Use when determining the amount of alimony under Polish KRO — calculating justified needs of the entitled person vs. earning/property capacity of the obligor (art.
Respond to a leaked agent credential: what it could reach, what was done with it after the leak time, which credentials to rotate in what order, and an evidence folder with…
Incident triage skill for security-event classification, containment planning, evidence preservation, and response coordination.
Analyze system, application, and security logs for forensic investigation. Use when investigating security incidents, insider threats, system compromises, or any scenario…
Investigate Salesforce login activity using LoginHistory, IdentityVerificationHistory, and Login Forensics (Event Monitoring add-on): reconstruct per-user login timelines,…
Run adversarial review. Use for PR/diff/code/security/UX/API/performance/design review, or when behavior, records, evidence, risks, or acceptance claims need pressure-testing…
Route security-sensitive work before implementation. Use when authentication, authorization, user input, secrets, sensitive data, uploads, webhooks, external integrations,…
Build and run a third-party / vendor risk management (TPRM) program aligned to NIST SP 800-161 C-SCRM and NIST CSF 2.0 GV.SC: inventory and tier vendors by risk, send the right…
Automatically analyze product, service, subscription, marketplace, or competitor pricing when the user asks "fiyatı iyi mi", "almaya değer mi", "en ucuz/kaliteli hangisi",…
Use when administering a Synapse / Matrix homeserver — list or snapshot all rooms, rate room health (public, unencrypted, orphaned), render a Graphviz map of the room/space tree,…
Run a safe automated MCP configuration security preflight while keeping raw scanner evidence out of model-facing output. Use before installing or approving an MCP server.
Use when a Meeting record distillation review is ready to be handed to a maintainer or accountable operator.
Comprehensive techniques for acquiring, analyzing, and extracting artifacts from memory dumps for incident response and malware analysis.
Research-driven repository repair, debugging, refactoring, cleanup, architecture recovery, dead-code removal, dependency hygiene, security review, performance optimization,…
Autonomous research-driven application and repository security hardening skill for AI coding agents. Use when asked to secure, harden, audit, pentest, threat-model, remediate,…
Use when Mission Control should recommend a read-only handoff audit burst for run instructions, validation evidence, limitations, docs quality, and security caveats.
Prepare a project for release through Mission Control. Use when validation, docs, versioning, changelog, limitations, evidence, deployment readiness, and security concerns need…
Mobile device intelligence — Android/iOS app analysis, mobile forensics, emulators, messaging app reconnaissance, and device fingerprinting.
Use after Molecular Cell reviews arrive to triage the decision, prioritize the (often mechanism-completing) new experiments by impact × feasibility, and draft a point-by-point…
Use when writing an NDSS rebuttal and working the interactive discussion phase — triaging Round-2 reviews under a short window, answering adaptive-attack and ethics objections…
Use when targeting Network and Distributed System Security Symposium (NDSS) or deciding whether a computer-science manuscript fits this venue.
Analyze network traffic for defensive triage and operate the local defense-focused plugin runtime for PCAP forensics, live capture review, incident prioritization, posture…
Assess non-functional requirements across 6 quality categories (Security, Performance, Reliability, Maintainability, Scalability, Usability) with measurable criteria,…
Run production on-call with a Nightshift MCP server — answer "what's wrong?", diagnose incidents from evidence, apply allowlisted fixes only through prepare → human yes → confirm,…
EU NIS2 Directive (Directive (EU) 2022/2555) compliance advisor for essential and important entities — entity classification, Art. 21 risk management measures, Art.
EU NIS2 Directive (Directive (EU) 2022/2555) compliance advisor for essential and important entities: entity classification, Art. 21 risk management measures, Art.
Generate a NIST Cybersecurity Framework (CSF) 2.0 compliance report — interactively walks through every function, category, and subcategory, collecting evidence and pulling…
Anti-forensics and evidence destruction techniques for red team operators conducting authorized engagements.
Run an office move or reconfiguration without losing a week of work — the dependency-ordered plan (internet lead times rule everything), the workstream owners, the comms that keep…
Design or audit one offline/local-first synchronization and conflict protocol: local storage, queued mutations, idempotency, causality/order, reconnect, tombstones, optimistic…
Evaluate a document, report, spreadsheet, hypothesis, decision memo, or Agent Skill with independent evidence review, conditional disruption, and evidence-based adjudication.
Investigate a suspected agentic security incident and convert evidence into validated defensive learning.
Conduct an authorized, evidence-led security review of an undocumented web application for an assessor or remediation baseline.
Produce evidence-led technical documentation for an undocumented application, including architecture, operations, code tours, data dictionaries, and security findings.
Prepare privacy-preserving, source-traceable threat intelligence for approved peer sharing. Use when converting incident or pattern evidence into a shareable defensive signal.
[omh] Hermes Verification Gate workflow: define and record build, lint, typecheck, test, security, docs, generated-output, and CI evidence before completion or merge.
Research external libraries with evidence-backed responses and GitHub permalinks. Use when investigating library APIs, implementation patterns, or historical context for open…
Operate security tools through an AI agent with explicit authority and evidence boundaries. Use when an agent may invoke local CLIs, GUI apps, browser automation, MCP servers,…
Create or redesign enterprise AI, automation, security, and operations product pages that explain system boundaries, approvals, auditability, exceptions, and rollback.
Simulates the opposing party's litigation and negotiation strategy by mapping their likely factual narrative, categorizing defenses, predicting evidence attacks, and designing…
Single-pass opposing counsel attack on a legal argument - takes on the role of experienced counsel for the other side who has been handed your submission and told "find every way…
Operational security management — traffic shaping, scan rate limiting, source IP management, tool signature avoidance, evidence handling, anti-detection patterns.
Review a pull request or branch for correctness, regressions, security, operational risk, and missing evidence.
OSINT Investigator v2.1 — comprehensive open-source intelligence skill. Triggers on: OSINT, recon, digital footprint, dorking, social media investigation, username lookups, email…
GRIMSEC Agent 11: Evidence-backed forensic investigation of open-source GitHub repositories. Use when investigating supply chain incidents, suspicious commits, compromised…
Digital forensics — evidence acquisition, memory/disk imaging analiz, timeline reconstruction, IOC extraction advisory.
Operator OPSEC + evidence handling — operator identity hygiene, source IP design, burner infrastructure, evidence chain of custody, log retention advisory.
Uses Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell
Perform forensic acquisition and analysis of cloud storage services including Google Drive, OneDrive, Dropbox,
Collect, parse, and correlate system, application, and security logs to reconstruct events and establish timelines
Use when scanning an external macro environment with PESTEL/PESTLE (and its variant family STEEPLE, STEEPLED, PESTLIED, STEEP, DESTEP, LoNGPESTLE): political, economic, social,…
Develop, test, benchmark, and operate PostgreSQL extensions with reusable harnesses and reference protocols.
Search physiotherapy evidence with PubMed/PEDro, PICO and GRADE. Use for etkililik, doz and güncel literatür; prefer medical-evidence-research when available.
Use after PNAS reviews arrive to triage the decision, prioritize experiments, and draft a point-by-point response that is respectful, evidence-led, and honest about limits.
Use after PNAS Nexus reviews arrive to triage the decision, prioritize experiments, and draft a point-by-point response that is respectful, evidence-led, and honest about limits.
Validates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation, regressions, and newly…
Runs an adversarial premortem on a UK litigation matter. Builds the strongest version of the case, then attacks it from four angles — procedural, substantive, evidentiary,…
Preserve and document security evidence before analysis, containment, or remediation changes it. Use for suspicious artifacts, volatile host state, vulnerability validation,…
Route cross-domain production evidence (readiness, migration, recovery, capacity/cost, incident-learning) into a launch or operational decision — go, no-go, defer, exception, or…
Create or refine promptfoo redteam setup configs: purpose, targets, plugins, strategies, frameworks, multi-input target inputs, policy text, grader guidance, contexts, and…