2,662 件 ・ 関連度順
概要と使いどころ
Facilitate SAFe 6.0 PI Planning events. Structure the 2-day cadence, generate PI Objectives with Business Value scores, build the Program Board for dependency visualization, and run the Confidence Vote. Use before every Program Increment when the organization follows SAFe.
日本語の概要は準備中です。原文の説明を表示しています。
Turn business data, KPI movement, or experiment results into a clear narrative using the what-so what-now what structure, audience calibration, and action-oriented insight. Use when leaders need a data-backed brief, dashboard storyline, or metric interpretation. Do not use for raw statistical modeling with no communication deliverable.
日本語の概要は準備中です。原文の説明を表示しています。
Build structured 3-scenario financial models (Base / Bull / Bear) for business planning or investment decisions. Sensitize revenue and cost drivers across scenarios, produce P&L summaries, cash flow bridges, and executive narratives. Aligns with FP&A 2.0 and CIMA Management Accounting standards. Use when leadership needs to understand the financial impact range of a decision. Do not use for statutory financial reporting or audit-ready financials.
日本語の概要は準備中です。原文の説明を表示しています。
Prepare customer or executive business reviews with outcome tracking, adoption health, ROI narrative, risks, commitments, and next-quarter plan using customer success and CX frameworks. Use when teams need QBRs, success plans, churn-risk conversations, or executive account reviews. Do not use for generic slide beautification or cold outreach prospecting.
日本語の概要は準備中です。原文の説明を表示しています。
Analyze budget-versus-actual or forecast-versus-actual performance and turn finance data into a management-ready narrative using variance logic, drivers, cash impact, and forward actions. Use when finance, FP&A, or business leaders need commentary, management accounts, or performance explanation. Do not use for bookkeeping entries, tax filing preparation, or legal accounting sign-off.
日本語の概要は準備中です。原文の説明を表示しています。
Draft concise follow-up messages, nudges, reminders, and recap emails from open decisions, stale requests, or recent meetings. Use when the work is repetitive business writing with known context. Do not use for sensitive legal language, high-stakes negotiation, or board-level communication without review.
日本語の概要は準備中です。原文の説明を表示しています。
Draft clear, professional business emails from rough notes, context, or instructions. Handles cold outreach, internal updates, client responses, and escalation drafts. Use when the work is routine email writing with known context and audience. Do not use for sensitive legal notices, formal regulatory correspondence, or board-level communication without review.
日本語の概要は準備中です。原文の説明を表示しています。
Natural-language orchestration of security tools through Gemini. Translates intent ("scan this scope for exposed admin panels") into safe, parameterized tool pipelines using nmap, masscan, naabu, httpx, nuclei, ffuf, gobuster, subfinder, amass, dnsx, katana, gau, semgrep, trivy, checkov, gitleaks, syft, grype, and custom scripts. Use when the user wants Gemini to drive a chain of CLI tools end to end with guardrails.
日本語の概要は準備中です。原文の説明を表示しています。
API security automation skill for REST, GraphQL, gRPC, and WebSocket APIs. Covers OpenAPI/AsyncAPI ingestion, authenticated fuzzing, OWASP API Top 10 (BOLA, BFLA, mass assignment, SSRF), schema diffing, GraphQL introspection abuse, JWT and OAuth misuse, rate-limit and replay testing. Use to automate API assessments with safe, scoped, evidence-backed findings.
日本語の概要は準備中です。原文の説明を表示しています。
Digital forensics and incident response triage skill for disk, memory, network, cloud, and endpoint artifacts. Covers Volatility 3, Velociraptor, KAPE, Plaso, Autopsy, Chainsaw, Hayabusa, Zeek, Arkime, EVTX, AWS/Azure/GCP audit logs, and timeline reconstruction. Use to extract IOCs, build incident timelines, and produce defensible analyst reports.
日本語の概要は準備中です。原文の説明を表示しています。
Threat intelligence fusion skill for collecting, normalizing, deduplicating, enriching, and operationalizing IOCs and TTPs from OTX, MISP, abuse.ch, VirusTotal, Shodan, GreyNoise, Censys, CISA KEV, NVD, vendor blogs, and internal telemetry. Use to build STIX/TAXII feeds, ATT&CK-mapped actor profiles, prioritized blocklists, and detection-ready intel packages.
日本語の概要は準備中です。原文の説明を表示しています。
AI and LLM red-teaming skill for evaluating prompt injection, jailbreak, data exfiltration, tool abuse, agent hijack, RAG poisoning, model denial of service, and unsafe tool-use chains in Gemini, Claude, GPT, and open-weight models. Use to build evaluation harnesses, attack corpora, defensive guardrails, and red-team reports for AI systems you own or are authorized to test.
日本語の概要は準備中です。原文の説明を表示しています。
Use when hunting self-hosted GitHub Actions runner vulnerabilities where fork pull requests can execute on privileged non-ephemeral runners. Trigger on: "self-hosted runner", "runs-on self-hosted", "fork PR workflow", "non-ephemeral runner", "first-time contributor approval", "runner images", "azure-builds runner", "outside collaborator approval", "runs-on matrix", "persistent runner", "Gato GitHub Attack Toolkit", "runner agent", self-hosted CI/CD runner abuse, "git config token", "workflow log deletion", runner C2.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit SMTP Open Relays. This skill teaches how to test mail servers to determine if they process email delivery regardless of the sender or recipient domain, enabling attackers to spoof internal addresses and bypass basic anti-phishing controls.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit misconfigured Spring Boot Actuator endpoints. This skill covers how to extract sensitive configuration details, heap dumps, environment variables, and ultimately escalating to Remote Code Execution (RCE) via `spring-cloud-starter` vulnerabilities.
日本語の概要は準備中です。原文の説明を表示しています。
Generate a NullPointer Studio styled PDF penetration test report from findings.json. Produces a professional dark-themed PDF with executive summary, risk dashboard, per-finding cards with business risk, remediation summary, and clean controls section.
日本語の概要は準備中です。原文の説明を表示しています。
Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, HTTP/2 single-packet attacks, and CWE-362-style synchronization gaps.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit Server-Side Request Forgery (SSRF) vulnerabilities in applications hosted on AWS to access the highly sensitive Instance Metadata Service (IMDS). This allows an attacker to steal valid IAM roles and temporary security credentials, leading to catastrophic cloud account compromise.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit an application's absolute trust in its underlying LLM (Overreliance). Use this skill to induce critical "hallucinations" (confident falsehoods) that cause downstream logical systems or automated agents tracking the LLM's output to make destructive actions or grant unauthorized access.
日本語の概要は準備中です。原文の説明を表示しています。
LLM prompt injection playbook. Use when testing AI/LLM applications for direct injection, indirect injection via RAG/browsing, tool abuse, data exfiltration, MCP security risks, and defense bypass techniques.
日本語の概要は準備中です。原文の説明を表示しています。
NoSQL injection playbook. Use when MongoDB-style operators, JSON query objects, flexible search filters, or backend query DSLs may allow data or logic abuse.
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit logic flaws in OAuth implementations, focusing specifically on the absence or improper validation of the `state` parameter, which leads to Cross-Site Request Forgery (CSRF) and account takeover (ATO).
日本語の概要は準備中です。原文の説明を表示しています。
macOS process injection playbook. Use when you need to inject code into running or launching macOS processes via dylib hijacking, DYLD environment variables, XPC exploitation, Mach port manipulation, or Electron/Chromium abuse.
日本語の概要は準備中です。原文の説明を表示しています。
Systematic fuzzing across two dimensions: (1) content discovery — hidden directories, files, backup/source leaks, HTTP verb enumeration, 401/403 bypass via path manipulation; (2) input validation — auth/token stripping, type confusion, boundary value analysis, HTTP parameter pollution, header fuzzing, cookie fuzzing, mass assignment discovery, and entropy/predictability analysis of any generated value. Works on any domain. Chains from /web-exploit or /pentester; chains into /business-logic when boundary violations, predictable IDs, or mass assignment are confirmed.
日本語の概要は準備中です。原文の説明を表示しています。