Email, calendars, task management, and automation (7.7K skills)
Build a minimal context pack and recommend the correct specialist path for token-efficient execution. Use when the task is non-trivial, spans multiple domains, or should reduce token usage before implementation.
The English summary is being prepared. Showing the original description.
Plan and sequence complex implementation work into deterministic, testable steps. Use when the user asks for planning, roadmap breakdown, execution strategy, effort estimation, or multi-step delivery coordination across domains.
The English summary is being prepared. Showing the original description.
Create safe, deterministic git worktrees for large or risky workstreams. Use when tasks are complex enough to warrant isolation from the main working tree.
The English summary is being prepared. Showing the original description.
Plan and sequence complex implementation work into deterministic, testable steps for this repository. Use when the user asks for planning, roadmap breakdown, execution strategy, effort estimation, or multi-step delivery coordination across domains.
The English summary is being prepared. Showing the original description.
Assembles the minimal context pack for a given task. Use when the task spans multiple domains or the context set has obvious redundancy. Do not trim required working context by default.
The English summary is being prepared. Showing the original description.
Route tasks using the repository's static routing catalog and load only the minimal context pack. Use before execution when the task spans multiple domains or the correct instruction set is unclear.
The English summary is being prepared. Showing the original description.
Create or update active planning documents under `planning/active`, then define the execution slices, validations, specialist handoff, and closeout expectations. Use when the task is non-trivial, multi-step, or explicitly asks for planning.
The English summary is being prepared. Showing the original description.
Creates or updates the active planning artifact under planning/active/ for any change-bearing workstream. Consumes the active spec when one exists. Defines ordered tasks, target paths, commands, and checkpoints.
The English summary is being prepared. Showing the original description.
Start or resume a MYOT task by reading AGENTS.md, project_map.md, and history.md, archiving history.md when switching tasks, and preparing a concise current task snapshot.
The English summary is being prepared. Showing the original description.
Configure GSD workflow toggles and model profile
The English summary is being prepared. Showing the original description.
Execute a quick task with GSD guarantees (atomic commits, state tracking) but skip optional agents
The English summary is being prepared. Showing the original description.
Zero-friction idea capture. Append, list, or promote notes to todos.
The English summary is being prepared. Showing the original description.
Capture idea or task as todo from current conversation context
The English summary is being prepared. Showing the original description.
Automatically advance to the next logical step in the GSD workflow
The English summary is being prepared. Showing the original description.
Execute a trivial task inline — no subagents, no planning overhead
The English summary is being prepared. Showing the original description.
List pending todos and select one to work on
The English summary is being prepared. Showing the original description.
Evaluates and selects Threat Intelligence Platform (TIP) products based on organizational requirements including feed integration capability, STIX/TAXII support, workflow automation, analyst interface, and total cost of ownership. Use when conducting a TIP procurement, migrating between TIP solutions, or assessing whether the current TIP meets program maturity requirements. Activates for requests involving ThreatConnect, MISP, OpenCTI, Anomali, EclecticIQ, or TIP procurement decisions.
The English summary is being prepared. Showing the original description.
Spearphishing targets specific individuals using personalized, researched content that bypasses generic spam filters. Email security gateways (SEGs) like Microsoft Defender for Office 365, Proofpoint,
The English summary is being prepared. Showing the original description.
Detect compromised O365 and Google Workspace email accounts by analyzing inbox rule creation, suspicious sign-in locations, mail forwarding rules, and unusual API access patterns via Microsoft Graph and audit logs.
The English summary is being prepared. Showing the original description.
Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks. Activates for requests involving scheduled task detection, Sysmon persistence hunting, or T1053.005 Scheduled Task/Job analysis.
The English summary is being prepared. Showing the original description.
Detect malicious email forwarding rules created by adversaries to maintain persistent access to email communications for intelligence collection and BEC attacks.
The English summary is being prepared. Showing the original description.
Implement a phishing report button in email clients with automated triage workflow that analyzes user-reported suspicious emails and provides feedback to reporters.
The English summary is being prepared. Showing the original description.
Responds to phishing incidents by analyzing reported emails, extracting indicators, assessing credential compromise, quarantining malicious messages across the organization, and remediating affected accounts. Covers email header analysis, URL/attachment sandboxing, and mailbox-wide purge operations. Activates for requests involving phishing response, email incident, credential phishing, spear phishing investigation, or phishing remediation.
The English summary is being prepared. Showing the original description.
Builds an automated malware submission and analysis pipeline that collects suspicious files from endpoints and email gateways, submits them to sandbox environments and multi-engine scanners, and generates verdicts with IOCs for SIEM integration. Use when SOC teams need to scale malware analysis beyond manual sandbox submissions for high-volume alert triage.
The English summary is being prepared. Showing the original description.