727 skills · sorted by relevance
Investigate slow jobs, stale data, and timeout alerts by timing the specific operation and comparing monitoring thresholds. Produce an evidence-based verdict that distinguishes insufficient time, stalled work, and false alerts before proposing changes.
Set up and troubleshoot the WizTelemetry Notification extension for KubeSphere. Configure delivery channels such as email and Slack, route alerts by labels, silence notifications for scheduled periods, and search notification history to investigate delivery problems.
Investigate an alert or suspicious identifier using logs and source code. Assess attack success, measure affected data and users, test the suspected flaw locally, and produce a response plan for human review and execution.
Replace the object detector in VSS Alerts Blueprint verification mode with an ONNX model. This guide covers model placement, interpreting detection outputs, DeepStream configuration, TensorRT engine builds, redeployment, and common loading or mount failures.
Turns one-shot external recon into a continuous monitoring program. Covers the scheduled re-scan-and-diff loop (baseline snapshot -> interval sleep -> re-scan -> asset/finding delta -> threshold-gated webhook alert), the scan-to-scan diff engine (new/removed/changed assets by a tracked-attribute table, new/resolved findings by a stable cross-scan fingerprint), adversary CTI / chatter monitoring across six public feeds (ransomwatch, ransomware.live, HackerNews Algolia search, Reddit security-subreddit RSS, GitHub Gist code-search, public Telegram channel scraping) with a source-kind-aware severity engine (leak-site/forum/telegram/paste tiers, CRITICAL through INFO), literal/glob/regex watchlist pattern matching, full-corpus capture with retroactive rescan on new watchlist entries, infrastructure-tracking-over-time discipline (certificate-transparency, passive-DNS, port/service, and typosquat re-enumeration cadence, and what a genuine 'perimeter drift' event looks like in the diff output), a five-state finding-lifecycle state machine (open/triaged/risk_accepted/resolved/false_positive) with per-severity SLA and fingerprint-based cross-scan dedup and auto-resolve/reopen rules, the alert-fatigue trap where a lifecycle-unaware rule re-fires on an already-accepted finding, a durable retry/backoff alert-outbox pattern ('queued is not delivered'), and copy-paste bash-cron plus PowerShell-Scheduled-Task recipes for a re-scan+diff loop with the Slack-compatible webhook payload shape. Passive OSINT and analysis only -- no new active-intrusion technique. Use when setting up ongoing monitoring for a retainer or MSSP engagement, tuning alert thresholds to avoid fatigue, triaging a finding's lifecycle status, investigating adversary chatter about a brand, building a 'what changed on the perimeter since last week' report, or deciding whether a persisting finding should re-alert.
The English summary is being prepared. Showing the original description.
Inspect fired CCAM alerts and manage alert rules for token thresholds, event patterns, inactivity, and status duration. Use when acknowledging alerts, creating or editing a rule, checking cooldowns, or connecting alert rules to webhook targets.
The English summary is being prepared. Showing the original description.
Design and run a monitoring system for a website or web app. Use this skill when setting up uptime checks, defining SLOs, configuring error tracking, choosing what to alert on, designing on-call rotations, or fixing alert fatigue. Triggers on monitoring, alerts, uptime, SLO, SLA, error rate, on-call, pager, alert fatigue, observability, dashboards, what should we monitor. Also triggers when an incident reveals a gap in monitoring.
The English summary is being prepared. Showing the original description.
Build, run, and improve a Security Operations Center — alert prioritization, runbook authoring, escalation criteria, on-call structure, alert tuning workflow, MTTD / MTTR / fidelity KPIs, analyst tiering, and shift handoffs. Use when the user mentions 'SOC,' 'security operations,' 'SOC analyst,' 'alert triage workflow,' 'runbook,' 'escalation,' 'on-call,' 'SOC tiering,' 'tier 1 / tier 2,' 'MTTD,' 'MTTR,' 'alert fatigue,' 'alert tuning,' 'shift handoff,' 'SOAR,' or wants to design or improve a security operations team.
The English summary is being prepared. Showing the original description.
Use when the repository keeps its alerting in code, or a person asks for alerts outside TaskTrooper - PrometheusRule YAML, a Cloud Monitoring alert policy in Terraform, a Datadog monitor, each routed to TaskTrooper's alert ingest URL so it opens an incident here
The English summary is being prepared. Showing the original description.
Analyze production Agentforce agent behavior using session traces and Data Cloud, and manage Agent Health Monitoring (AHM) alerts. TRIGGER when: user queries STDM session data or Data Cloud trace records; investigates production agent failures, regressions, or performance issues; asks about session traces, conversation logs, or agent metrics; wants to reproduce a reported production issue in preview; runs findSessions or trace analysis queries; creates, lists, updates, or deletes an AHM data alert on an agent metric (escalation rate, deflection, etc.); asks why an alert is not firing or wants to check whether alerts have fired (notification counts, or the per-alert Incidents view). DO NOT TRIGGER when: user creates, modifies, or debugs .agent files during development (use agentforce-generate); writes or runs test specs (use agentforce-test); uses sf agent preview for local development iteration; deploys or publishes agents.
The English summary is being prepared. Showing the original description.
Medicinal chemistry filters for compound triage. Apply drug-likeness rules (Lipinski rule of five, Veber, Oprea, CNS, lead-like, rule of three), structural alert catalogs (PAINS a/b/c, NIBR screening-deck severity, Brenk, BMS, Glaxo, Dundee, ChEMBL common alerts), ZINC-15 percentile complexity metrics (Bertz, SAscore, QED, Whitlock, Barone), chemical-group detection, Lilly demerits, and the medchem query language (MATCHRULE, HASALERT, HASPROP, HASGROUP) for filtering a library at scale. Also trigger on medchem, `import medchem as mc`, RuleFilters, NIBRFilters, CommonAlertsFilters, NamedCatalogs, QueryFilter, PAINS filtering, or structural alerts.
The English summary is being prepared. Showing the original description.
Use this skill when an auditor, customer or regulator will ask how security events are logged and watched, and someone says "prepare logging evidence", "show we monitor alerts", "what do we log and for how long", "who looks at the SIEM", "prove an alert was handled" or "our monitoring evidence is just dashboard screenshots". Maps log coverage and retention per system, lists the alert rules that matter and where they go, traces real alerts end to end with timestamps, and writes an evidence pack with the gaps stated plainly.
The English summary is being prepared. Showing the original description.
Process OpenClaw GitHub Secret Scanning alerts, which flag exposed credentials. Inspect affected content, redact secrets, replace comments when needed, notify authors, and resolve alerts using a dedicated script under maintainer permissions.
Use the VideoDB Python SDK to search video by speech or visual content and create playable clips with timestamps. Add subtitles and audio, change aspect ratios, and configure alerts for live video or desktop sessions.
Build clinical decision support for electronic medical records, covering drug interactions, dose validation, clinical risk scores, and alerts. Provides patterns for testable checking functions, severity-based interface behavior, and safety tests that detect missed warnings.
Create and tune Falco rules to detect possible container escapes, where a container gains access to its host. Define detection conditions, alert priorities, and output fields, then refine exceptions to reduce false positives.
Set up decoy credentials, storage, and secrets across AWS, Azure, and GCP to detect suspicious access. Connect audit logs to security alerts, verify detection, and document permissions, resource inventories, and maintenance plans.
Deploy decoy credentials, documents, and URLs with Canarytokens to detect suspicious access. Guides token generation, placement, alert testing, and inventory tracking, with email or webhook notifications when someone interacts with a planted token.
Set up decoy files on endpoints and shared folders to detect possible ransomware activity. Monitor modifications, deletions, and renaming with file monitoring tools, connect events to alerts, and test whether the detection and response process works.
Create automated workflows that add threat intelligence to suspicious IP addresses, domains, URLs, and file hashes. Combine findings from multiple services into consistent alert context and confidence scores to support analysts reviewing security alerts.
Design a product metrics dashboard with clearly defined measures, data sources, charts, targets, and alert thresholds. The skill produces a Markdown specification that also covers dashboard layout, review schedules, and responsibilities for responding to alerts.
Configure GKE logging, metrics collection, dashboards, and alerts with Cloud Logging, Cloud Monitoring, and managed Prometheus. Diagnose missing measurements, collection failures, permission errors, and alert rule problems to identify appropriate configuration changes.
Monitor daily AWS spending by service and account, compare it with historical baselines, and send Slack alerts with cost differences and likely causes. Known planned increases are excluded, and cloud resources remain unchanged.
Track machine learning experiments with Trackio by recording training measurements, viewing live dashboards, and flagging diagnostic events. Retrieve metrics and alerts through command-line queries, with JSON output for automated monitoring and experiment review.