「grants」の検索結果

Hunt JWT cryptographic failures — alg:none signature-stripping and RS256→HS256 key-confusion that let an attacker forge a token for any identity (e.g. an admin) without knowing a secret. Use when the app authenticates with a JSON Web Token (an `eyJ...` Bearer token in the Authorization header, a cookie, or a login response). This skill OWNS JWT signature/crypto forgery (alg:none, key confusion, kid/jku header injection); hunt-ato covers JWT as one ATO path, hunt-auth-bypass covers SSO/SAML token trust, hunt-api-misconfig covers non-crypto JWT handling. Critical when a forged token grants access to another user's data or an admin-only endpoint.

日本語の概要は準備中です。原文の説明を表示しています。

Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2 attacks via SSRF, K8s ServiceAccount token privilege analysis once held (token discovery / cluster exposure is owned by hunt-k8s), role-trust-policy confused-deputy, cross-account assume-role enumeration, IAM privilege escalation patterns (24+ AWS, 8+ Azure, 6+ GCP), and AWS Cognito Identity Pool unauthenticated-role attack chain (GetId → GetCredentialsForIdentity → IAM role abuse). Built for the case where recon yields a credential (key, JSON, token) and you need to know what it grants and how to escalate. Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain.

日本語の概要は準備中です。原文の説明を表示しています。

Write competitive research proposals for NSF, NIH, DOE, and DARPA. Agency-specific formatting, review criteria, budget preparation, broader impacts, significance statements, innovation narratives, and compliance with submission requirements.

日本語の概要は準備中です。原文の説明を表示しています。

Write competitive research proposals for NSF, NIH, DOE, DARPA, and Taiwan NSTC. Agency-specific formatting, review criteria, budget preparation, broader impacts, significance statements, innovation narratives, and compliance with submission requirements.

日本語の概要は準備中です。原文の説明を表示しています。

Qualify the exact final diff for a LoopX-managed goal. Use when goal policy enables change_quality_qualification, before a non-trivial delivery or merge, and when producing or repairing an exact-scope quality receipt. The workflow is language-neutral, permits at most one policy-authorized safe-fix pass, and never grants merge or repository authority.

日本語の概要は準備中です。原文の説明を表示しています。

Write competitive research proposals for NSF, NIH, DOE, DARPA, and Taiwan NSTC. Agency-specific formatting, review criteria, budget preparation, broader impacts, significance statements, innovation narratives, and compliance with submission requirements.

日本語の概要は準備中です。原文の説明を表示しています。

Sets up CloudWatch observability for the first time - Omni (CloudWatch Application Observability) and classic CloudWatch. Omni: creating a Space or Domain; access grants (who has access, at what level) and access profiles bounding async alerts, integrations, or agents; instrumenting an app or AI agent with the plain ADOT SDK so traces reach Omni (Python/Node/Java/.NET on EC2/ECS/EKS/Lambda), incl. no-image-rebuild and .NET CoreCLR vars; ingesting Azure telemetry via the CloudWatch agent on an Azure VM or AKS; connecting Slack to a Space; whether GitHub or a custom MCP tool server (HTTP/stdio; API key, bearer, OAuth2) can be connected. CloudWatch: onboarding a service to Application Signals - ADOT auto-instrumentation, the amazon-cloudwatch-observability add-on, monitored service, reporting telemetry, ServiceEvents, CI/CD git/deployment metadata, Terraform/manifest edits. For using what is set up - queries, dashboards, alarms, Omni alerts, X-Ray, synthetics, Dynamic Instrumentation - use aws-observability.

日本語の概要は準備中です。原文の説明を表示しています。

Format CVs for academic positions with publications, grants, and teaching

日本語の概要は準備中です。原文の説明を表示しています。

Use BEFORE editing any file in `supabase/migrations/` or `supabase/schemas/`, OR when the user runs a `/database` subcommand (`compact local migration`, `rls scenarios`, `align`). Encodes the three contracts that protect the Grida database layer: applied migrations are immutable, RLS implementation mirrors tests (never the reverse), `schemas/*.sql` is the human-readable end-state. Companion to `supabase/AGENTS.md` (RLS, grants, security boundaries).

日本語の概要は準備中です。原文の説明を表示しています。

Write competitive research proposals for NSF, NIH, DOE, DARPA, and Taiwan NSTC. Agency-specific formatting, review criteria, budget preparation, broader impacts, significance statements, innovation narratives, and compliance with submission requirements.

日本語の概要は準備中です。原文の説明を表示しています。

Compute what a degree will actually cost — sticker minus real aid, inflated per year, split into cash and loans, with the loan's decade-long monthly tail made visible before enrollment instead of after. Use when asked what will college really cost, compare these two offers' real prices, how much loan payment after graduation, or is this school affordable. Produces the all-in number from the script, the offer-letter decode (grants vs loans untangled), the monthly-tail reality check, and the two-school comparison.

日本語の概要は準備中です。原文の説明を表示しています。

Build or tailor an academic CV for faculty, postdoc, research or fellowship applications: publications, grants, teaching, supervision and service in the order the field expects, with consistent citations. Use when asked to write my academic CV, update my CV for a lectureship, tenure-track or postdoc application, format my publications list, or adapt my academic CV for an industry research role. Produces the full academic CV, a field-appropriate section order, a clean publications list in one citation style, and a two-page summary version when asked.

日本語の概要は準備中です。原文の説明を表示しています。

This skill should be used when the user asks to "simplify", "clean up the diff", "run simplify", "simplify the changes", "review changed code for cleanup", explicitly invokes "/simplify", or asks to "commit without simplify", "skip simplify for this commit", or "commit this but skip simplify". Reviews changed code across reuse, simplification, efficiency, and altitude, or grants an explicit one-commit bypass. Not for correctness bugs.

日本語の概要は準備中です。原文の説明を表示しています。

Audit and harden your SaaS tool stack — enforce SSO, review OAuth grants, manage shadow IT, and secure admin accounts across Slack, GitHub, Google Workspace, and AWS. Use when tightening security across company SaaS tools.

日本語の概要は準備中です。原文の説明を表示しています。

Draft, audit, or minimally revise English- or Chinese-language academic prose to reduce formulaic, vacuous, mechanically repetitive, or process-leaking language while preserving claims, evidence strength, logical relations, manuscript-wide terminology identity, document-level pattern variation, and scholarly register. Use for papers, abstracts, grants, cover letters, and reviewer responses when the user asks to de-AI, humanize, audit AI-like phrasing, or rewrite text without changing meaning. English is primary; Chinese is supported. Not for detector evasion, policy circumvention, pure translation, non-academic copy, or adding facts, citations, examples, or author experiences that the source does not contain.

日本語の概要は準備中です。原文の説明を表示しています。

MCP threat-model artifact for a scaffolded harness. Reports allowed/denied tools, dangerous permissions count, secrets reachability, network/shell/file-write grants, default-deny posture. Verdict: clean (exit 0) / medium (exit 1) / high (exit 2). The 'enterprise gold' artifact for PR + compliance review.

日本語の概要は準備中です。原文の説明を表示しています。

Trigger for: Labor-Hour IGCE, LH estimate, Time-and-Materials IGCE, T&M estimate, burdened hourly rate, burden multiplier, labor-category ceiling hours, materials estimate, proposed LH/T&M rate validation, price-reasonableness memo, or fair-and-reasonable analysis. Build auditable LH/T&M estimates using BLS OEWS wages, explicit burden multipliers, GSA CALC+ positioning, GSA Per Diem travel, and separately priced T&M materials. Do NOT use for FFP, cost-reimbursement, grants, or cooperative agreements. Requires the bls-oews, gsa-calc, and gsa-perdiem MCP servers.

日本語の概要は準備中です。原文の説明を表示しています。

Trigger for: cost-reimbursement IGCE, CR cost estimate, CPFF, CPAF, CPIF, cost-plus estimate, BAA estimate, fixed-fee analysis, award-fee analysis, incentive-fee analysis, proposed CR rate validation, cost-pool buildup, share-ratio scenario, price-reasonableness memo, or fair-and-reasonable analysis. Build auditable CR estimates using BLS OEWS wages, fringe/overhead/G&A/FCCM pools, contract-type-specific fee, GSA CALC+ positioning, and GSA Per Diem travel. Do NOT use for FFP, LH/T&M, grants, or cooperative agreements. Requires the bls-oews, gsa-calc, and gsa-perdiem MCP servers.

日本語の概要は準備中です。原文の説明を表示しています。

Trigger for: explaining current FAR, DFARS, or agency-supplement text; determining documented acquisition-policy status for an agency and FAR part; comparing codified text, RFO model text, and agency deviations; tracing acquisition rulemaking; finding procurement comment periods; analyzing public comments; refreshing prior policy analysis; or producing an Acquisition Policy Impact Brief. Use published federal sources and supplied policy documents without making legal or procurement-specific applicability determinations. Do not use for clause selection, market research execution, opportunities, pricing, grants, or cooperative agreements.

日本語の概要は準備中です。原文の説明を表示しています。

Trigger for: Other Transaction or OT should-cost, cost estimate, cost-share analysis, milestone pricing, funding profile, proposed-price comparison, prototype price analysis, research OT budget, production follow-on OT estimate, or OT price-reasonableness support under 10 U.S.C. 4021 or 4022. Build auditable milestone-based .xlsx workbooks using BLS OEWS wages, CALC+ positioning, GSA Per Diem, materials, cost sharing, and agreement-specific fees. Use for pre-solicitation budgets and proposal comparisons. Do NOT use for FAR-based IGCEs, OT project descriptions, grants, or an Agreements Officer's determination. Requires the bls-oews, gsa-calc, and, when travel applies, gsa-perdiem MCP servers.

日本語の概要は準備中です。原文の説明を表示しています。

Structured peer review of manuscripts and grants. 7-stage evaluation: initial assessment, section review, statistical rigor, reproducibility, figure integrity, ethics, writing. Covers CONSORT/STROBE/PRISMA and report structure. For evidence quality see scientific-critical-thinking; scoring see scholar-evaluation.

日本語の概要は準備中です。原文の説明を表示しています。

The secret-source gate. Routed to when changed code reads, writes, or passes a secret — API key, token, password, connection string, signing key, certificate, or any value that grants access. Validates that every secret comes from the approved store and never lands in source, log, test fixture, error response, image, or LLM prompt. The auth-crypto-reviewer agent is dispatched as the reviewer.

日本語の概要は準備中です。原文の説明を表示しています。

Format CVs for academic positions with publications, grants, and teaching

日本語の概要は準備中です。原文の説明を表示しています。

Programmatic security management in Neo4j — RBAC/ABAC, user lifecycle (CREATE/ALTER/DROP USER), role lifecycle (CREATE/GRANT ROLE/DROP ROLE), privilege grants and denies (GRANT/DENY/REVOKE on graph, database, DBMS), property-level access control, sub-graph access control, SHOW PRIVILEGES inspection, and auth provider config reference (LDAP, OIDC/SSO). Use when an agent needs to manage users, roles, or privileges programmatically via Cypher on the system database. Does NOT handle Cypher query writing — use neo4j-cypher-skill. Does NOT handle cluster ops or backups — use neo4j-cli-tools-skill. Property-level security and ABAC require Enterprise Edition.

日本語の概要は準備中です。原文の説明を表示しています。