Initialize a threat hunting program with an environment map, tool inventory, huntmap, and empty execution directories
Create phase plans for a threat hunt with exact telemetry tasks, receipts, and query outputs
Use when the user asks to triage Huntress incidents across client organizations, find coverage gaps or dark agents, trace an indicator's blast radius across the fleet, reconcile…
Terraform / OpenTofu / Nix / k8s manifest misconfiguration detection — open security groups, missing encryption, public S3/GCS, IAM wildcards, plaintext secrets, missing tags.
Full-power feature implementation using parallel subagents for backend, frontend, testing, and security.
Performs a first-pass security audit of project structure and attack surface to map risk and entry points. Use as the starting point for a security review.
Run the Vibe Innovation Framework mini-gate assessment to scope, justify, and execute a loop-back. Use when evidence in the current phase suggests an earlier phase's output is…
IOC pivots for a CVE — top IPs, ASNs, geo distribution, ATT&CK technique chain, Shadowserver scan counts (1d/7d/30d/90d averages), CrowdSec community sightings, merged in-the-wild…
Use when the user asks to find a device, contact, or serial number across every IT Glue client, rank clients by documentation completeness, audit stale passwords for SOC2 /…
Reviews or implements Spring Security configuration — JWT authentication, OAuth2, method-level security, CORS, and CSRF.
Quick OWASP security scan for injection risks, hardcoded secrets, weak crypto, and Spring Security misconfigs.
Jenkins UI and frontend development — Jelly views, Design Library components, form controls, help files, JavaScript integration, and XSS prevention.
Audit Kafka security configuration across the codebase and live cluster using the Lenses MCP server. Checks authentication (SASL), encryption (SSL/TLS), authorisation (ACLs),…
Generate and configure cloud infrastructure (IaC) and CI/CD pipelines from the architecture's cloud spec. Idempotent over existing infra. Includes infra security review.
QA code review in 8 dimensions (Security with OWASP Top 10 + STRIDE, Errors, Consistency, Impact, Env vars, Versioning, Second opinion cross-model, Visual audit vs design-spec).
Use when the user asks to run their Kaseya BMS service desk from the terminal - check the queue, find stale or aging tickets, balance technician workload, review unbilled billable…
Keitaro tracker management for affiliate marketers and media buyers. Manage campaigns, flows, landings, reports, and optimization via natural language through Keitaro Admin API.
CISA + EU KEV (Known Exploited Vulnerabilities) catalog watch — pull recent KEV additions, intersect with installed dependencies, surface entries with imminent due dates.
Gated feature, bug-fix, and explicit project-release loop: clarify, discover/diagnose, plan, implement, verify, review, and commit.
Kronikarz projektu — generuje wpis dokumentujący postępy z bieżącej sesji AI (Dziennik Prac). Uruchamiaj pod koniec każdej sesji pracy, aby zapisać kontekst, decyzje…
Code review for PRs or local changes. Covers code quality, dependency updates, performance, test coverage, documentation accuracy, and security.
Every Level RMM endpoint, plus a local SQLite fleet store and offline cross-entity rollups no Level tool has: at-risk ranking, patch posture, alert triage, and stale-device…
Use when the user asks to see what changed across their Liongard environments, find stale launchpoints or offline agents, run an estate-wide health or coverage check, pivot a…
Reviews LLM-powered applications against the OWASP Top 10 for Large Language Model Applications (2025 edition).
Design a system's architecture for the agent-assisted era: choose the architecture style, the stack, the module boundaries, the contracts, and the data model — concentrating…
Configure and operate the kube-logging logging-operator (formerly Banzai Cloud) on Kubernetes — the CRD-driven log pipeline: Fluent Bit collector → fluentd or syslog-ng aggregator…
Analyze a PR for LVMS (LVM Storage) security threats with STRIDE/DFD analysis, MITRE ATT&CK and OWASP mapping
Strategic analysis of a project to identify the single highest-leverage, most innovative addition. Use when the user asks what to build next, what the most impactful improvement…
Android APK analysis using GDA.exe. AI drives analysis by tracing code paths, extracting IOCs (including encrypted), and producing structured malware reports.
Inspects and configures the web application firewall (WAF) in front of a Power Pages production site.
Inspects and configures the security headers a Power Pages site sends to browsers — Content Security Policy, frame and clickjacking protection, cross-origin sharing, cookie…
Proactieve weekly management-sweep — draait alle 5 manager-agents (SEO, indexering, security, performance, content) parallel over de LIVE shop + codebase en levert één…
Open, local revenue-intelligence CLI for Maxio Advanced Billing - MRR waterfalls, retention, and per-client history computed offline from a SQLite mirror, so the trended history…
Use when the user asks to find wasted Microsoft 365 licenses, see who holds global admin or other privileged roles, triage new Microsoft Defender security alerts, flag…
Manage and interact with MisarDefender — the local macOS security daemon. Use when: checking security daemon status, viewing security events, starting/stopping defender, scanning…
Use when working with mise (mise-en-place) or planning to update mise.toml. If the project use mise consult it even for one-line edits to mise.toml/hk.pkl, hooks, or CI tool…
Score durability across 7 moat types (network, switching, scale, brand, IP, data, regulatory) with 0–10 per moat + decay-rate forecast. Routes to red-team-strategist.
Use when: structuring a multi-lens review of a change, spec, design, or implementation; combining intent, design, implementation, security, adversarial, and verification…
Use when the user asks to find a device in N-able N-central, run the morning NOC triage sweep, search across N-central servers, audit custom-property or maintenance-window…
Use when the user asks to audit autoscale across all their Nerdio Manager customers, sweep session-host power state, reconcile per-customer billing and usage, list customer…
Given an open good-first-issue on the configured `` repo, explain it in beginner terms and sketch a concrete approach: which files to read first, what "done" looks like,…
Every NinjaOne report, plus a local store that answers fleet-wide questions no single API call can: patch compliance, backup gaps, AV blast-radius, health, drift.
Use when drafting, editing, or reviewing chapters of The Old Songs of Aevoria narrative fiction series.
Connect Google (GTM, GA4, Google Ads) and Meta Ads to ppc-manager via OAuth. Walks through Google Cloud Console and Meta app setup, runs browser-based OAuth, and stores encrypted…
Answer a newcomer's "how do I contribute here" question by grounding the response in `CONTRIBUTING.md` and the project's own docs.
Generate `op://` secret references for every field on a 1Password item. Output is ready to paste into a `.env` template.
Użyj tego skilla do wieloźródłowego researchu w sieci: wyszukiwania jednego lub wielu tematów, pobierania wielu stron przez fetchWebContent i zapisywania oczyszczonych plików…
OpenAI Agents SDK (Python) development. Use when building AI agents, multi-agent handoffs, function tools, guardrails, sessions, streaming, or tracing with the `openai-agents` /…
Analyze affected packages and version ranges in OSV vulnerability records. Triggers on mentions of affected packages, version ranges, impacted ecosystems, package vulnerability…
Filter OSV vulnerability data by ecosystem, reference type, or alias pattern. Triggers on mentions of filtering vulnerabilities by package ecosystem (npm, PyPI, Maven), reference…
Parse an OSV (Open Source Vulnerability) JSON file and display structured vulnerability data. Triggers on mentions of OSV parsing, vulnerability JSON reading, CVE/GHSA data…
Extract specific sub-information from OSV vulnerability data — severity details (CVSS v2/v3), Maven package decomposition, version ranges, or event timelines.
Analyze CVSS severity data from OSV vulnerability records. Triggers on mentions of CVSS scores, vulnerability severity assessment, risk rating, or when user needs to evaluate the…
Validate OSV (Open Source Vulnerability) JSON files against the schema. Triggers on mentions of OSV validation, vulnerability format checking, schema compliance, or when user…
Use when the user asks for news, wants a briefing, says "/news-briefing", or asks to aggregate recent information on any topic.
Pack an EXTERNAL repository into a single AI-friendly file (markdown/xml/json). Use for third-party library analysis, security audits, or handoff to external LLMs.
Fan a local diff through three independent, axis-focused review passes (correctness, security, conventions), then merge the findings into a single structured report.
Run a structured pre-flight self-review on local changes before opening a PR. Reads the diff against a configurable base (default: the merge base of HEAD and the upstream default…
Use Pawahara Harness for difficult coding, CTF, competitive programming, debugging, optimization, or long-running tasks that benefit from diverse beam-search workers, scoring,…
Use when the user asks to reconcile Pax8 billing, find invoice leakage, compute Pax8 MRR and margin, catch usage overages before they invoice, see what changed in their book of…