Email, calendars, task management, and automation (7.8K skills)
Orchestrator - spawns an autonomous orchestrator agent that decomposes a task into subtasks and drives multiple Claude agents to completion. Use when: overmind, orchestrate, multi-agent, delegate, spawn agents, break down task, run agents.
The English summary is being prepared. Showing the original description.
Use TaskBelay for substantial development that benefits from saved progress, verification reuse or interruption recovery, or when explicitly requested. Reuse existing user authority. Skip ordinary questions and small mechanical edits unless requested.
The English summary is being prepared. Showing the original description.
[Workflow] Turn UI-bearing canonical specs into reviewed, interactive multi-view HTML mockups; stop before planned work or production code.
The English summary is being prepared. Showing the original description.
[Workflow] Implement behavior already captured in a canonical spec or test-case set, with scope held, reviewed changes and verified tests. Spec gaps use workflow-feature.
The English summary is being prepared. Showing the original description.
[Workflow] Turn an idea or existing canonical specs into a reviewed provisional spec or reviewed, readiness-checked, prioritized planned tasks and stories; stop before implementation. --from=idea|spec --to=spec|tasks.
The English summary is being prepared. Showing the original description.
[Project Management] Use for explicit project-owned tracker guidance (--mode=guide), or portable-engine work records, placement, linked concerns, lifecycle, evidence, acceptance and local status. Existing engine modes and bare inspect remain supported.
The English summary is being prepared. Showing the original description.
[Project Management] Use when a workflow step or the user asks for an initiative: a structured product idea or feature request ready for task refinement.
The English summary is being prepared. Showing the original description.
[Utilities] Use when asking about or configuring the .claude/.codex/.agents/.opencode skills framework: command discovery/help, runtime modes, scoped settings, commit reviews, hooks, workflows or skill visibility. Explains options; changes only requested settings.
The English summary is being prepared. Showing the original description.
[Code Quality] Use when a workflow step or the user asks for a focused code-change review: staged, unstaged, branch diff or simple pull request. --fix-loop fixes and re-reviews. Complex pull request: workflow-review-changes; rationale: why-review.
The English summary is being prepared. Showing the original description.
Build GenAI and agentic apps with genai-tk (tclatos/genai-tk), a YAML-driven IoC toolkit over LangChain, DeepAgents, DeerFlow, and Prefect. Use this skill whenever the user mentions genai-tk, genai_tk, `cli init`, `cli agents run`, `LangchainAgent`, `create_harness`, `get_llm`, `global_config()`, `model_id@provider`, `agents:`/`agent_defaults:` profiles, `RetrieverFactory`, `cli workflow`, or BAML extraction. Also trigger for app_conf.yaml, GENAITK_PROFILE, CodeAct, OpenSandbox, decision models, or "the toolkit".
The English summary is being prepared. Showing the original description.
Convert any phased plan file, or a conversation about what to build, into labelled GitHub issues under one tracking epic mapping each issue to its source task. No plan file required. Don't use for writing plans, resolving issues, or triage.
The English summary is being prepared. Showing the original description.
Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks. Activates for requests involving scheduled task detection, Sysmon persistence hunting, or T1053.005 Scheduled Task/Job analysis.
The English summary is being prepared. Showing the original description.
Spearphishing targets specific individuals using personalized, researched content that bypasses generic spam filters. Email security gateways (SEGs) like Microsoft Defender for Office 365, Proofpoint,
The English summary is being prepared. Showing the original description.
Detect compromised O365 and Google Workspace email accounts by analyzing inbox rule creation, suspicious sign-in locations, mail forwarding rules, and unusual API access patterns via Microsoft Graph and audit logs.
The English summary is being prepared. Showing the original description.
Detect malicious email forwarding rules created by adversaries to maintain persistent access to email communications for intelligence collection and BEC attacks.
The English summary is being prepared. Showing the original description.
Responds to phishing incidents by analyzing reported emails, extracting indicators, assessing credential compromise, quarantining malicious messages across the organization, and remediating affected accounts. Covers email header analysis, URL/attachment sandboxing, and mailbox-wide purge operations. Activates for requests involving phishing response, email incident, credential phishing, spear phishing investigation, or phishing remediation.
The English summary is being prepared. Showing the original description.
Build an automated pipeline to defang indicators of compromise (URLs, IPs, domains, emails) for safe sharing and distribute them in STIX format through TAXII feeds and threat intelligence platforms.
The English summary is being prepared. Showing the original description.
Automates the enrichment of raw indicators of compromise with multi-source threat intelligence context using SOAR platforms, Python pipelines, or TIP playbooks to reduce analyst triage time and standardize enrichment outputs. Use when building automated enrichment workflows integrated with SIEM alerts, email submission pipelines, or bulk IOC processing from threat feeds. Activates for requests involving SOAR enrichment, Cortex XSOAR, Splunk SOAR, TheHive, Python enrichment pipelines, or automated IOC processing.
The English summary is being prepared. Showing the original description.
Implement a phishing report button in email clients with automated triage workflow that analyzes user-reported suspicious emails and provides feedback to reporters.
The English summary is being prepared. Showing the original description.
Builds an automated malware submission and analysis pipeline that collects suspicious files from endpoints and email gateways, submits them to sandbox environments and multi-engine scanners, and generates verdicts with IOCs for SIEM integration. Use when SOC teams need to scale malware analysis beyond manual sandbox submissions for high-volume alert triage.
The English summary is being prepared. Showing the original description.
Examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.
The English summary is being prepared. Showing the original description.
Analyze the NTFS Master File Table ($MFT) to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space using MFTECmd, analyzeMFT, and X-Ways Forensics.
The English summary is being prepared. Showing the original description.
Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry keys, scheduled tasks, services, drivers, and startup locations on Windows systems.
The English summary is being prepared. Showing the original description.
Analyze Microsoft Outlook PST and OST files for email forensic evidence including message content, headers, attachments, deleted items, and metadata using libpff, pst-utils, and forensic email analysis tools for legal investigations and incident response.
The English summary is being prepared. Showing the original description.