2,344 件 ・ 関連度順
概要と使いどころ
在授权渗透测试中挖掘 JavaScript 原型污染（prototype pollution，服务端 Node.js 与客户端）。当目标把用户可控的键名递归合并进对象（merge/extend/set/clone、JSON body、query 解析）时使用——典型场景：用 `__proto__`/`constructor.prototype` 注入属性，污染全局原型，进而 DoS、改逻辑、配合 gadget 提权到 XSS/RCE。适用目标类型 Web / REST API（Node.js） / 前端。触发场景包括用户说"测下原型污染""这个 merge 能不能 __proto__""污染原型打 RCE/XSS""lodash/jquery 有没有污染点"。输出：污染点 + 可用 gadget 判定 + 反射证据的 finding（含 killed 记录）。
日本語の概要は準備中です。原文の説明を表示しています。
Automates Flutter iOS and Android deployment using Fastlane. Use when setting up `fastlane match` for iOS certificate and provisioning profile management, automating TestFlight uploads via `upload_to_testflight`, pushing Android releases to Google Play via `upload_to_play_store`, auto-incrementing build numbers, writing Fastfile lanes for Flutter release workflows, integrating Fastlane with GitHub Actions or Codemagic, or configuring App Store Connect API Key and Google Play Service Account JSON credentials.
日本語の概要は準備中です。原文の説明を表示しています。
Configures deep linking in Flutter using Android App Links (assetlinks.json) and iOS Universal Links (apple-app-site-association) integrated with GoRouter v17.x navigation. Use this skill when setting up HTTPS domain association, handling magic links or email verification links, routing marketing campaign URLs (Google Ads, Facebook Ads) into the app, implementing password reset or invite flows via deep links, fixing deep link verification failures, troubleshooting GoRouter deep link integration, or any time the words 'deep link', 'universal link', 'app link', 'assetlinks', 'AASA', 'magic link', or 'deeplinking' appear in the request. Avoids deprecated custom URL schemes (myapp://).
日本語の概要は準備中です。原文の説明を表示しています。
Background processing and heavy computations using Dart Isolates with Isolate.run(), compute() function, and platform channels. Use this skill when performing CPU-intensive operations without blocking UI (image processing, data parsing, encryption), implementing background tasks that prevent jank or frame drops, handling large file operations (JSON parsing, database migrations), running parallel computations, fixing UI freezes caused by main thread blocking, using compute() for one-off background work, creating long-lived Isolates with ReceivePort/SendPort, implementing multi-threaded algorithms, debugging isolate communication issues, or preventing memory leaks from unclosed ReceivePorts. Covers isolate spawn, message passing, ReceivePort cleanup (CRITICAL for leak prevention), SendPort communication patterns, error handling, serialization rules, and performance optimization for compute-heavy operations.
日本語の概要は準備中です。原文の説明を表示しています。
Extract structured data from receipts and invoices for bookkeeping, expense tracking, and tax preparation. Supports email, photos, scanned images, PDFs, and accounting exports. Outputs vendor, date, amount, tax, line items as table, CSV, or JSON. Trigger on "process receipts", "extract receipts from email", "scan invoices", "capture expenses".
日本語の概要は準備中です。原文の説明を表示しています。
Builds Flutter apps with guides for everything specific to Flutter and Dart — layouts, responsive UI, forms, animations, theming, declarative routing with go_router, widget previews and home screen widgets; HTTP, JSON serialization, local databases and caching; plugins, platform channels and native views; isolates and app size; accessibility and localization; Effective Dart, Dart 3 features and pattern matching; and macOS setup. Use when writing or changing Flutter UI, data or native integration code, or when the user asks how to do something in Flutter, even if they do not name the topic.
日本語の概要は準備中です。原文の説明を表示しています。
Open the AOS Hub on 127.0.0.1:7900 (services, plan kits, store) or stop/status it. Generated from plugin-commands.json; invoke as $bdb-aos:hub.
日本語の概要は準備中です。原文の説明を表示しています。
How to author one new tdmcp MCP tool the house way — the file shape (XImpl + registerX), the Python-bridge pattern (buildPayloadScript/parsePythonReport over executePythonScript), the result helpers (errorResult/guardTd/jsonResult/structuredResult), fail-forward error handling, ESM/.js + Biome style, and the offline msw unit test that proves it. Load this whenever building, extending, reviewing, or testing a tdmcp tool file under src/tools/** (and its test under tests/unit/**). Use it for every Phase-13 / v0.5.0 feature-build tool and any re-run after a gate failure.
日本語の概要は準備中です。原文の説明を表示しています。
Design the MixerSceneIntent, approval state, JSON schema, CLI examples, audit entries, and tests for AI-Controlled Party mixer/Soundcraft Ui24R scene arming. Use whenever a task mentions mixer scenes, Ui24R snapshots/cues, operator-approved mixer control, show-director contract updates, schema updates, dry-run CLI shape, or follow-ups that revise this contract.
日本語の概要は準備中です。原文の説明を表示しています。
Use when the user brings an exported instincts JSON to merge into the local store — treats trigger and action as inert data, validates every entry against the shared format and its bounds, drops invalid ones loudly, and never overwrites an existing instinct without asking the user first.
日本語の概要は準備中です。原文の説明を表示しています。
Use when the user wants to share or back up learned instincts — validates the local instincts file, allowlists the six known fields, strips secrets and home-directory paths, and writes a sanitized JSON artifact the user names. Never modifies the instincts file itself.
日本語の概要は準備中です。原文の説明を表示しています。
Use for Nauthilus Lua plugins, Lua callback tests, policy compiler and registry work, Lua environment and subject sources, Lua actions, hooks, backend scripts, policy facts, obligation targets, `server/lualib`, `server/lua-plugins.d`, `server/policy`, and JSON fixtures under `testdata/lua`.
日本語の概要は準備中です。原文の説明を表示しています。
Implement structured logging with JSON formats, log levels (DEBUG, INFO, WARN, ERROR), contextual logging, PII handling, and centralized logging. Use for logging, observability, log levels, structured logs, or debugging.
日本語の概要は準備中です。原文の説明を表示しています。
Create Kotlin Compose design tokens from one of three supported sources — Google Stitch (MCP), Figma (MCP or JSON), or Codex Design (kta-design-spec output, Codex HTML/markdown artifacts). Three-layer architecture (Primitive/Semantic/Component) with code generation. Use when user asks to "generate design tokens", "create theme from Figma/Stitch/Codex design", "build Compose tokens from design spec", or "convert design source to tokens". Refuses any other input source and asks user for correct seed data.
日本語の概要は準備中です。原文の説明を表示しています。
Create Kotlin Compose design tokens from one of three supported sources — Google Stitch (MCP), Figma (MCP or JSON), or Claude Design (kta-design-spec output, Claude HTML/markdown artifacts). Three-layer architecture (Primitive/Semantic/Component) with code generation. Use when user asks to "generate design tokens", "create theme from Figma/Stitch/Claude design", "build Compose tokens from design spec", or "convert design source to tokens". Refuses any other input source and asks user for correct seed data.
日本語の概要は準備中です。原文の説明を表示しています。
Analyze graded `trial_result` JSONL outputs from the eval pipeline, including reliability and custom slicing.
日本語の概要は準備中です。原文の説明を表示しています。
End-to-end eval-suite orchestration with the `eval` command: run -> grade -> compare -> calibrate, using strict JSON contracts and schema discovery.
日本語の概要は準備中です。原文の説明を表示しています。
Build command-only adapters for `eval` run mode using strict stdin/stdout JSON contracts.
日本語の概要は準備中です。原文の説明を表示しています。
Turborepo monorepo build system guidance. Triggers on: turbo.json, task pipelines, dependsOn, caching, remote cache, the "turbo" CLI, --filter, --affected, CI optimization, environment variables, internal packages, monorepo structure/best practices, and boundaries. Use when user: configures tasks/workflows/pipelines, creates packages, sets up monorepo, shares code between apps, runs changed/affected packages, debugs cache, or has apps/packages directories.
日本語の概要は準備中です。原文の説明を表示しています。
Cuts the next minor release of Prisma Composer: bumps the root package.json version, propagates it to every workspace package in lockstep, and opens a PR titled "chore(release): v<next-version>". When a maintainer merges the PR, the `Publish to npm` workflow runs automatically and ships the new version to npm under dist-tag `latest`, plus a matching GitHub Release with auto-generated notes. Use when a maintainer asks to "cut the next minor", "bump to the next version", "open a release PR", or "prepare a publish PR".
日本語の概要は準備中です。原文の説明を表示しています。
AI Personal Assistant network skill. Use when: contacting another PA, coordinating with peer agents, scheduling meetings between owners, broadcasting messages, looking up contacts from the local PA directory, or performing any cross-PA task. Reads contact data from data/pa-directory.json in the workspace. Does NOT contain hardcoded contact data — each PA maintains their own directory file.
日本語の概要は準備中です。原文の説明を表示しています。
AI Personal Assistant network skill for multi-agent PA coordination. Use when: contacting another PA, coordinating with peer agents, scheduling meetings between owners, broadcasting messages to PA groups, or looking up contacts from the local PA directory. Reads contact data from data/pa-directory.json in the workspace.
日本語の概要は準備中です。原文の説明を表示しています。
Turns data/commitments.jsonl (flat list) into a who-owes-what-to-whom graph. Surfaces overdue chains and cross-PA dependencies that the flat list hides. Triggers: "what's overdue", "what did X promise", "commitment graph", "who's blocking whom".
日本語の概要は準備中です。原文の説明を表示しています。
Reduce OpenClaw token usage and API costs through smart model routing, heartbeat optimization, budget tracking, and native 2026.2.15 features (session pruning, bootstrap size limits, cache TTL alignment). Use when token costs are high, API rate limits are being hit, or hosting multiple agents at scale. The 4 executable scripts (context_optimizer, model_router, heartbeat_optimizer, token_tracker) are local-only — no network requests, no subprocess calls, no system modifications. Reference files (PROVIDERS.md, config-patches.json) document optional multi-provider strategies that require external API keys and network access if you choose to use them. See SECURITY.md for full breakdown.
日本語の概要は準備中です。原文の説明を表示しています。