671 件 ・ 関連度順
概要と使いどころ
Implements secure session management with JWT tokens, Redis storage, refresh flows, and proper cookie configuration. Use when building authentication systems, managing user sessions, or implementing secure logout functionality.
日本語の概要は準備中です。原文の説明を表示しています。
Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, secure sessions and cookies, encrypt OAuth tokens, track IP addresses, and implement audit logging for Better Auth. Use when users need to secure their auth setup, prevent brute force attacks, or harden a Better Auth deployment.
日本語の概要は準備中です。原文の説明を表示しています。
Apply security-conscious thinking when generating or modifying code. Enforces trust boundary awareness, input validation, injection prevention, secrets management, and defense-in-depth authorization. Use when generating code that handles user input, authentication, authorization, database queries, external APIs, or file operations, or when the user mentions 'security review', 'secure this', 'check for vulnerabilities', 'trust boundary', 'input validation', or 'OWASP'. Loaded automatically by the code-generating molecules (code-forge, refactor-safely, bug-fix). This skill governs the security posture of generated code -- not architecture (see architecture) and not code craft (see clean-code).
日本語の概要は準備中です。原文の説明を表示しています。
Security vulnerabilities in AI-generated code and LLM applications, covering OWASP Top 10 for LLMs, secure coding patterns, and AI-specific threat modelsUse when "ai code security, llm vulnerabilities, ai generated code review, owasp llm, secure ai development, security, ai, llm, owasp, code-review, vulnerabilities" mentioned.
日本語の概要は準備中です。原文の説明を表示しています。
Authentication & Authorization Implementation Patterns workflow skill. Use this skill when the user needs Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.
日本語の概要は準備中です。原文の説明を表示しています。
Authentication & Authorization Implementation Patterns workflow skill. Use this skill when the user needs Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.
日本語の概要は準備中です。原文の説明を表示しています。
Authentication & Authorization Implementation Patterns workflow skill. Use this skill when the user needs Build secure, scalable authentication and authorization systems using industry-standard patterns and modern best practices and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.
日本語の概要は準備中です。原文の説明を表示しています。
API Security Best Practices workflow skill. Use this skill when the user needs Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.
日本語の概要は準備中です。原文の説明を表示しています。
API Security Best Practices workflow skill. Use this skill when the user needs Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.
日本語の概要は準備中です。原文の説明を表示しています。
API Security Best Practices workflow skill. Use this skill when the user needs Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities and the operator should preserve the upstream workflow, copied support files, and provenance before merging or handing off.
日本語の概要は準備中です。原文の説明を表示しています。
Builds recovery waterfall models with absolute priority, secured vs unsecured claims, and plan of reorganization distribution analysis. Use when modeling bankruptcy recoveries, analyzing claim priorities, or estimating creditor distributions.
日本語の概要は準備中です。原文の説明を表示しています。
Detect hardcoded credentials, default passwords, fail-open configurations, insecure default settings, and other security misconfigurations that ship as default behavior in applications.
日本語の概要は準備中です。原文の説明を表示しています。
Smart contract and secure API contract security analysis — invariant checking, access control, reentrancy, and integer overflow patterns. Implements Checks-Effects-Interactions pattern, formal invariant verification, and OpenSCV vulnerability taxonomy for Solidity/EVM and Rust/Solana contracts.
日本語の概要は準備中です。原文の説明を表示しています。
Use when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face ID, Touch ID), CryptoKit (AES-GCM, ChaChaPoly, ECDSA, ECDH, HPKE, ML-KEM), Secure Enclave, secure credential storage (OAuth tokens, API keys), certificate pinning (SecTrust, SPKI), keychain sharing across apps/extensions, migrating secrets from UserDefaults or plists, or OWASP MASVS/MASTG mobile compliance on Apple platforms.
日本語の概要は準備中です。原文の説明を表示しています。
State management and storage choice in React Native. State libs work mostly the same as web (Zustand, Jotai, Redux Toolkit, TanStack Query, Context); storage choice is RN-specific — AsyncStorage, MMKV, SecureStore, Keychain. Hydration patterns, splash screen handling, secrets discipline. Use this skill to: - Pick state management lib (matches web React intuition). - Pick storage by sensitivity (AsyncStorage / MMKV / SecureStore / Keychain). - Hydrate state on app start without UI flicker. - Persist Zustand store across app restarts. - Avoid storing secrets in plaintext storage. Do NOT use this skill for: - General project conventions (see rn-conventions). - Platform-specific code (see rn-platform-specific). - Navigation (see rn-navigation). - Testing state/storage (see rn-testing).
日本語の概要は準備中です。原文の説明を表示しています。
Use when setting up a secure email inbox for any AI agent — configuring inbound email via Resend, webhooks, tunneling for local development, and implementing security measures to prevent prompt injection attacks. Also use when someone mentions 'agent email', 'bot inbox', 'receive emails for agent', 'agent webhook', 'email security for AI', 'prompt injection via email', 'inbound email for bot', or wants their AI agent to receive and respond to emails securely.
日本語の概要は準備中です。原文の説明を表示しています。
Security-focused development skill covering OWASP Top 10 and secure coding. Use when implementing authentication, handling user data, or security review. Keywords: security, auth, authentication, authorization, OWASP, XSS, SQL injection, CSRF, secure
日本語の概要は準備中です。原文の説明を表示しています。
Detects insecure platform interaction in mobile apps (Android/iOS). Trigger on: exported Activity, exported Service, exported BroadcastReceiver, Content Provider, Intent injection, deep link hijacking, WebView JavaScript enabled, JavascriptInterface, addJavascriptInterface, setJavaScriptEnabled, intent:// scheme, file:// scheme, WKWebView, WKScriptMessageHandler, UIPasteboard, URL scheme hijacking, Universal Links, PendingIntent, FLAG_IMMUTABLE, overlay attack, tapjacking, screenshot prevention, FLAG_SECURE, Broadcast sniffing, IPC data exposure. Covers MASVS-PLATFORM-1/2/3.
日本語の概要は準備中です。原文の説明を表示しています。
Detects weak or misconfigured cryptography in mobile apps (Android/iOS). Trigger on: hardcoded keys, ECB mode, DES, 3DES, RC4, MD5, SHA-1, SecureRandom misuse, static IV, reused IV, Math.random, arc4random, CommonCrypto, CryptoKit, Android Keystore, SecKey, AES-ECB, RSA without OAEP, insufficient key size, predictable seed, insecure key storage, broken hash, PBKDF2 iteration count. Covers MASVS-CRYPTO-1 (algorithm choice) and MASVS-CRYPTO-2 (key management).
日本語の概要は準備中です。原文の説明を表示しています。
Identify and exploit Insecure Direct Object Reference (IDOR), or Broken Object Level Authorization (BOLA), vulnerabilities. Manipulate internal identifiers (e.g., user IDs, database primary keys, transaction IDs) within HTTP request parameters or API payloads to unauthorizedly access, modify, or delete data belonging to other users.
日本語の概要は準備中です。原文の説明を表示しています。
Exploit Java Insecure Deserialization vulnerabilities leading to Remote Code Execution (RCE). Identify serialized Java objects natively passed within HTTP parameters, cookies, or sockets (e.g., `rO0AB...`). Utilize `ysoserial` to meticulously craft malignant payload chains exploiting vulnerable gadget libraries like CommonsCollections inherently present in the application's classpath.
日本語の概要は準備中です。原文の説明を表示しています。
Insecure deserialization playbook. Use when Java, PHP, or Python applications deserialize untrusted data via ObjectInputStream, unserialize, pickle, or similar mechanisms that may lead to RCE, file access, or privilege escalation.
日本語の概要は準備中です。原文の説明を表示しています。
Audit and attack session cookies via missing Secure/HttpOnly/SameSite attributes, overly broad Domain/Path scope, non-expiring persistent cookies, absent __Host- and __Secure- prefixes, browser cache leakage (Cache-Control: no-store missing), session token predictability via Burp Sequencer analysis, server-side session not invalidated on logout, and SSO single-logout bypass. Tools: Burp Suite Repeater/Sequencer, OWASP ZAP, EditThisCookie, Tamper Data, Cookiebro.
日本語の概要は準備中です。原文の説明を表示しています。
Set up SOPS + age encryption for sharing .env files securely across machines. Detects existing state, installs tools, generates age keys, creates .sops.yaml, and encrypts .env files as YAML (avoids SOPS dotenv bug #1435). Use when user mentions "sops setup", "encrypt env", "share secrets", "secure env files", "sops age setup", "env encryption", "setup sops", "share env across machines".
日本語の概要は準備中です。原文の説明を表示しています。