688 skills · sorted by relevance
Organize internal investigations from intake to draft reports. Track evidence, missing sources, and conflicting accounts in a structured log, answer questions with entry references, and prepare summaries tailored to different audiences.
Start an internal investigation after a complaint or allegation. The skill collects intake details, creates a checklist of information sources, and sets up a persistent investigation log for attorneys preparing an investigation workspace.
Draft an internal investigation memo from the investigation log, or update an existing draft as new information arrives. The workflow flags outstanding priority sources and shows changes before revising the memo.
Turn an internal investigation report into a summary for HR, leadership, or outside counsel. Adjust detail for each audience, excluding legal analysis and attorney impressions from HR versions while retaining full context for outside counsel.
Add documents, interview notes, or observations to an open investigation. Process batches against documented selection criteria, surface significant items, and log everything reviewed so the team can verify coverage and update its source checklist.
Ask questions about an open internal investigation without rereading every log entry. The skill summarizes witness accounts, conflicting statements, evidence, and information gaps, citing log entry IDs so attorneys can trace answers back to the record.
Use when you need to check an IP, domain, file hash, or URL against VirusTotal's reputation database. Returns detection ratio, verdict, community score, and key findings. Commonly invoked by investigation skills (/ip-investigation, /domain-investigation, /hash-investigation, /url-investigation) and by analysts enriching IOCs. Other agents/skills can chain this for VirusTotal enrichment.
The English summary is being prepared. Showing the original description.
Define a consistent process for unattended AI research using public sources. Limit clarification questions, show a search plan, distinguish facts from interpretations and assumptions, and keep reports structured so repeated investigations can be compared.
Guides preparation for supervisory authority (DPA) inspections and investigations including document readiness checklists, interview preparation for key personnel, technical demonstration procedures, on-site logistics, response protocols, and post-inspection follow-up. Covers unannounced inspections, formal audits, and complaint-triggered investigations. Keywords: DPA inspection, supervisory authority, investigation, readiness, interview preparation, response protocol.
The English summary is being prepared. Showing the original description.
Conducts digital forensics investigations following a personal data breach, covering evidence preservation, chain of custody documentation, log analysis, scope determination, and root cause analysis. References industry-standard tools including Splunk, ELK Stack, and Wireshark. Provides forensic workflow from initial evidence collection through final investigation report. Keywords: digital forensics, breach investigation, evidence preservation, chain of custody, root cause analysis, Splunk, ELK, Wireshark.
The English summary is being prepared. Showing the original description.
Drafts privilege-protective, board-ready executive summary memoranda of internal antitrust investigation findings for US federal law. Covers monopolization, vertical restraints, acquisitions, FTC Act Section 5, tech-platform conduct, risk assessment, and remediation. Use when drafting antitrust investigation summaries, board memos on competition risk, or internal compliance investigation reports.
The English summary is being prepared. Showing the original description.
investigation-scout と investigation-diver による2フェーズ調査。 不具合の原因調査やコード探索など、未知の領域を掘り下げたいときに使う。 scout が候補を広く洗い出し、diver が高優先の候補を深掘りする。
The English summary is being prepared. Showing the original description.
Use this skill when the user asks about FMCSA investigation types — Focused Investigation vs Comprehensive Review vs Compliance Review (CR) vs Investigation, when each is triggered, scope differences, on-site vs off-site, and how to prepare for each. Cite 49 CFR 385 Subpart C + D.
The English summary is being prepared. Showing the original description.
Design or change REA investigation tools by defining responsibilities, inputs, results, and CLI or MCP interfaces. Produce a proposal that explains how Evidence records should be interpreted, compares the nearest existing alternative, and outlines verification.
Investigate photos, videos, public accounts, and records using OSINT, research based on public information. Connect sparse clues, test competing explanations, and report evidence, confidence, and unresolved questions about locations, events, identities, or infrastructure relationships.
Build a shared incident timeline in Timesketch from endpoint, server, and cloud logs. Search events, add tags and investigator notes, reconstruct the attack sequence, and organize findings into a story for incident reporting.
Investigate security incidents in Splunk by connecting authentication, endpoint, and network logs. Use SPL, Splunk’s search language, to identify suspicious activity, reconstruct event timelines, document findings, and develop detection rules.
Create disk images for investigations using dd or dcfldd on Linux. The workflow covers write protection, bit-for-bit copying, hash checks to verify integrity, and documentation of the acquisition process.
Analyze disk images with Autopsy and The Sleuth Kit to recover deleted files, search content, and examine recorded activity. Build investigation timelines and visual reports that help stakeholders understand evidence from one or multiple disk images.
Analyze Chrome, Edge, and other Chromium browser profiles with Hindsight to reconstruct web activity. Combine browsing history, downloads, cookies, and other stored records into a chronological timeline, with XLSX, JSON, or SQLite output for investigation.
Research topics across multiple sources, cross-check findings, and verify source URLs before producing a report with confidence labels. Choose from quick lookups to iterative investigations that preserve findings, with community sources prioritized for questions about public reactions.
Structure problem solving around clear goals, competing explanations, experiments, and measurable results. Use the cycle to diagnose bugs, validate features, compare prompts, or evaluate an early product, then choose the next step based on evidence.
Evaluate vulnerability reports using seven practical criteria, including attacker capabilities, real usage, documented behavior, and remediation costs. Produce a reasoned decision to accept, dismiss, or request more evidence before committing to deeper investigation.
Coordinates parallel investigation threads to simultaneously explore multiple hypotheses or root causes across different system areas. Use when debugging production incidents, slow API performance, multi-system integration failures, or complex bugs where the root cause is unclear and multiple plausible theories exist; when serial troubleshooting is too slow; or when multiple investigators can divide root-cause analysis work. Provides structured phases for problem decomposition, thread assignment, sync points with Continue/Pivot/Converge decisions, and final report synthesis.
The English summary is being prepared. Showing the original description.