「elf」の検索結果

Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OIDC trust-policy abuse, Jenkins script-console RCE and CVE-2024-23897 file read, GitLab CI runner-token registration, Terraform state file leakage, artifact/log secret leakage, pipeline env-var disclosure. Use when target has a public GitHub/GitLab org, exposed CI dashboards (Jenkins/TeamCity/Drone/Argo), or build artifacts/images are reachable.

日本語の概要は準備中です。原文の説明を表示しています。

NTLM info disclosure is a Medium-severity finding when chained to context — the leak itself is intentional protocol behavior (RFC-compliant NTLMSSP challenge), but on internet-exposed enterprise infrastructure it provides exact reconnaissance for the next stage of an attack. Highest-value targets:

日本語の概要は準備中です。原文の説明を表示しています。

Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions privilege flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persistence techniques (IAM user/key creation, AAD app registration, GCP svc account key creation, EventBridge/Logic Apps backdoors), data exfiltration (S3/Blob/GCS, snapshot share, RDS/CosmosDB/Cloud SQL exfil), cloud-native lateral movement (cross-account assume, Azure AD multi-tenant, GCP project hierarchy), serverless attacks (Lambda env vars, layer hijack, Step Functions), Kubernetes-on-cloud (EKS/AKS/GKE-specific paths to node and AWS metadata), and CSPM evasion (CloudTrail blind spots, GuardDuty mute, Sentinel rule shaping). Use when the engagement scope is cloud accounts, when you've stolen cloud credentials, or...

日本語の概要は準備中です。原文の説明を表示しています。

Cross-cutting methodology for the CVE-hunting pipeline (ported from find-cve-agent): when a bug is design-vs-real, false-positive avoidance, version checking before reporting, responsible disclosure norms, acceptance-rate expectations per vuln class, vulnerability chaining playbook, known false-positive patterns, maintainer-response patterns, secure-pattern reference (what NOT to flag), and a self-criticism checklist to run before claiming a finding. Use this alongside the cve-hunter/cve-exploiter/cve-validator agents and the /cve-hunt pipeline — load it whenever judging if a finding is real, worth reporting, or already fixed.

日本語の概要は準備中です。原文の説明を表示しています。

別駭我！基本安全檢測 — Security self-check for Clawdbot/Moltbot. Run a quick audit of your clawdbot.json to catch dangerous misconfigurations — exposed gateway, missing auth, open DM policy, weak tokens, loose file permissions. Auto-fix included. Invoke: "run a security check" or "幫我做安全檢查".

日本語の概要は準備中です。原文の説明を表示しています。

Perform a comprehensive read-only security audit of Clawdbot's own configuration. This is a knowledge-based skill that teaches Clawdbot to identify hardening opportunities across the system. Use when user asks to "run security check", "audit clawdbot", "check security hardening", or "what vulnerabilities does my Clawdbot have". This skill uses Clawdbot's internal capabilities and file system access to inspect configuration, detect misconfigurations, and recommend remediations. It is designed to be extensible - new checks can be added by updating this skill's knowledge.

日本語の概要は準備中です。原文の説明を表示しています。

Autonomous agents are AI systems that can independently decompose goals, plan actions, execute tools, and self-correct without constant human guidance. The challenge isn't making them capable - it's making them reliable. Every extra decision multiplies failure probability. This skill covers agent loops (ReAct, Plan-Execute), goal decomposition, reflection patterns, and production reliability. Key insight: compounding error rates kill autonomous agents. A 95% success rate per step drops to 60% b

日本語の概要は準備中です。原文の説明を表示しています。

Design and build custom Claude Code agents with effective descriptions, tool access patterns, and self-documenting prompts. Covers Task tool delegation, model selection, memory limits, and declarative instruction design. Use when: creating custom agents, designing agent descriptions for auto-delegation, troubleshooting agent memory issues, or building agent pipelines.

日本語の概要は準備中です。原文の説明を表示しています。

Query and manage personal finances via the official Actual Budget Node.js API. Use for budget queries, transaction imports/exports, account management, categorization, rules, schedules, and bank sync with self-hosted Actual Budget instances.

日本語の概要は準備中です。原文の説明を表示しています。

Complete career acceleration system — from self-assessment to offer negotiation. Covers career strategy, job search operations, resume/CV optimization, interview preparation, salary negotiation, career transitions, and long-term growth planning. Works for any role, any level, any industry.

日本語の概要は準備中です。原文の説明を表示しています。

Requires OFOX_API_KEY — create one at https://app.ofox.ai. Shared execution layer for the Ofox video generation API (api.ofox.ai) — creates a video job, polls it to completion, downloads the finished mp4 from a persistent CDN URL, and reports the real cost. This is a library skill, not a standalone user-facing one — it is invoked by scenario skills such as seedance-short-drama, seedance-ad-creative, and seedance-product-video, which build model/prompt/resolution choices for a specific use case and then call into this skill's script rather than re-implementing the API calls. Load this skill directly only when a user explicitly names the Ofox video API, asks to call it with specific low-level parameters, or asks to debug/resume a stuck or failed Ofox video job by job id — for a plain scenario request ("make me a short drama scene", "generate a cinematic ad clip"), use the relevant scenario skill instead, which itself depends on this one.

日本語の概要は準備中です。原文の説明を表示しています。

Generate presentation slides as self-contained HTML files with brand-consistent styling

日本語の概要は準備中です。原文の説明を表示しています。

An innate exploratory drive that guarantees no graph node remains permanently invisible to an agent population. After a warm-up period (step > 3), each agent fires a coverage scan with probability |unseen_nodes| / |all_nodes|. When triggered, the agent teleports directly to the globally unseen node with the highest belief uncertainty, works it, and returns control to the normal action-selection loop. Probability is self-annealing: it starts near 1.0 when almost everything is unseen and decays toward 0.0 as coverage saturates, requiring no manual schedule. The mechanism is "innate" (hard-coded into the agent step loop) as distinct from the "adaptive" EFE path, which requires local neighbors and learned precision weights. Together they form a two-layer exploration architecture: adaptive for locally-guided foraging, innate for topological completeness.

日本語の概要は準備中です。原文の説明を表示しています。

Principled action selection for autonomous agents using Expected Free Energy (EFE) under the Active Inference framework. Each candidate action is scored as G(n) = w_prag * (-E[p_n] * damping) + w_epist * (-Var[p_n] * novelty(n)), where agent beliefs are maintained as per-node Beta distributions and updated via Bayesian observation. Selection is a softmax over -gamma * G, making exploration an automatic consequence of uncertainty rather than a hardcoded epsilon. Precision weights w_prag and w_epist self-adapt via surprise history, shifting the agent between exploitation and exploration regimes without any manually tuned schedule.

日本語の概要は準備中です。原文の説明を表示しています。

Operationalizing an expungement website — user intake flows, document generation pipelines, court filing integrations, payment processing, state-by-state workflow variations, customer support for sensitive populations, and the handoff between automated systems and human legal review. Activate on 'expungement operations', 'legal tech SaaS', 'court filing integration', 'document automation pipeline', 'expungement business', 'legal service workflow', 'multi-state legal operations'. NOT for expungement law itself (use national-expungement-expert), web design (use legal-tech-web-design), or legal document drafting (use recovery-app-legal-terms).

日本語の概要は準備中です。原文の説明を表示しています。

Decision-theoretic framework for agents embedded within the environments they model and act upon

日本語の概要は準備中です。原文の説明を表示しています。

Expert in developer tool documentation as a product. Activate on: docs site, getting started guide, API reference, developer documentation, Docusaurus, Mintlify, Nextra, ReadMe, migration guide, troubleshooting page, docs information architecture, documentation testing, llms.txt. NOT for: marketing copy (use seo-content-blogging), API design itself (use api-architect), general technical writing (use technical-writer).

日本語の概要は準備中です。原文の説明を表示しています。

Classify every destructive/gated action an agent body can attempt (git, filesystem, network, shell, github) into block/approve/allow tiers, and audit whether the pre-tool and post-tool governance backing that classification is real: blocked actions proven zero-side-effect by a negative fixture, every denial backed by a receipt and a transcript event, every block-tier denial paired with a safe alternative, and no unmanaged or same-UID body ever marked "contained." Use when building or reviewing Agent Harbor's C5 governance gate (destructive git blocker, approval request/result, denial receipts), gating a new tool surface before it can run destructive commands, or auditing whether an existing "destructive-action blocked" claim actually has evidence behind it. NOT for proving an existing sandbox boundary actually contains an adversary once an action is isolated (use sandboxed-adversarial-test-harness), deciding where in a DAG to place a human review node or designing the approval UX itself (use human-gate-designer), or designing the general work-receipt schema across an entire agent task (use agent-work-receipt-designer).

日本語の概要は準備中です。原文の説明を表示しています。

Expert in cluttering -- the lesser-known fluency disorder characterized by rapid/irregular speech rate, excessive disfluencies, and frequent ADHD comorbidity. Covers differential diagnosis from stuttering, assessment protocols, therapy approaches (rate control, self-monitoring, pragmatic awareness), technology-assisted intervention, and AI tools for people who clutter. Activate on 'cluttering', 'rapid speech disorder', 'speech rate too fast', 'speech disfluency not stuttering', 'disorganized speech', 'ADHD speech problems', 'cluttering vs stuttering', 'speech intelligibility', 'mazed speech', 'telescoping words'. NOT for stuttering-only treatment (overlap is common but they are distinct), hearing disorders, or voice disorders (pitch, resonance).

日本語の概要は準備中です。原文の説明を表示しています。

Design and build mathematically rigorous, high-density, interactive data graphics and streaming telemetry visualizations following Mike Bostock's D3.js and Observable methodologies. Use when crafting custom SVG/Canvas charts, reactive streaming time-series, multi-dimensional brush-and-link coordinates, small multiples, or topological swarm graphs. NOT for generic dashboard template clones, basic spreadsheet charts, or off-the-shelf low-effort wrapper libraries.

日本語の概要は準備中です。原文の説明を表示しています。

Discipline an AI agent needs to work an issue/task tracker (Jira, Linear, GitHub Issues) as the shared source of truth: pull the right next item instead of inventing work, search before creating to avoid duplicates, write actionable items with checkable acceptance criteria, keep status transitions honest, and link work to items via branches/PRs/commits so progress is legible. Use when an agent picks up tracker work, files a new issue, updates status, or closes an item. NOT for authoring the PR itself (use agent-pr-authoring), roadmap-level planning and prioritization (use legible-roadmap-with-sidequests), or the mechanics of multiple agents coordinating on the same codebase (use multi-agent-coordination).

日本語の概要は準備中です。原文の説明を表示しています。

Design RL simulation sandboxes, trajectory datasets, QLoRA/LoRA adaptation plans, eval harnesses, and rollback unhooks for agents learning specific coding behaviors beyond the base model. Use when building or reviewing tool-use training loops, offline trajectories, reward functions, self-improvement harnesses, or Port Daddy agent behavior curricula. NOT for generic ML tutorials, full model training operations, or production deployment without eval gates and safety unhooks.

日本語の概要は準備中です。原文の説明を表示しています。

Verify every visual-evidence artifact (screenshot/GIF/recording) attached to a PR carries a provenance manifest binding it to real daemon-backed truth — daemon port, run id, transcript head hash, agent node id, commit, and an honest real/fixture/mock source label — and that operator-control-panel PRs cover the required set of proof states. Use when gating a PR's proof artifacts before merge, auditing whether a "LIVE" visual claim is backed by a real daemon run versus a reused or fixture-backed mock, or defining the required state-coverage set for a control-panel change. NOT for the capture technique itself — headless Playwright, `screencapture -x -l`, non-interruptive capture (use port-daddy-agent-skill's visual-evidence doctrine), designing the receipt body schema an artifact attaches to (use agent-work-receipt-designer), or the broader dogfood/Potemkin product-quality bar (use multi-agent-authoring-product-bar).

日本語の概要は準備中です。原文の説明を表示しています。

Install Port Daddy's bounded interactive coordination hooks ("tentacles", from the Giant Squid Harness) into the INTERACTIVE sessions of agentic coding CLIs (Claude Code, Codex, Gemini, Antigravity/agy) by auto-detecting which CLIs are installed and writing PER-PROJECT hook config behind a runtime gate, so coordination fires only inside a Port Daddy project while the daemon is running — never machine- wide-always-on. Use when the user says "install port daddy hooks", "agent CLI hooks", "interactive session hooks", "make coordination hooks fire in interactive sessions", "codex/gemini/agy hooks", or "auto-detect agent CLIs". NOT for generic software/package installation; NOT for installing the Port Daddy daemon or `pd` CLI itself (delegate to the `port-daddy` skill / `pd setup`); NOT for MCP server setup (delegate to `pd mcp install`); NOT for authoring new skills (delegate to `skill-architect` / `skill-creator`); NOT for editing the tentacle scripts themselves (owned by the Giant Squid Harness program; this installer layer is pd-adr-090).

日本語の概要は準備中です。原文の説明を表示しています。