「nct」の検索結果

Record and track organizational decisions using the RAPID framework. Captures decision context, options analysis, RAPID roles, risk assessment, and communication plan. Use when making cross-functional decisions, documenting governance choices, or building an auditable decision trail.

日本語の概要は準備中です。原文の説明を表示しています。

Identify and exploit Prototype Pollution vulnerabilities in JavaScript/Node.js applications. This skill covers the progression from polluting `Object.prototype` to identifying functional gadgets (like `child_process.spawn`) to achieve Remote Code Execution (RCE).

日本語の概要は準備中です。原文の説明を表示しています。

Exploit insecure deserialization in Node.js applications (specifically targeting libraries like `node-serialize`) by crafting malicious Immediately Invoked Function Expressions (IIFE) hidden within serialized JSON objects to achieve Remote Code Execution (RCE).

日本語の概要は準備中です。原文の説明を表示しています。

Perform static reverse engineering and analysis on Windows Portable Executable (PE) files to identify malicious indicators without executing the file. Use this skill during Incident Response, malware triage, or threat hunting to safely extract metadata, imported APIs, exported functions, embedded strings, and packed indicators from suspicious Windows binaries (.exe, .dll, .sys).

日本語の概要は準備中です。原文の説明を表示しています。

Execute dynamic instrumentation utilizing Frida to inject custom JavaScript into running iOS applications (IPAs) on jailbroken devices. Hook native functions, bypass SSL Pinning, bypass Jailbreak Detection, and manipulate in-memory data at runtime.

日本語の概要は準備中です。原文の説明を表示しています。

Format string exploitation playbook. Use when printf-family functions receive user-controlled format strings, enabling arbitrary stack reads (%p/%s), arbitrary memory writes (%n/%hn/%hhn), GOT/hook overwrites, and canary/libc/PIE leaks.

日本語の概要は準備中です。原文の説明を表示しています。

Abuse Azure Managed Identities from compromised Azure Virtual Machines (VMs), Functions, or App Services to seamlessly request valid, highly-privileged Azure AD access tokens and laterally move throughout the cloud environment without requiring explicit credentials.

日本語の概要は準備中です。原文の説明を表示しています。

Penetration test AWS cloud environments for misconfigurations, privilege escalation, data exposure, and lateral movement. Use this skill when assessing AWS accounts for security weaknesses including S3 bucket misconfigurations, IAM policy flaws, EC2 metadata exploitation, Lambda function abuse, and cross-account attack paths. Covers both external and authenticated AWS pentesting.

日本語の概要は準備中です。原文の説明を表示しています。

White-box source code security review structured around OWASP ASVS 5.0 (427 verification requirements across 16 chapters). Reads and understands application source code to build a security-aware knowledge base that enriches all downstream skills. Covers: tech stack identification, route/endpoint mapping, authentication and authorization architecture, dangerous function patterns, source-to-sink data flow tracing, IaC review, dependency analysis, ASVS compliance mapping, and LLM integration security (prompt injection, tool abuse, output handling, RAG poisoning, MCP server patterns). When LLM/AI framework usage is detected, automatically reviews OWASP LLM Top 10 patterns from source code and chains into /ai-redteam with white-box context for live endpoint testing. Chains into /pentester, /threat-modeling, /web-exploit, /api-security, /cloud-security, /analyze-cve, /credential-audit, and /ai-redteam — providing white-box context that transforms black-box testing into targeted, informed assessment.

日本語の概要は準備中です。原文の説明を表示しています。

Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every technique includes actual payloads, commands, and verification logic. Chains from /pentester or /codebase when API endpoints are discovered, chains into /web-exploit when classic injection points are found in API parameters, chains into /post-exploit when RCE is achieved, and chains into /ai-redteam when an LLM/AI endpoint is discovered (chat APIs, completion endpoints, RAG search, agentic tool-use, MCP servers).

日本語の概要は準備中です。原文の説明を表示しています。

API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.

日本語の概要は準備中です。原文の説明を表示しています。

Curate, review, or repair ai-gene-review ModuleReview YAML documents under modules/, including pathway/module boundary setting, parts and variant modeling, annoton-level molecular functions, representative UniProt/PTN grounding, module deep-research provenance, validation, rendering, and project batch updates.

日本語の概要は準備中です。原文の説明を表示しています。

Use when running or wiring OpenScientist for AI Gene Review gene-function hypotheses, especially blinded comparisons against local bioinformatics analyses.

日本語の概要は準備中です。原文の説明を表示しています。

Use this agent when you need to systematically review existing GO annotations for a gene and make curation decisions based on literature evidence and functional analysis. This agent should be called after seeding the SPECIES/GENE/GENE-ai-review.yaml file, which seeds each annotation with `action: PENDING`; these should all be manually reviewed.

日本語の概要は準備中です。原文の説明を表示しています。

Review AI Gene Review pull requests and curation changes for GO term quality, evidence support, core function identification, and annotation action justification. Use for PR review comments, review follow-up automation, and QA of gene review YAML.

日本語の概要は準備中です。原文の説明を表示しています。

Work with BioReason-Pro predictions and reasoning traces for protein function. Use when: comparing BioReason outputs against curated reviews, converting web exports to YAML, reviewing reasoning trace quality, or running the SFT/RL comparison. Triggers: "bioreason", "GO-GPT predictions", "reasoning trace review", "bioreason comparison", "SFT vs RL".

日本語の概要は準備中です。原文の説明を表示しています。

Evaluate and review GO-CAM (Gene Ontology Causal Activity Model) activities / annotons — molecular-function typing, has-input, causal relations, complexes, evidence — and check their consistency with gene annotation reviews. Use when reviewing cached GO-CAMs under gocams/, filling a GoCamReview YAML (gocams/<id>/<id>-review.yaml), or grounding a module in GO-CAM models.

日本語の概要は準備中です。原文の説明を表示しています。

Use when building GBA games with the BPCore Lua engine - entity, sprite and tilemap functions, SRAM save and load, link cable multiplayer protocol, camera and scrolling, or optimization patterns

日本語の概要は準備中です。原文の説明を表示しています。

5-level verification pyramid: static→unit→Playwright E2E (homepage-first, 6bp)→AI visual→post-deploy. 8-check quality gate. Multi-agent testing (functional/security/a11y/performance). Playwright v1.56+ AI agents (Planner/Generator/Healer, v1.63 current). WCAG 2.2 AA via axe-core v4.13. Percy+Chromatic visual regression. ADA Title II 2027/2028 deadlines.

日本語の概要は準備中です。原文の説明を表示しています。

What every delivered app must DO — anti-placeholder, complete features, working forms, psnotify notifications, feature flags, embarrassingly-easy UX, the feature catalog.

日本語の概要は準備中です。原文の説明を表示しています。

Anti-AI-slop design system for distinctive, premium interfaces. Bold typography, dark-first #060610, fluid clamp() type, cascade layers + native nesting + container queries, OKLCH color, @starting-style, View Transitions API, DTCG tokens.

日本語の概要は準備中です。原文の説明を表示しています。

One-line-prompt → cinematic, gorgeous, functional, well-tested, deployed website. Pre-hydrated SPA + full PWA kit + JSON-LD rich snippets + third-party integrations. React 19+Vite default (Angular optional). 100 concrete improvements grouped into 10 categories that EVERY single-prompt site build must satisfy before being marked done. Trigger whenever the user says 'make a website for X', 'build a site for X', 'rebuild X.com', or any equivalent one-liner.

日本語の概要は準備中です。原文の説明を表示しています。

Use when designing or reviewing a public API, exported function signature, module boundary, exported type/interface, or any contract other code depends on

日本語の概要は準備中です。原文の説明を表示しています。

Use when writing or reviewing functions, classes, naming, or non-trivial logic (≥3 lines)

日本語の概要は準備中です。原文の説明を表示しています。