181 skills · sorted by relevance
Break a large development brief into ordered goals and save plans, progress events, blockers, and evidence in the repository. Coordinate Claude Code sessions through handoff instructions, with final completion requiring cleanup, verification, and code review evidence.
Prepare batches of merged SGLang pull requests for a release branch. It checks conflicts and previous attempts, starts the cherry-pick workflow, monitors completion, and reports created pull requests or failure reasons.
Assess whether a container can escape its isolation and reach the host during an authorized security test. Review privileges, shared mounts, Docker socket exposure, and runC vulnerabilities, then document demonstrated impact and remediation.
Develop network monitoring for signs that may precede ransomware encryption. Uses detection rules, linked log events, and threat intelligence to identify suspicious activity and define how alerts should be investigated, prioritized, and escalated.
Investigate suspicious PowerShell activity using endpoint monitoring data and security logs. Examine encoded commands, downloads, and attempts to evade inspection, then document evidence, affected systems, risk, and recommended response actions.
Create and tune Falco rules to detect possible container escapes, where a container gains access to its host. Define detection conditions, alert priorities, and output fields, then refine exceptions to reduce false positives.
Inspect DNP3 traffic, a communication protocol used in industrial control systems, for unauthorized sources and unexpected commands. The skill compares captured traffic with normal patterns and reports suspicious control actions, restarts, and file operations.
Examine Windows and Active Directory logs for attempts to extract passwords and other credentials. Identify suspicious memory access and database exports, correlate events with user and host context, and produce findings with severity ratings and detection queries.
Detect unexpected changes in running containers by comparing them with their original images and monitoring execution and file activity. Use Falco or Microsoft Defender for Containers to investigate changes and guide isolation, replacement, and preventive configuration.
Investigate Kerberoasting, an attack that targets service account passwords, using Active Directory authentication logs. Examine unusual service ticket requests, correlate endpoint and network evidence, and organize findings with risk levels and recommended response actions.
Create detection rules and investigation queries from API access logs to flag repeated identifier probing and unusual authorization responses. Helps investigate attempts to access other users’ data and review logging and rate limits.
Deploy decoy accounts, service entries, and policy objects in Active Directory to detect suspicious activity. Configure monitoring rules for Windows security events and validate alerts for credential misuse, reconnaissance, and movement between systems.
Add checks to LLM prompts and responses using Llama Guard 3, NeMo Guardrails, and LLM Guard. Configure content screening, conversation boundaries, and sensitive-data filtering, then measure blocking and false-positive rates with labeled test prompts.
Investigate Linux intrusions using auditd records. Configure audit rules, search events with ausearch, summarize activity with aureport, reconstruct a timeline of suspicious actions, and forward logs to a central security monitoring system.
Investigate captured network traffic and connection records with Wireshark, Zeek, and NetFlow analysis. Identify communications with attacker infrastructure, trace movement between internal systems, estimate data transfers, and produce findings linked to packet evidence and timestamps.
Configure safety checks for LLM applications with NeMo Guardrails. Covers attempts to bypass safety rules, input and output validation, masking personal information, and checking factual claims through programmable rules and integrations.
Organize complex tasks with three Markdown files for plans, findings, and progress. Keep goals, decisions, errors, and test results available across sessions so the agent can review its position and continue work with a clear next step.
Investigates GitHub or Linear issues through code, change history, and reproduction attempts. Produces a structured handoff covering causes, assumptions, effort, and impact, then requests the appropriate Factory workflow stage update when applicable.
Write integration tests for core error processors by simulating API failures with a mock model. Check retry attempts, changes to conversation messages, and streamed responses, with guidance on test setup and diagnosing empty output.
Use German-language guidance to organize multi-step agent work in Markdown files. Store plans, findings, and progress by task, then revisit those records to resume research, review decisions, and track unfinished phases.
Review an outside contributor’s pull request before running its code. Identify concealed behavior, obfuscated code, risky dependencies, and build hooks, with file locations and specific checks for maintainers to follow up.
Analyze a difficult problem with two agents chosen for contrasting reasoning styles. They independently investigate causes and plan a solution, then exchange arguments to resolve disagreements and produce a shared recommendation without changing files.
Extends the core PUA skill with local performance notes, recovery of task state after conversation compression, KPI report cards, and style switching. It tracks established working habits across sessions and keeps feedback in a local file.
Design the controls around autonomous agents: what they can edit, how results are evaluated, how progress is logged, and when human approval is required. Build research and experiment loops with clear recovery and review rules.