DevOps & Infra

planexeorg Skill

Use after the napkin_math pipeline has produced parameters/bounds/scenarios/montecarlo JSON to generate a plan assessment (assessment.md) — a thin interpretation layer over the intermediary artifacts. Emits a JSON manifest, a provenance map, gate verdicts (Critical / Fragile / Marginal / Robust), failure drivers, confidence and trust boundaries, scenario sanity check, and suggested next actions. The artifact is a navigation/judgment file, not a copy of the raw simulation data.

planexeorg Skill

Use when the user wants to run the napkin-math pipeline end-to-end on a PlanExe report, or resume a partially populated output directory by filling in only the missing stages. Orchestrates digest preparation, parameter extraction, validation, bounds, calculations, scenarios, Monte Carlo, and assessment rendering. Never copies artifacts forward from prior runs, and never re-runs a stage whose output is already on disk.

keeveeg Skill

Plan reproducible production of game spaces and environments from approved layouts and art direction, including reuse, assembly, and future pipeline validation.

projetvs-pdi Bundle

Use esta skill sempre que o usuário pedir para criar/rotacionar/revogar/listar tokens de API do Cloudflare, adicionar um domínio/zona novo, gerenciar registros DNS, publicar um site no Cloudflare Pages a partir de um repo GitHub/GitLab (criar projeto, configurar build, conectar domínio), ou aplicar as recomendações padrão do Cloudflare (SPF/DMARC) após uma zona propagar — tudo via API REST do Cloudflare, sem clicar no painel. Dispare para "token do Cloudflare", "escopar token pra uma zona", "CNAME/A/TXT", "site novo no Cloudflare", "publicar esse repositório no Pages", "buildar e implantar esse projeto", "credencial pra pipeline de deploy", "a zona já propagou, aplica as recomendações", "conecta esse domínio ao Pages", "SPF/DMARC pra não ter e-mail spoofado", ou automatizar algo antes feito manualmente no painel. Prefira sempre esta skill a orientar cliques no painel quando o usuário está no Claude Code (com shell).

chambear2809 Bundle

Use when configuring Galileo MCP, registering Galileo with IDE/agent clients, inventorying live MCP tools, or auditing Galileo MCP product coverage. Covers Galileo API-key secret handling, self-hosted URL derivation, live MCP tool inventory and drift checks, write/generation tool gating, MCP tool-call observability handoffs, and explicit boundaries between Galileo MCP IDE workflows and broader Galileo platform, Agent Control, Splunk HEC/OTLP, dashboard, and detector automation. Render, validate, probe, and document safe client setup for the official Galileo MCP Server (`https://api.galileo.ai/mcp/http/mcp`) across Cursor, VS Code, Codex, Claude Code, and AWS Kiro.

chambear2809 Bundle

Use when the user asks for reusable HEC token management, inputs.conf rendering, ACS HEC tokens, allowed index restrictions, indexer acknowledgement, HEC port/TLS settings, or a shared ingestion endpoint for apps and external collectors. Render, preflight, apply, and validate Splunk HTTP Event Collector service configuration for Splunk Enterprise and Splunk Cloud.

chambear2809 Bundle

Use when the user asks to install, configure, prepare, or validate the InfoSec app. Render, install, and validate InfoSec App for Splunk readiness, including package delivery, prerequisite security data-source checklist, dashboard and macro checks, CIM/data-model prerequisites, Cloud IDM support-request notes, Lookup Editor dependency, and validation SPL.

chambear2809 Bundle

Use when the user needs SPL2 pipeline authoring, conversion review, compatibility linting, or shared templates for Ingest Processor or Edge Processor workflows, including Cisco Data Fabric or telemetry pipeline management requests that need reusable SPL2 pipeline logic. Render and lint reusable SPL2 pipeline templates for Cisco Data Fabric, Splunk Ingest Processor, and Edge Processor, including routing, redaction, sampling, lookups, metrics, OCSF, decrypt, stats, custom templates, SPL-to-SPL2 compatibility, and PCRE2 migration checks.

jcaraballo113 Bundle

Diagnose and reclaim space in a WSL 2 distro — both inside Linux and the virtual disk file it lives in on the Windows drive, which grows with every write and never shrinks by itself. Use when the user says "WSL is full", "my distro is out of space", "ext4.vhdx is huge", "Docker Desktop's disk is huge", or freed space inside WSL and the Windows drive did not get it back. For the rest of the Windows drive, use `clean-windows-hdd`.

jcaraballo113 Bundle

Diagnose what fills a Mac's disk, attribute every large folder to the tool that wrote it, and reclaim the regenerable and leaked space with the user's go-ahead. Use when the user says "my Mac is full", "disk is almost full", "what is taking up space", "free up space", or suspects a tool (Claude, Docker, node) is filling the drive.

projetvs-pdi Skill

Atualiza um site estático já publicado em CloudFlare Pages, puxando a versão mais recente de um repositório Git (GitHub ou GitLab) ou de uma pasta local e republicando. Use esta skill sempre que o usuário pedir para "atualizar o site", "publicar a nova versão", "fazer deploy", "subir as mudanças do GitHub/GitLab para o CloudFlare", "colocar a versão nova no ar" ou similar — mesmo sem citar CloudFlare Pages explicitamente, desde que o site já esteja publicado nele. Não use esta skill para a configuração inicial de domínio/DNS/zona (isso é a skill publicacao-dominio-cloudflare) — esta aqui é só para republicar conteúdo em um site que já existe.

chambear2809 Bundle

Use when the outcome is ITSI product/package installation, upgrade, license readiness, restart, core-app health, or installation validation; route post-install entities, services, KPIs, dependencies, Event Analytics configuration, and content-pack import to splunk-itsi-config. Install and validate Splunk IT Service Intelligence (ITSI) on Splunk Cloud or Splunk Enterprise.

chambear2809 Bundle

Use when the user asks to install Splunk SOAR On-prem, build a SOAR cluster, onboard SOAR Cloud, install Automation Broker, install splunk-side SOAR apps, or wire up SOAR with Splunk Enterprise Security. Render, preflight, apply, and validate the full Splunk SOAR lifecycle: Splunk SOAR (On-prem) unprivileged single-instance install, On-prem cluster install with external services (PostgreSQL local or AWS RDS, GlusterFS, Elasticsearch, HAProxy), SOAR Cloud onboarding helper (JWT capture, IP allowlist, REST automation user provisioning), Splunk SOAR Automation Broker on Docker or Podman with FIPS detection, Splunk-side apps (Splunk App for SOAR Splunkbase 6361, Splunk App for SOAR Export Splunkbase 3411), and ES integration readiness with a fail-closed Mission Control UI handoff.

chambear2809 Bundle

Use when the user asks to prepare Cisco Cloud Control, AgenticOps, AI Canvas, Cloud Control Studio, Cloud Control Workflows, or governed Cisco/Splunk agent execution workflows. Render, validate, doctor, and optionally execute delegated setup plans for Cisco Cloud Control adoption, AI Canvas readiness, Cloud Control Studio handoffs, official Cloud Control feature coverage, Cisco Workflows API readiness, delegated Cisco Data Fabric architecture coverage, MCP connectors, Splunk AI Agent Monitoring, Observability content, and Cisco domain readiness.

chambear2809 Bundle

Use when the user asks about splunk-ai-assistant, Splunk AI Assistant, Splunk AI Assistant for SPL, AI Assistant for SPL, or the `Splunk_AI_Assistant_Cloud` app. Install, validate, and help complete Splunk AI Assistant (`Splunk_AI_Assistant_Cloud`) setup on Splunk Cloud or Splunk Enterprise. Handles Splunkbase installation with the shared app installer, checks post-install health, and supports Enterprise cloud-connected onboarding, activation, and proxy configuration.

chambear2809 Bundle

Use when the user asks to archive expired Splunk Cloud index data to the Splunk-managed archive, set or change DDAA archival retention, restore archived data, or move an index onto Splunk Archive. Not for DDSS self-storage or generic index administration, which live in splunk-cloud-acs-admin-setup. Render, validate, and apply Splunk Cloud Platform Dynamic Data Active Archive (DDAA): per-index archival retention via the ACS index splunkArchivalRetentionDays setting, retention math validation, and restore and disable runbooks for the Splunk Web-only operations.

chambear2809 Bundle

Use when the user asks to install a Splunk app, TA, add-on, download from Splunkbase, deploy an app package, or manage installed apps. Install, update, and manage Splunk apps and add-ons (TAs). Supports installing locally from .tgz/.spl files, remotely from a URL, or from Splunkbase. Can also list installed apps and uninstall apps.

chambear2809 Bundle

Use when the user asks to set up Splunk for a Cisco product such as ACI, Nexus 9000, Duo, Meraki, ThousandEyes, ASA, or FTD, including choosing the dedicated ASA syslog TA versus Cisco Security Cloud API or eStreamer collection. Resolve a Cisco product name from the SCAN catalog and route installation, configuration, and validation through the correct existing setup skill.

chambear2809 Bundle

Use when the user asks for a Splunk admin doctor, health audit, full feature coverage check, production- safe remediation plan, Cloud/Enterprise admin troubleshooting, or routing to existing Splunk admin skills. Diagnose Splunk Cloud Platform and Splunk Enterprise administration health, render full-coverage doctor reports, and create selected safe fix packets.

chambear2809 Bundle

Use when the user asks about Splunk_TA_aws, the Splunk Add-on for AWS, CloudTrail, AWS Config, or GuardDuty log ingestion, SQS-based S3 inputs, or a manual AWS TA configuration alternative to Data Manager. Install, render, configure, and validate the Splunk Add-on for AWS (Splunk_TA_aws, Splunkbase 1876) as the manual TA path that complements splunk-cloud-data-manager-setup. Renders real inputs.conf stanzas for CloudTrail and GuardDuty via the SQS-based S3 input and AWS Config via the aws_config input, emits an IAM-role or access-key account-setup runbook, creates the aws index, maps source types to CIM, and validates ingestion.

chambear2809 Bundle

Use when configuring Cisco Security Cloud API inputs, product flows, indexes, or dashboards in Splunk.

chambear2809 Bundle

Use when the user asks to govern runtime agent behavior with Agent Control and wire control events to Splunk Platform or Splunk Observability Cloud. Render, validate, and optionally apply Agent Control setup assets covering Docker or external server readiness, file-backed auth templates, policy controls, Python @control() snippets, TypeScript runtime snippets, OpenTelemetry and custom Splunk HEC event sinks, Splunk HEC and OTel Collector handoffs, and Splunk Observability dashboards/detectors.

chambear2809 Bundle

Inspect, render, connected-preflight, and observe a pinned Galileo On-Prem galileo-stack deployment on Kubernetes; produce secret-safe evidence and Galileo/CSE joint-session handoffs for every install, upgrade, rollback, uninstall, CRD, galileoctl, GPU, air-gap, and lab-bootstrap change. Use when planning reusable Galileo On-Prem Kubernetes deployment work without unattended mutation.

chambear2809 Bundle

Use when the user asks about Splunk_TA_google-cloudplatform, the Splunk Add-on for Google Cloud Platform, GCP audit logs, Cloud Logging, Pub/Sub ingestion, or GCP log onboarding in Splunk. Install, render, configure, and validate the Splunk Add-on for Google Cloud Platform (Splunk_TA_google- cloudplatform, Splunkbase 3088). Centers on the high-value Cloud Logging to Pub/Sub ingestion path, rendering the real google_cloud_pubsub input (google:gcp:pubsub:message plus auto-classified audit subtypes), a service-account credential runbook, the gcp index, and ingestion validation; documents the monitor, billing, bucket, and resource-metadata inputs.

chambear2809 Bundle

Use when the user asks about Splunk_TA_okta_identity_cloud, the Splunk Add-on for Okta Identity Cloud, Okta System Log, OktaIM2, Okta Universal Directory, or Okta authentication onboarding in Splunk. Install, render, configure, and validate the Splunk Add-on for Okta Identity Cloud (Splunk_TA_okta_identity_cloud, Splunkbase 6553). Renders real inputs.conf stanzas for the okta_identity_cloud modular input across the log, user, group, app, groupUser, and appUser metrics (OktaIM2:* source types), emits an OAuth 2.0 client-credentials or API-token account runbook, creates the okta index, maps source types to CIM, and validates ingestion.

chambear2809 Bundle

Use when installing Edge Processor, managing EP pipelines, routing forwarders, or handling Cisco Data Fabric / telemetry pipeline management requests that need Splunk Platform edge routing and transformation. Render Cisco Data Fabric edge-routing workflows and the full Splunk Edge Processor lifecycle for Splunk Cloud Platform tenants and Splunk Enterprise 10.0+ data management control planes. Covers EP objects, TLS / mTLS, Linux or Docker instances, multi-instance scale-out, source types, destinations, SPL2 pipelines with splunk-spl2-pipeline-kit linting, apply handoffs, default destination guardrails, ACS allowlist stubs, and AI-powered data management readiness handoffs.

chambear2809 Bundle

Use when the user asks to set up Ingest Actions, evaluate or mask data at ingest, drop noisy events before indexing, or stage an RFS S3 destination for a route handoff. Not for Ingest Processor or Edge Processor pipelines. Render, validate, and apply eval, mask, and drop rules as props.conf RULESET and transforms.conf INGEST_EVAL through target-app REST endpoints on Splunk Enterprise or a customer-managed heavy forwarder. For route-s3, apply stages only outputs.conf [rfs:] and exits 2 with an explicit Splunk Web or supported rulesets-API handoff for the route rule. Splunk Cloud is render/handoff-only.

chambear2809 Bundle

Use when the user asks to onboard, configure, render, or validate RSA SecurID data in Splunk. Umbrella render, install, and validation workflow for RSA SecurID Splunk add-ons: RSA SecurID Authentication Manager syslog parsing (Splunk_TA_rsa-securid, Splunkbase 2958) and RSA SecurID Cloud Authentication Service API collection (Splunk_TA_rsa_securid_cas, Splunkbase 5210). Renders CAS inputs, AM syslog handoffs, encrypted account setup, metadata, and validation SPL.

chambear2809 Bundle

Use when the user asks about Splunk Secure Gateway, Connected Experiences, Spacebridge, Private Spacebridge, or mobile distribution. Apply only splunk_secure_gateway app enable/disable on an explicit Splunk Enterprise target. Render an Enterprise egress check, endpoint and instance-ID placeholder skeletons, and Splunk Web/MDM/device-registration operator runbooks; configure has no live API. Splunk Cloud permits plain render/support handoff only, with no local probe, session authentication, or live REST.

chambear2809 Bundle

Use when the user asks to investigate, install, upgrade, configure, validate, troubleshoot, or roll back Splunk Stream Forwarder on a Windows host. Provides action-capable local PowerShell, Windows OpenSSH, WinRM, and AWS Systems Manager paths; enforces a drift-bound investigation and plan before installing the Windows x64 Splunk_TA_stream payload and bundled Npcap driver.

chambear2809 Bundle

Use when installing or validating Cilium, Tetragon, Hubble, or Isovalent platform workflows on Kubernetes. Install and operate Cisco Isovalent on Kubernetes: Cilium, Tetragon, Enterprise add-ons, and gated private Isovalent product packs. Renders OSS or Enterprise Helm assets, distribution and CNI- conflict preflights, feature coverage, apply plans, doctor reports, live validation, and day-2 discover/backup/upgrade/rollback/uninstall runbooks. NOT a Splunk TA skill; Splunk telemetry wiring is delegated to splunk-observability-isovalent-integration.

chambear2809 Bundle

Use when validating Cisco Talos reputation enrichment and service-account readiness in Splunk ES Cloud.

chambear2809 Bundle

Use when the user asks to bootstrap a deployment server, tune Universal Forwarder phoneHome intervals, inspect enrolled clients, set up DS high availability, migrate clients to a new DS, scale to 5000+ forwarders, or diagnose DS runtime health. Hand off serverclass.conf and deploymentclient.conf authoring to splunk-agent-management-setup. Render, preflight, bootstrap, validate, and operate the Splunk Enterprise Deployment Server runtime: enable-deploy-server bootstrap, deployment-app layout checks, phoneHome tuning, REST inspection, large-fleet HA pairing, client re-enrollment, staged rollout, Splunk 9.4.3+ filterType handling, and failure-mode runbooks for 503 floods, app drift, and unenrolled clients.

chambear2809 Bundle

Use when the user asks to create, validate, or operationalize Splunk Observability SLOs. Render and validate focused Splunk Observability Cloud service-level objective setup plans, including SLI source selection, objective/target placeholders, SLO API payload intent, /slo/validate handoffs, deeplinks, detector follow-up, and deep-native-workflow delegated specs.

chambear2809 Bundle

Use when the user asks to set up Splunk Cloud Data Manager, onboard cloud data sources through Data Manager, validate Data Manager prerequisites, handle Data Manager CloudFormation or ARM or Terraform templates, diagnose Data Manager ingestion health, migrate Azure Event Hubs from MSCS, promote historical AWS S3 data, or onboard CrowdStrike FDR data. Render, doctor, apply supported cloud-side artifacts for, and validate Splunk Cloud Platform Data Manager onboarding across AWS, Azure, GCP, and CrowdStrike with Data Manager 1.16 source coverage, HEC ACK/token guardrails, Data Manager-generated CloudFormation/ARM/Terraform template handling, provider prerequisite checks, health searches, migration warnings, and secret-file-only handoffs.

chambear2809 Bundle

Use when configuring an already-running Galileo instance for Splunk Platform or Splunk Observability Cloud, including multimodal traces and multi-model experiment comparison evidence. Render, validate, and optionally apply Galileo application readiness, object lifecycle, Observe export/runtime, Evaluate, Luna, Controls, multimodal, and Splunk wiring for Galileo SaaS or Enterprise deployments. Covers projects, log streams, datasets, prompts, experiments, metrics, annotations, feedback, RBAC, provider handoffs, trace maintenance/metrics APIs, Luna Studio training, metadata-only media export, AI Assistant beta readiness, global dashboards, generic alert webhook relay, SDK experiment groups, large-dataset batching, Annotation Queues GA, AI-assisted custom metrics, cost/billing review, Trace Count alerts, multimodal out-of-the-box metric variants, and the Splunk Agent Observability documentation epoch, HEC/OTLP/OTel handoffs, dashboards, and detectors; delegate On-Prem Kubernetes deployment and packaged services.