Other skills

Use when the person and the agent go over what was just delivered together, live: on execute-plan's recommendation at a plan's close, or whenever the person asks to walk or rework a delivery with the agent. Runs the project's verify skill with the person guiding it, judging and deciding, the agent proposing what to check. Not for the agent's quality pass alone (the project's verify skill).

The English summary is being prepared. Showing the original description.

Use when a person wants a swarm of role seats to work a topic on the swarm board under a chosen protocol: a brainstorm (ideas before any judgment), a debate (questions argued to decisions, a skeptic endorsing) or an editorial (one text drafted, read by seats standing for its readers, revised), a protocol or template the project keeps as a `protocol-<name>` skill (or an older `brainswarm-<name>` one), or a custom protocol recommended for the person's intent, or a seat's brief names a brainswarm protocol. Produces the run's record in aiview, written by the orchestrator alone. Not for one person thinking aloud with the agent (brainstorm, interview) and not for a plan's slices (execute-plan).

The English summary is being prepared. Showing the original description.

Use when carrying out an implementation plan the person has already approved, whether starting it or resuming it in a later session, and the tracker in it has to stay true while the work happens. Not for producing the plan (write-plan) and not for reviewing the result.

The English summary is being prepared. Showing the original description.

Use when a person wants to think an idea through and keep the discussion: a feature, a tool choice, an architecture question, before a plan or without one, with the agent through an interview. Produces a board in aiview holding the decisions, the diagrams and what was investigated. Not for a swarm of seats working it (brainswarm), not for an implementation plan and not for bug fixes.

The English summary is being prepared. Showing the original description.

Use when a pull request needs readable coverage feedback rather than one total. Compares current and baseline coverage (LCOV, Cobertura or JSON) and reports per-file line and branch deltas, new files and hidden drops, with a one-line summary for the PR comment.

The English summary is being prepared. Showing the original description.

Use when a weekly quality review, sprint check-in or quarterly portfolio review is due and the numbers already exist in CI, the tracker and the quarantine list. Computes pass rate, escaped defects and flake debt, rates each area red, amber or green, and rolls teams up into a portfolio view.

The English summary is being prepared. Showing the original description.

Use when a service is about to ship and its release steps live only in people's heads or a chat thread, or a shared release window needs its cutover order. Writes a six-phase runbook (pre-flight, smoke, canary, promote gate, rollout, verification) with baseline-relative criteria and rollback paths.

The English summary is being prepared. Showing the original description.

Use after any user-visible incident to write a blameless post-mortem: a sourced timeline, root cause (what and why, not who), impact on users, revenue and SLOs, action items with owners, dates and success criteria, and what went well.

The English summary is being prepared. Showing the original description.

Use when a team runs ProjectDiscovery Nuclei for template-based web scanning, alongside or beyond ZAP: choosing templates by path, tag or severity, rate limits, JSONL output, custom YAML matchers for app-specific checks, community CVE templates and CI severity gates.

The English summary is being prepared. Showing the original description.

Use when a product shows dates, numbers, currencies, times or durations to users in several locales and needs proof each locale formats them correctly (5/4/2026 vs 04.05.2026, 1,234.56 vs 1.234,56, $ vs EUR placement).

The English summary is being prepared. Showing the original description.

Use when a performance regression is traced to a commit but the hot path inside it is unclear. Reads flame graphs from py-spy, async-profiler, Go pprof or clinic.js, finds the hottest frames, tells CPU-bound from lock contention or allocation pressure and suggests the next step.

The English summary is being prepared. Showing the original description.

Use when a pull request changes .proto files for gRPC services, Buf Schema Registry modules or message-bus payloads, and consumers must not break. Runs buf breaking against a past version, picks the FILE, PACKAGE, WIRE_JSON or WIRE category, sets exemptions and gates CI.

The English summary is being prepared. Showing the original description.

Use when scoping an embedded hardware-in-the-loop (HIL) rig or reading an automotive, aerospace or industrial HIL report: MIL, SIL, PIL and HIL stages, NI, dSPACE, Vector and Speedgoat stacks, CAN, LIN, FlexRay and Ethernet emulation, fault injection and ISO 26262, DO-178C and IEC 61508 evidence.

The English summary is being prepared. Showing the original description.

Use when a pull request changes a GraphQL schema, or a Federation supergraph may have drifted. Diffs the schemas with graphql-inspector, classifies changes as breaking, dangerous or safe, applies rules such as deprecated-field removal and usage checks, and gates CI.

The English summary is being prepared. Showing the original description.

Use when a Cucumber, Behave or Reqnroll project has grown past ~50 step definitions, before writing a step that may already exist, or when new .feature files need a duplicate check. Inventories steps, merges duplicates, publishes a step-library README and a scenario coverage map.

The English summary is being prepared. Showing the original description.

Use when a project has accessibility debt and a zero-violations gate would block every PR. Builds a CI ratchet that fails only on new WCAG violations a PR introduces, with pre-existing ones baselined per rule and page, from axe-core, pa11y, Lighthouse, WAVE or IBM Equal Access results.

The English summary is being prepared. Showing the original description.

Use after an accessibility scan across many pages (pa11y-ci, axe over a sitemap, Lighthouse batch) when the team needs a shareable conformance report. Groups violations by WCAG 2.2 success criterion and level, flags pages that were not scanned and writes a summary plus per-page detail.

The English summary is being prepared. Showing the original description.

Use when building or reviewing a custom interactive widget with no native HTML equivalent (combobox, dialog, menu, tabs, tree and more). Gives the W3C ARIA Authoring Practices pattern: required roles and states, keyboard interaction and common violations.

The English summary is being prepared. Showing the original description.

Detect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse across Windows and Linux.

The English summary is being prepared. Showing the original description.

Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs, SMB traffic, and remote service abuse.

The English summary is being prepared. Showing the original description.

Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Activates for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.

The English summary is being prepared. Showing the original description.

Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous ticket usage patterns in Splunk and Elastic SIEM

The English summary is being prepared. Showing the original description.

Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware. Activates for requests involving fileless malware detection, in-memory attacks, PowerShell exploitation, or living-off-the-land techniques.

The English summary is being prepared. Showing the original description.

Detect bootkits such as BlackLotus and Bootkitty and Secure Boot bypass via DBX and binary checks.

The English summary is being prepared. Showing the original description.