1,505 件 ・ 関連度順
概要と使いどころ
Optimizes CI pipelines for monorepos by detecting affected packages/apps and running only necessary builds and tests. Includes Turborepo/Nx strategies, caching, and parallel execution. Use for "monorepo CI", "affected detection", "incremental builds", or "workspace optimization".
日本語の概要は準備中です。原文の説明を表示しています。
JWT attack methodology for penetration testers. Covers algorithm confusion (alg:none, RS256→HS256), weak HMAC secret brute force, kid parameter injection (SQLi, path traversal), jku/x5u/jwk header injection, JWKS cache poisoning, JWS/JWE confusion, timing attacks, and mobile JWT storage extraction. Use when testing JWT-based authentication, hunting auth bypass via token manipulation, or evaluating JWT implementation security in web or mobile apps.
日本語の概要は準備中です。原文の説明を表示しています。
OAuth 2.0 attack checklist: authorization code interception, redirect_uri bypass, CSRF on OAuth flow, state parameter abuse, open redirector chaining, token leakage via Referer, PKCE bypass, and scope escalation. Use when testing OAuth implementations in web apps or bug bounty.
日本語の概要は準備中です。原文の説明を表示しています。
Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host poisoning, X-HTTP-Method-Override / GCS cache, reflected→stored XSS via cache, classic Omer-Gil Web Cache Deception, Cloudflare Cache Deception Armor bypass, session-token cache deception, Akamai hop-by-hop smuggling → server-side edge poisoning, and Kettle's 2024 path-normalization WCD against Cloudflare/Fastly/GCP. Host/X-Forwarded-Host injection that reaches app logic (reset-link poisoning, routing SSRF, OAuth issuer) is owned by hunt-host-header; this skill owns the case where the poisoned response is CACHED and served to other users. Use when hunting cache poisoning, Web Cache Deception, CDN-fronted apps.
日本語の概要は準備中です。原文の説明を表示しています。
Triage ASM/recon output for ownership before testing — separate the target's real assets from namespace-collision noise. Automated recon keyword-matches on the brand name, so for any target whose name is a common/dictionary word, the output is dominated by assets belonging to UNRELATED same-named companies (repos, cloud buckets, mobile apps, breach corpora, typosquats). Built from an authorized engagement where an ASM report's 'Criticals' were overwhelmingly false positives and the combo/repos/mobile/bucket lists were polluted with unrelated same-named orgs. Use at the START of any engagement, immediately on receiving any ASM/recon/OSINT dataset, BEFORE testing anything.
日本語の概要は準備中です。原文の説明を表示しています。
Well-built apps catch errors and return a clean, generic message. A broken app,
日本語の概要は準備中です。原文の説明を表示しています。
End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase grep, pinned-cert extraction, exported-component enumeration, Frida runtime instrumentation templates, intent-injection probes. Built from an authorized external red-team engagement where 7 APKs were pulled manually, 4 download attempts truncated, and a hardcoded JWT + 30 internal API endpoints were recovered from one of the apps. Use when target has a mobile app catalogue (Play Store developer page), when you find an APK URL hosted on a web server, or when post-recon mentions 'mobile app' in scope.
日本語の概要は準備中です。原文の説明を表示しています。
Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions privilege flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persistence techniques (IAM user/key creation, AAD app registration, GCP svc account key creation, EventBridge/Logic Apps backdoors), data exfiltration (S3/Blob/GCS, snapshot share, RDS/CosmosDB/Cloud SQL exfil), cloud-native lateral movement (cross-account assume, Azure AD multi-tenant, GCP project hierarchy), serverless attacks (Lambda env vars, layer hijack, Step Functions), Kubernetes-on-cloud (EKS/AKS/GKE-specific paths to node and AWS metadata), and CSPM evasion (CloudTrail blind spots, GuardDuty mute, Sentinel rule shaping). Use when the engagement scope is cloud accounts, when you've stolen cloud credentials, or...
日本語の概要は準備中です。原文の説明を表示しています。
React Native and Expo best practices for building performant mobile apps. Use when building React Native components, optimizing list performance, implementing animations, or working with native modules. Triggers on tasks involving React Native, Expo, mobile performance, or native platform APIs.
日本語の概要は準備中です。原文の説明を表示しています。
One-time CRM initialization. Reads agency.config.json, creates Google Sheet tabs with correct headers, and deploys the webhook Apps Script. Run this once after agency-setup to bootstrap your CRM.
日本語の概要は準備中です。原文の説明を表示しています。
Detect crisis signals in user content using NLP, mental health sentiment analysis, and safe intervention protocols. Implements suicide ideation detection, automated escalation, and crisis resource integration. Use for mental health apps, recovery platforms, support communities. Activate on "crisis detection", "suicide prevention", "mental health NLP", "intervention protocol". NOT for general sentiment analysis, medical diagnosis, or replacing professional help.
日本語の概要は準備中です。原文の説明を表示しています。
Refactor apps so backend owns runtime truth and UI only projects snapshots. Use when tools have split authority. NOT for cosmetic UI work or new features before drift is removed.
日本語の概要は準備中です。原文の説明を表示しています。
Use when building content-heavy sites with Astro, deciding between SSG/SSR/hybrid, choosing client directives (idle/visible/load/media), structuring content collections with type-safe schemas, integrating React/Vue/Solid/Svelte components in the same project, or migrating from Next.js for marketing/docs. Triggers: client:idle vs client:load tradeoffs, content collections schema with zod, image optimization via @astrojs/image, view transitions, server islands, MDX layouts. NOT for SPA-style apps that need full interactivity (use Next/Remix), Astro internals/plugin authoring, or non-content sites where islands provide no benefit.
日本語の概要は準備中です。原文の説明を表示しています。
Research AI coding assistant products, audiences, user stories, social proof, hacks, and unmet needs for apps like Cursor, Claude Code, Codex, Warp Code, Devin, Windsurf, GitHub Copilot, Cline, Aider, and homegrown agent stacks. Use when designing or positioning agentic developer tools, Port Daddy Agent Harbor, swarm consoles, background coding agents, or competitive/product research for AI software engineering. NOT for implementing the coding agent runtime, generic market research, or UX mockups without developer workflow evidence.
日本語の概要は準備中です。原文の説明を表示しています。
Design low-friction UX, interaction patterns, and comeback loops for AI coding assistant apps, agent consoles, background coding agents, and Port Daddy swarm/operator surfaces. Use when creating flows like prompt-to-diff, context attach, plan/apply/review, checkpoint rollback, background-agent dashboards, visual proof, or multi-agent invocation. NOT for generic landing pages, static dashboards, or implementation-only changes without product flow.
日本語の概要は準備中です。原文の説明を表示しています。
Browse the web for any task — research topics, read articles, interact with web apps, fill forms, take screenshots, extract data, and test web pages. Use whenever a browser would be useful, not just when the user explicitly asks.
日本語の概要は準備中です。原文の説明を表示しています。
Tiered web access router. TIER 1 insane-search: headless extraction plus WAF bypass via curl_cffi, yt-dlp, Jina Reader, public APIs, Playwright fallback for blocked/403/Cloudflare pages, articles, YouTube subtitles. TIER 1.5 agent-reach: platform-native readers for Chinese/social platforms: Xiaohongshu, Douyin, Weibo, Bilibili, V2EX, WeChat, plus Twitter/Reddit/LinkedIn/GitHub. TIER 2 aside-browser FIRST (user's real logged-in browser: aside exec agent, aside repl Playwright), then CloakBrowser + agent-browser as the stealth fallback: source-patched stealth Chromium (CloakBrowser) driven over CDP by the agent-browser CLI for clicks, forms, screenshots, video, cookie login, QA/dogfood, Electron apps. Triggers: browse, stealth browser, CloakBrowser, agent-browser, cloak launch, bypass bot detection, blocked site, scrape, fill form, screenshot, import cookies, play youtube, podcast transcript. NOT for simple searches (web-search), fetches (webfetch), or messaging/workspace platforms — Slack/Discord/Notion/Gmail have Tier-1 CLIs in external-communication; come here only as its fallback.
日本語の概要は準備中です。原文の説明を表示しています。