured budget overrun", "list Azure budgets", "create Azure budget", "budget alerts", "budget coverage", "missing CostCenter tags", "allowed VM SKUs", "allowed Azure regions", "would this SKU be denied", "cost guardrails". DO NOT USE FOR: planning-target forecasts, bill investigations, pricing, rightsizing, or commitments.

日本語の概要は準備中です。原文の説明を表示しています。

Evaluates market bubble risk through quantitative data-driven analysis using the revised Minsky/Kindleberger framework v2.1. Prioritizes objective metrics (Put/Call, VIX, margin debt, breadth, IPO data) over subjective impressions. Features strict qualitative adjustment criteria with confirmation bias prevention. Supports practical investment decisions with mandatory data collection and mechanical scoring. Use when user asks about bubble risk, valuation concerns, or profit-taking timing.

日本語の概要は準備中です。原文の説明を表示しています。

Provides verified corrections for IAM behaviors that AI agents frequently get wrong — policy evaluation edge cases, trust policy gotchas, STS session limits, Organizations quirks, and SAML/MFA specifics. Also provides structured workflows for IAM role management and baseline policy generation from application source code or a Terraform plan JSON. Covers condition operator safety (ForAnyValue/ForAllValues with Null checks), bucket policy deny patterns (VPC endpoint restrictions, org paths), confused deputy protection, and service role creation for AWS services (Glue, CloudTrail, Lambda, ECS, etc.) with aws:SourceAccount/aws:SourceArn trust conditions. Applies when creating IAM roles, writing IAM or bucket policies, generating policies from application source code or a Terraform plan JSON, working with STS, Organizations, or condition operators, or any task needing a service or execution role. Does not cover non-IAM authorization like Cognito user-pool policies or app-level RBAC.

日本語の概要は準備中です。原文の説明を表示しています。

Enterprise role-based access control for Apollo.io. Use when implementing team permissions, restricting data access, or setting up enterprise security controls. Trigger with phrases like "apollo rbac", "apollo permissions", "apollo roles", "apollo team access", "apollo enterprise security".

日本語の概要は準備中です。原文の説明を表示しています。

Audit and harden Algolia credentials, record exposure, index restrictions, and tenant search controls. Use when reviewing frontend keys, backend ACLs, key rotation, or data visibility. Trigger with "secure Algolia", "Algolia key audit", or "Algolia security review".

日本語の概要は準備中です。原文の説明を表示しています。

Audit and harden Anima and Figma tokens for design-to-code pipelines. Use when protecting API credentials, restricting Figma access scope, or hardening CI/CD design automation pipelines. Trigger with: "anima security", "anima token safety", "figma token security".

日本語の概要は準備中です。原文の説明を表示しています。

Map workforce roles and application actors to Algolia team permissions, API-key ACLs, and secured-key restrictions. Use when reviewing least privilege, tenancy, SSO requirements, or access rotation. Trigger with "Algolia RBAC", "Algolia SSO", or "Algolia tenant access".

日本語の概要は準備中です。原文の説明を表示しています。

Rigorous, defensible email-spoofability verdict and SPF supply-chain risk analysis computed from published DNS alone. Deepens the record-level SPF/DMARC/DKIM/BIMI/MTA-STS/DNSSEC fetch recipes in the offensive-osint arsenal (§16.14) with the reasoning that section doesn't do: a priority-ordered composite verdict for whether an attacker can actually land header-From-spoofed mail in an inbox, and by which vector (exact-domain vs subdomain) — grounded in the single most-misunderstood distinction in email security: the envelope MAIL FROM that SPF authenticates vs the visible header From: that only DMARC governs. Explains precisely why SPF -all/~all alone is NOT spoof-proof without DMARC enforcement, and why SPF +all bypasses DMARC even under p=reject pct=100. Covers RFC 7208 §4.6.4's 10-DNS-lookup / 2-void-lookup PermError fail-open condition with a runnable stdlib-only lookup-counter script, plus the SPF-include-takeover supply-chain vector (an attacker re-registering a dead include inherits SPF-pass authority over the victim domain) with strict transient-vs-NXDOMAIN discrimination discipline so a temporary SERVFAIL is never mistaken for a takeover lead. Fully passive: DNS TXT reads only, no mail sent, no RCPT TO probe, no API keys. Use when auditing a domain's real spoofing resistance (not just its published records), explaining to a client why 'we have SPF -all' does not mean they're covered, investigating an SPF PermError or an unusually long include chain, evaluating a dead SPF include as a takeover lead, or writing a defensible spoofability finding for a deliverable.

日本語の概要は準備中です。原文の説明を表示しています。