DevOps & Infra

ftrout Bundle

Triage a security alert or suspicious event the way a tier-1/tier-2 SOC analyst does: decide whether it is a true positive, benign, or a false positive, scope it, assign a defensible severity tier, and write a triage note with evidence for and against, actions taken, and next steps. Use this whenever the user pastes an alert, a SIEM/EDR/IdP/email/cloud/DLP detection, a scanner finding, or a "user reported something weird" message and asks "is this bad", "what do I do with this", "how severe is this", "should I escalate", "write up this alert", or "triage this". Also use it when someone wants a consistent severity score, a benign-explanation checklist, or the questions to ask before escalating, even if they never say the word triage.

roboco-io Bundle

AWS Well-Architected Cost Optimization Pillar review. Checks resource sizing, scaling, storage classes, and cost monitoring configurations in IaC code.

ftrout Bundle

Design, write, test, tune, deploy, and review detection rules through their full lifecycle, with Sigma as the canonical rule format and conversion to Splunk SPL, Sentinel/Defender KQL, Elastic EQL/ES|QL, or Chronicle YARA-L. Use it whenever someone wants to "write a detection", "build a rule for", "alert on", "turn this report/hunt/purple-team gap into a detection", "review this Sigma rule", "why is this rule so noisy", "tune the false positives", "map this rule to ATT&CK", or pastes a Sigma/KQL/SPL rule and asks whether it is any good. Also use it when a threat report, an incident lesson, or a hunt result implies a detection that nobody has written yet, even if the user only asks "how would we catch this next time".

ftrout Bundle

Investigate suspected compromise in AWS, Azure, or GCP: find the right logs (CloudTrail, AzureActivity, Entra audit, GCP Cloud Audit Logs), reconstruct what an identity or access key did, spot the high-signal control-plane events (access key creation, role assumption chains, StopLogging, PutBucketPolicy, role assignments, Key Vault reads, setIamPolicy, service account key creation), size the blast radius, and contain safely (rotate, deny, SCP, revoke) while preserving evidence. Use it whenever someone mentions a leaked or exposed access key, a GuardDuty / Defender for Cloud / Security Command Center finding, an unexpected cloud bill, a public bucket, an unknown IAM user or role, "someone logged into the console", "who created this resource", or pastes CloudTrail, Activity Log, or audit log JSON, even if they do not say "incident". Also use it for post-hoc "what did this credential touch" reviews.

ftrout Bundle

Investigate a suspected account or identity compromise in Entra ID (Azure AD), Okta, Google Workspace, or on-prem Active Directory: analyze sign-in logs for impossible travel, new country or ASN, MFA fatigue, legacy auth, token replay and AiTM session hijack; check risky OAuth consent grants, MFA method changes, mailbox rules, and privilege changes; spot AD attack indicators (Kerberoasting, AS-REP roasting, DCSync, golden and silver tickets, NTDS theft); and contain in the right order (reset, revoke sessions, disable, remove consent, krbtgt double reset) without breaking the business. Use it whenever someone says a user "got phished", "clicked the link", "approved an MFA prompt they didn't request", reports a risky sign-in or Identity Protection / Okta ThreatInsight alert, asks "is this account compromised", pastes sign-in or Security event log exports, or mentions a suspicious inbox rule, unknown app consent, or new Global Admin, even if the word "identity" never appears.

hiyabh Skill

Hands-on Git workflows: resolve merge/rebase conflicts with a documented rationale, generate professional Conventional-Commit messages from the actual diff, and author complete CI/CD GitHub Actions pipelines. TRIGGER when the user says 'resolve the merge conflicts in this branch and explain what you kept from each side', 'commit these changes with a message that summarizes what I did', 'write a GitHub Actions workflow that runs tests, builds, and deploys to staging on push to develop', or similar. Hebrew: 'תפתור את הקונפליקטים', 'תסביר מה שמרת מכל צד', 'תעשה commit עם הודעה טובה', 'תכתוב workflow ל-GitHub Actions', 'CI/CD', 'pipeline של דיפלוי'. Follows the global Git Hygiene rules (atomic commits, conventional messages). NOT for routine `git status`/`git log` questions — just answer those directly.

hiyabh Bundle

Turn a PDF (or a flipbook viewer link like heyzine) into a polished static website that flips like a real book — page-curl animation, RTL by default (Hebrew), zoom, fullscreen, thumbnails, keyboard nav, PDF download — then deploy it to a shareable link on Vercel. Trigger phrases — "תבנה אתר לדפדף ב-PDF", "תהפוך את ה-PDF לספר", "אתר flipbook", "ספר דיגיטלי לדפדוף", "flipbook from this PDF", "make this PDF flippable", "turn this PDF into a book", "דפדוף כמו ספר", or when the user has a PDF / flipbook link and wants an interactive page-turning site. NOT for editing the PDF itself, NOT for video (use hyperframes).

hiyabh Skill

On-call / production incident triage: correlate logs + recent deploys + config changes into a most-likely-cause, read a console screenshot and give exact fix commands, or write+run a diagnostic query over metrics/logs and interpret it. TRIGGER when the user says 'API latency doubled in the last hour, check the logs, recent deploys, and config changes, then tell me the most likely cause', 'here is a screenshot of the AWS console, walk me through why the RDS instance is failing and give me the exact commands to fix it', 'show me all 5xx events for /payments over the last 24h, write the query, run it, and tell me what stands out', or reports an ongoing outage/latency spike/error surge. Hebrew: 'תקרית פרודקשן', 'ה-latency קפץ, תבדוק לוגים ודיפלויים', 'למה ה-RDS נופל', 'תכתוב שאילתת אבחון על הלוגים', 'טריאז׳ לתקרית'. For a single reproducible bug (not a live incident), use a root-cause debugging skill like debug instead, if you have one.

hiyabh Bundle

Build a private Hebrew Telegram Q&A bot powered by RAG (Cohere embed-v4 + rerank-v3.5 + Qdrant Cloud + Claude Sonnet 4.6) over a specific rabbi's writings (folder of DOC/DOCX/PDF). Every answer cites source book + chapter/section. Deploys to Railway. Trigger phrases: 'בנה בוט רב', 'בנה בוט טלגרם על הרב', 'תבנה לי בוט על כתבי X', 'rabbi bot', 'telegram bot for rabbi X', 'RAG bot over writings of', 'בנה לי מאגר וקטורי על ספרי', 'בוט שאלות-תשובות על כתבי'.

hiyabh Skill

Safety layer for working on production/live environments. TRIGGER when: user mentions 'production', 'live server', 'פרודקשן', 'שרת חי', 'שרת לייב', 'database migration', 'deploy to prod', 'customer data', 'real users', or when working with production connection strings, live API keys, or real databases. MUST trigger before any destructive operation on production systems.

stifleur390 Skill

Pest PHP — framework de test élégant pour PHP. Expectation API, datasets, hooks, architecture testing, mocking, snapshot testing, browser testing, mutation testing, CI/CD, plugins. Utiliser quand on écrit des tests PHP, on configure Pest, on veut améliorer la couverture, ou on debug un test.

mzvonar Skill

Create a new git worktree on a new branch (off the repo's default branch unless another base is stated) and switch to working inside it for the rest of the session. Use this skill whenever the user asks to "create a worktree", "new worktree", "spin up a worktree", "work from a fresh worktree/branch", "branch off main/master and work from it", or otherwise wants isolated work that must not touch the root checkout. Also covers what a fresh worktree is missing before tests, dev servers, or docker-compose stacks will run from it.

mzvonar Bundle

Run Prisma migrations and regenerate the Prisma client safely — preflight (env file, schema location, package manager), `migrate dev` / `migrate deploy` / `generate`, and the recovery procedures for the ways `migrate dev` refuses to run (drift, edited-after-apply checksum drift, shared dev DBs, raw-SQL objects Prisma cannot model, Prisma 7's agent reset guard). Use whenever the user asks to run or create a migration, apply schema changes, regenerate the Prisma client, "update the DB", "apply the schema", "run db:migrate", or when `prisma migrate dev` complains about drift, demands a reset, hangs on a prompt, or a new enum value / model is "undefined" at runtime after a migration.

stifleur390 Skill

Déploiement et infrastructure pour Laravel 13. Docker, CI/CD, Forge, Vapor, Coolify, Nginx. Utiliser quand on déploie une app, on configure Docker, on met en place le CI/CD, ou on configure le serveur.

provectus Bundle

This skill should be used when the user asks to "create an npx package", "build a CLI tool with TypeScript", "set up a Node.js CLI", "publish an npm package", "configure package.json bin field", "add CLI argument parsing", "create an executable npm package", or when writing TypeScript code for a command-line tool distributed via npx. Covers package structure, TypeScript configuration, argument parsing, build pipeline, and npm publishing.

provectus Skill

Use when GitHub Actions checks fail, workflow runs are red, or user asks to fix CI. Triggers on "fix CI", "actions failing", "checks are red", "pipeline broke", "workflow failed". User may provide a run URL, job ID, or just ask to fix.

provectus Bundle

Production patterns for building LangGraph StateGraph workflows deployed on AWS Bedrock AgentCore. Covers graph design, interrupt-based human-in-the-loop, multi-day checkpointing, 3-tier model routing with fallback chains, confidence calibration implementation, Cedar policy enforcement for agent authorization, cost-aware pipeline design, AgentCore Runtime deployment, Bedrock Foundation Models and Guardrails, MCP tool integration via AgentCore Gateway, and observability with LangSmith and CloudWatch. Use when building agentic AI workflows with LangGraph, deploying agents on AWS Bedrock AgentCore, or implementing interrupt-based HITL workflows.

808enzo Bundle

Build the regular report a lifecycle program gives the business, read change over time on cohorts rather than on the whole base, and report money so that credit and effect are not confused. Use when somebody asks for a CRM dashboard, when a number went up in the deck and nobody can say compared to what, when repeat purchase share improved in the month acquisition was cut, when the newest cohorts look worse than the old ones, when channel tools claim more orders than the business took, or when attributed revenue keeps rising and the holdout does not move. Covers a comparison base and a noise band for every line, counterweights, freeze dates and restatement notes, the cohort table by age, splitting a base-wide change into mix and within-cohort change, the attribution model and window per decision, and the register of vanity metrics. Not the metric definition, not test design, not pipeline monitoring, not paid acquisition analytics.

provectus Bundle

Use when working with Terraform or OpenTofu - creating modules, writing tests (native test framework, Terratest), setting up CI/CD pipelines, reviewing configurations, choosing between testing approaches, debugging state issues, implementing security scanning (trivy, checkov), or making infrastructure-as-code architecture decisions. Enforces Provectus opinionated conventions (exact version pinning, etc.) on top of community best practices.

provectus Bundle

AWS Lambda best practices for function design, configuration, and operations. Use when designing Lambda functions, choosing memory/timeout settings, planning concurrency and scaling, setting up monitoring, processing streams, or securing Lambda workloads. Triggers on tasks involving Lambda function creation, handler design, cold start optimization, idempotency, event source mapping, reserved/provisioned concurrency, or deciding whether Lambda is the right compute choice. Does not cover language-specific SDK patterns, CloudFormation/Terraform resource definitions, or Lambda@Edge.

provectus Bundle

AWS DynamoDB best practices for table design and data modeling. Use when designing DynamoDB schemas, choosing partition/sort keys, creating secondary indexes, modeling relationships, handling time series data, or optimizing query patterns. Triggers on tasks involving DynamoDB table creation, key design, GSI/LSI configuration, single-table design, adjacency lists, write sharding, or capacity planning. Does not cover DynamoDB SDK/API reference or CloudFormation/Terraform resource definitions.

provectus Bundle

This skill should be used when the user asks to "build a genomics pipeline", "call variants", "analyze RNA-seq", "run ChIP-seq analysis", "annotate variants", "QC sequencing data", "detect CNVs", or when writing any bioinformatics pipeline code involving NGS data. Provides expert guidance on pipeline frameworks (Nextflow, Snakemake, WDL), alignment, variant calling, and production-ready nf-core workflows.

drdustinedwards Bundle

Personal workflow rules for Dustin's dev environment. Triggers on session start, env var work, deploy verification, Capsid task files, user-facing copy, and architectural decisions. Applies to every project in the portfolio.

qf-studio Bundle

Validate and release Navigator plugin to marketplace. Auto-invoke when user says "release plugin", "publish navigator", "create release", or "deploy new version".

understudylabs Bundle

Use when a developer wants to run a hosted job — a fine-tune, an RL (reinforcement-learning) run, batch inference, or large-scale trajectory generation — and asks where, how long, and how much. "What would it cost to fine-tune this", "which provider should I use for this RL run", "is this cheaper locally or in the cloud". Estimates and routes; never spends.

g-tavares14 Skill

Prepares production launches. Use when the user runs /agent-skills:ship. Use when preparing to deploy to production, or when asking what needs to be in place before shipping. Use when you need a pre-launch checklist, when setting up monitoring, when planning a staged rollout, or when you need a rollback strategy.

g-tavares14 Skill

Automates CI/CD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.

understudylabs Bundle

Use to acquire, cache, organize, and explain local open-weight models — "download a model", "what models do I have", "where did the weights go", "free up model disk", "which Gemma/Nemotron should I pull", "how do open models work". Covers where weights come from and live, formats/quantization, gated weights and HF tokens, disk budgeting, start-small-and-cache, and the local→cloud graduation path. American families (Gemma 4, Nemotron 3). To score a local model on a workload, use run-local-model-lab.

understudylabs Bundle

Use when a developer asks a coding agent to improve an LLM app or agent — "make my LLM app cheaper/faster", "raise quality or reliability", "compare models", "pick a model or route". Orchestrates trace → evaluate → optimize (GEPA, automatic prompt evolution) → compare → deploy via worker skills. Not for generic coding unless LLM behavior, cost, traces, evals, or routing is involved.

insightfulanalytics Bundle

CLI syntax reference for Tabular Editor 2 (TabularEditor.exe); deployment, scripting, BPA analysis, and CI/CD integration. Automatically invoke when the user mentions "TabularEditor.exe", TE2 CLI flags (-D, -S, -A, -B, -TMDL, -O, -C), or asks to "deploy a model via CLI", "set up CI/CD for Power BI", "automate model deployment", "run BPA from command line", "save model as TMDL".

insightfulanalytics Skill

End-to-end pipeline for a Power BI Workout Wednesday challenge — from a pasted challenge link to a built PBIP report, visually verified against the original and published to a Fabric workspace. Use when the user pastes a workout-wednesday.com challenge link, says "this week's Workout Wednesday", "WW week N", or asks to build or publish a WW challenge solution.

insightfulanalytics Skill

The end-to-end pipeline for changing a semantic model in a local PBIP — confirm the field exists, author, land it in TMDL, validate offline, then prove it against real data. Invoke on "change the model", "add a measure", "add a column", "fix the model", "the number is wrong", "this measure is wrong", "add a relationship", "set up RLS", "add a calculation group", "add a date table", "rename a field", "the model won't open", or any request that ends with a .tmdl file changing. Sequences connect-pbid, power-query, date-table, semantic-model, dax-standard, tmdl, dax-optimisation and refresh-semantic-model, and carries the Desktop-breaking gotchas that a single-skill route misses.

insightfulanalytics Bundle

Expert guidance for the cross-platform Tabular Editor CLI (the `te` binary, currently in preview) that manages Power BI / Analysis Services semantic models from the terminal on macOS, Linux, and Windows. Use when the user mentions the `te` CLI or "Tabular Editor CLI" (not the "2"), or runs a `te <command>` to scaffold, inspect, edit, validate, run BPA on, query, deploy, refresh, test, or migrate a semantic model. Not for the legacy Windows-only `TabularEditor.exe` (TE2).

ailessonio Bundle

Hugging Face Hub CLI (`hf`) for downloading, uploading, and managing models, datasets, spaces, buckets, repos, papers, jobs, and more on the Hugging Face Hub. Use when: handling authentication; managing local cache; managing Hugging Face Buckets; running or scheduling jobs on Hugging Face infrastructure; managing Hugging Face repos; discussions and pull requests; browsing models, datasets and spaces; reading, searching, or browsing academic papers; managing collections; querying datasets; configuring spaces; setting up webhooks; or deploying and managing HF Inference Endpoints. Make sure to use this skill whenever the user mentions 'hf', 'huggingface', 'Hugging Face', 'huggingface-cli', or 'hugging face cli', or wants to do anything related to the Hugging Face ecosystem and to AI and ML in general. Also use for cloud storage needs like training checkpoints, data pipelines, or agent traces. Use even if the user doesn't explicitly ask for a CLI command. Replaces the deprecated `huggingface-cli`.

l3rowniecakez Skill

Investigate and answer questions using the SIT Google Cloud Console logs for the claim-folder-worker-sit Cloud Run Job (the actual per-date claim-data-extraction processing worker on SIT). Use when user says '/log-cde-job-sit', asks about a processing date ('วันที่ประมวลผล'), or needs job-level detail (per-date success/fail counts, extraction errors, upload results) for claim-folder-worker-sit.

l3rowniecakez Skill

Investigate and answer questions using the PRODUCTION Google Cloud Console logs for the claim-folder-worker Cloud Run Job (the actual per-date claim-data-extraction processing worker). Use when user says '/log-cde-job-prod', asks about a processing date ('วันที่ประมวลผล'), or needs job-level detail (per-date success/fail counts, extraction errors, upload results) for claim-folder-worker in prod.