152 skills ・ Works with: Datadog · sorted by popularity
Export recorded AI usage costs and budgets as Prometheus metrics or JSON. Feed external dashboards with totals, model tier breakdowns, session costs, and budget utilization, or send the same data to a webhook endpoint.
Schedule Claude Code cloud agents for recurring tasks or a single future run. Define their instructions, repositories, and service connections, then manage routines, run them immediately, and inspect execution logs when problems occur.
Coordinate specialist agents to investigate and improve application performance across databases, backend services, frontend code, and delivery infrastructure. Establish baseline measurements, address observed bottlenecks, validate changes with load tests, and set up monitoring to detect future slowdowns.
Use Stratus Red Team to simulate attack techniques across AWS, Azure, GCP, and Kubernetes. Prepare test resources, run and repeat simulations, check logs and alerts, and remove resources to assess whether security detections work.
Inspect npm packages and dependency files for malicious installation scripts, credential theft, and self-spreading behavior. Use GuardDog scanning, source inspection, known-malicious version checks, and isolated execution to produce an evidence-based assessment.
Investigate production issues by searching Datadog logs, querying metrics, and following request traces across services. Compare error counts across time periods, inspect surrounding logs, and manage dashboards through a command-line tool.
Build an investor fundraising presentation as a single PowerPoint file. The skill adapts the narrative, metrics, charts, and funding request to the company’s financing stage and business sector, with checks for numerical clarity and slide quality.
Investigate Sentry alerts using Datadog logs and recent GitHub changes, then post an initial diagnosis with a severity assessment. Notify the on-call team when severity reaches the configured threshold or the investigation remains inconclusive, without changing monitored systems.
Draft incident postmortems by aligning channel updates, GitHub deploys and merges, and Datadog spikes. It opens a review PR with a correlated timeline, proposed causes, and candidate follow-up actions for humans to confirm.
Connect Kortix to Microsoft Teams and handle conversations with progress updates, final replies, and interactive questions. The skill also covers reading channel discussions, exchanging files, and posting to conversations the bot has already joined.
Connect Slack to Kortix and handle team conversations through the Slack CLI. Show live progress, send formatted replies, share files, and search messages, with thread binding that routes follow-up replies back to the same agent session.
Search and aggregate Datadog logs through the Composio CLI. Filter by service, environment, and time range, follow requests across services, and export structured JSON for incident analysis or scheduled daily digests.
Creates comprehensive Technical Design Documents (TDD) with mandatory and optional sections through interactive discovery. Use when user asks to "write a design doc", "create a TDD", "technical spec", "architecture document", "RFC", "design proposal", or needs to document a technical decision before implementation. Do NOT use for README files, API docs, or general documentation (use docs-writer instead).
The English summary is being prepared. Showing the original description.
Analyze gh-aw OpenTelemetry traces from JSONL mirrors or OTLP backends.
The English summary is being prepared. Showing the original description.
Implement secret-safe HTTP headers for MCP transport in gh-aw.
The English summary is being prepared. Showing the original description.
Scans a live Kubernetes environment with `mirrord dump` to find an identifier mirrord can filter traffic on: a header, a `baggage` or `tracestate` member, a tenant or user id, a trace id (W3C, B3, X-Ray, Google, Jaeger), a JWT claim, a cookie, a path segment, or a JSON body field that is present on every hop of a request chain, unique to one developer's traffic, and settable by that developer. Runs mirror-only dumps on each service, sends a tagged probe request at the edge or observes real traffic, scores the candidates, and produces the matching `http_filter` (regex, jq on headers, path, method, body, or combinations) plus a per-hop report of where each identifier is dropped. Installs the mirrord CLI through a package manager when it is missing. Use when the user asks what to filter on, whether the cluster already propagates a request id or trace context, how to isolate their own requests on a shared staging cluster, how to filter on a JWT or cookie with mirrord, or wants to inspect live traffic with mirrord dump. Changes no application code: propagation gaps go to the mirrord-header-propagation skill.
The English summary is being prepared. Showing the original description.
Makes a codebase propagate W3C baggage (the `baggage` header carrying `mirrord-session=<key>`) end to end, so mirrord HTTP filters, preview environments, and queue splitting can route a whole request chain to one developer's session. Detects existing OpenTelemetry, Datadog, or other tracing that can already propagate baggage and enables it; otherwise adds a small propagation layer. Covers inbound/outbound HTTP and gRPC, publishing to and consuming from Kafka, RabbitMQ, SQS/SNS, GCP Pub/Sub, Azure Service Bus, NATS, Redis Pub/Sub, BullMQ and Temporal, per-message context restore in consumers, and storage hand-offs such as a GCS signed URL upload that triggers Pub/Sub or an S3 presigned upload that triggers SQS. Ends with a report of every flow found and which ones still drop the header. Use when the user asks to propagate headers, baggage, tracestate, the mirrord session key, or trace context across services or queues, or when a mirrord filter matches the first service but not downstream services or queue consumers.
The English summary is being prepared. Showing the original description.
Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain enum, GraphQL/Swagger/REST discovery, identity fabric (Entra/Okta/ADFS/Google/SAML/M365 deep — Teams/SharePoint/OneDrive), cloud bucket enum (S3/GCS/Azure), CDN/WAF bypass, origin discovery, vendor fingerprinting (Citrix/F5/Pulse/Fortinet/PaloAlto/Cisco/VMware), CI/CD exposure, 48-pattern secret-scan catalog (AWS/GCP/GitHub/Stripe/Slack/Anthropic/OpenAI/Atlassian/DataDog/npm/PyPI), Postman workspaces, breach correlation (HudsonRock/HIBP/DeHashed/IntelX), TLS/JA3 audit, certificate transparency, JS endpoint extraction, package registry leaks, mobile/APK recon, sat imagery, sector-specific recon (healthcare DICOM, finance SWIFT, ICS/SCADA Modbus/BACnet). Detail content in 15 modular reference files, loaded on demand. Use for any authorized recon: scoping, asset discovery, attack-path mapping, secret triage, severity scoring.
The English summary is being prepared. Showing the original description.
Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2 attacks via SSRF, K8s ServiceAccount token privilege analysis once held (token discovery / cluster exposure is owned by hunt-k8s), role-trust-policy confused-deputy, cross-account assume-role enumeration, IAM privilege escalation patterns (24+ AWS, 8+ Azure, 6+ GCP), and AWS Cognito Identity Pool unauthenticated-role attack chain (GetId → GetCredentialsForIdentity → IAM role abuse). Built for the case where recon yields a credential (key, JSON, token) and you need to know what it grants and how to escalate. Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain.
The English summary is being prepared. Showing the original description.
Evidence-capture and PoC-redaction discipline for bug-bounty submissions: cookie redaction protocol (which fields to mask, Preview annotation / Burp panel hiding / DevTools workflow), PII black-bar discipline (what to mask in other-user data — names, emails, phones, faces — vs what is safe to leave — usernames, trace IDs, request bodies), HAR file sanitization (jq filters for Cookie/Set-Cookie/Authorization headers), Burp Repeater/Intruder screenshot hygiene (hide request body, show only Results table for rate-limit attacks), Chrome DevTools Console PoC patterns (credentials include so cookies are not echoed, labeled console.log), screenshot capture order, filename conventions, post-submission rotation hygiene. Use BEFORE any PoC screenshot, BEFORE attaching a HAR, or whenever preparing evidence with session cookies or other-user PII. Pairs with bugcrowd-reporting and report-writing.
The English summary is being prepared. Showing the original description.
Add OpenTelemetry tracing to a new flow or hot path, frontend or backend. Use when building a user-facing flow, a cross-service call, a queue or background job, or code on a latency-sensitive path; when adding spans, span attributes, or trace propagation; or when a trace in Tempo/Datadog is missing, disconnected, or opaque.
The English summary is being prepared. Showing the original description.
Unified APM and monitoring surface. Polls Datadog, New Relic, and OpenTelemetry backends for active alerts, error traces, and entity health. Use --watch for live polling every 60 seconds. Use --setup to configure monitoring credentials.
The English summary is being prepared. Showing the original description.
Post-setup credential manager. Shows current integration status (configured/missing/expired) and lets you update individual credentials without re-running the full setup wizard. Runs a smoke test after each update.
The English summary is being prepared. Showing the original description.
Lightweight green/red status panel for every configured integration. No gather, no actions.
The English summary is being prepared. Showing the original description.