Results for “build”

Designs and documents structured incident response playbooks aligned with NIST SP 800-61r3 and SANS PICERL frameworks, covering playbook structure, decision trees, escalation criteria, RACI matrices, and SOAR integration.

Drive an entire repository to a fully green baseline — typecheck, lint, tests, and build all passing from a clean checkout — when the user has explicitly authorized fixing. Use when "make the repo green", "get CI passing", "fix all the failing tests". Ratchet integrity → audit-gate-logic.

Conduct internal audits against ISO/IEC 42001:2023 by identifying AIMS gaps, building an AI risk register with Annex A control mappings, and generating a 12-month Clause 9.2 audit plan.

Establishes recurring vulnerability scanning workflows using Nessus, Qualys, or OpenVAS, prioritizes findings with risk scoring and CISA KEV data, integrates with SIEM for exploitation detection, and tracks remediation via SLA-based dashboards and automated ticketing.

Builds repeatable API security test suites in Postman covering OWASP API Security Top 10 vulnerabilities, with automated authentication, multi-role testing, and CI/CD integration via Newman.

Build a comprehensive catalog of API endpoints including documented, undocumented, shadow, zombie, and deprecated APIs using passive traffic analysis, active scanning, DNS enumeration, JavaScript analysis, and cloud resource inventory.

Reverse-engineers EDR, Defender, and AV hook tables, ETW providers, and AMSI implementations to build targeted bypasses including unhooking, indirect syscalls, ETW patching, and call stack spoofing for authorized red team operations.

Use to design or audit complaint identification and classification in customer support, especially in regulated sectors. Trigger for "are we identifying complaints correctly", "complaint detection", regulatory complaint definition, FCA or CFPB complaint handling, vulnerable customer identification, root cause categorisation for complaints, or building an AI classifier for complaints.

Build and run a third-party/vendor risk management program aligned to NIST SP 800-161 and NIST CSF 2.0: inventory, tier, assess, contract, monitor, and offboard vendors.

Analyse and shrink JavaScript bundle size for any web app. Use when asked to "reduce bundle size", "analyse bundle", "tree shaking", "lazy loading", "code splitting", "slow initial load", "large JS", "chunk size", "build performance", "LCP caused by JS", "why is the bundle so big", or "first load JS too large".

Deploy AWS Security Hub as a centralized cloud security posture management platform, aggregate findings from GuardDuty, Inspector, Macie, and third-party tools, enable security standards, configure automated remediation, and build compliance dashboards across multi-account AWS organizations.

Provides a structured framework for analyzing cyber intrusions by examining four core features: Adversary, Capability, Infrastructure, and Victim. Covers implementing the Diamond Model programmatically to classify and correlate intrusion events, build activity threads, and generate pivot-ready intelligence.

You are an expert in Hapi.js, the configuration-centric enterprise framework for Node.js. You help developers build production APIs with built-in input validation (Joi), authentication strategies, plugin architecture, caching, rate limiting, and comprehensive request lifecycle hooks — designed for teams that need structure, security, and testability without third-party middleware sprawl.

Wire Promptfoo and DeepTeam into CI/CD for automated regression red-teaming of LLM apps against OWASP LLM Top 10 and OWASP Agentic presets, failing the build when jailbreak or injection vulnerabilities regress.

Investigates insider threat incidents involving employees, contractors, or trusted partners who misuse authorized access to steal data, sabotage systems, or violate security policies. Combines digital forensics, user behavior analytics, and HR/legal coordination to build an evidence-based case.

Build an append-only log integrity chain using SHA-256 hash chaining for tamper detection. Each log entry is hashed with the previous entry's hash to create a blockchain-like structure where modifying any entry invalidates all subsequent hashes.

Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API, building dependency graphs, calculating risk scores, and generating compliance reports.

Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "codeql analysis", "build codeql database", or "find vulnerabilities with codeql". Supports "run all" (security-and-quality suite) and "important only" (high-precision security findings) scan modes. Also handles creating data extension models and processing CodeQL SARIF output.

Audit a directory of multilingual blog content for completeness, consistency, hreflang correctness, meta-tag parity, and freshness. Builds a translation coverage matrix, flags stale translations, validates hreflang and schema, and emits a prioritized report with runnable fix commands. Use when user says "locale audit", "blog locale-audit", "check translations", "multilingual audit", "translation check", "hreflang check", "Uebersetzungen pruefen".

Designs and implements backend systems including REST APIs, microservices, database architectures, authentication flows, and security hardening. Use when the user asks to "design REST APIs", "optimize database queries", "implement authentication", "build microservices", "review backend code", "set up GraphQL", "handle database migrations", or "load test APIs". Covers Node.js/Express/Fastify development, PostgreSQL optimization, API security, and backend architecture patterns.

Use to design or audit the support contribution to a customer health score, so the score predicts something instead of averaging weakly-related signals into a colour. Trigger for "build a customer health score", "add support signal to health scoring", "our health scores don't predict churn", red/amber/green account scoring, or a health score nobody trusts.

Design the architecture for a multi-command skill system — the shared state schema, the command map, the router, and the boundary each command stops at — before any skill files get written. Use when the user wants to turn one skill into a system, combine several related or overlapping skills into a single coherent one, build a skill with subcommands (like `/thing audit`, `/thing polish`), design a suite, family, or collection of skills, or asks "how should I structure this skill set". Also trigger on "skill system", "skill architecture", "multi-command skill", "system of skills", "make these skills work together", "skill with slash commands", or complaints that their skills overlap, collide, duplicate each other, or never fire. Produces an architecture spec only — it never writes SKILL.md or reference files. Hand the finished spec to skill-creator to build from.

Reverse-engineers a federal RFP we received — given the SOW/PWS and evaluation criteria already in the Theseus KG, reconstructs the CO's hidden decision tree (upstream `sow-pws-builder` 6 scope blocks + 3 intake answers), surfaces hot buttons, ghost language, discriminator hooks, missing-section signals, and CPFF-form / Section-5 / QASP / Key-Personnel traps. USE WHEN the user asks "what scope decisions did the CO already make?", "reverse engineer this RFP", "what hot buttons are hiding in this PWS?", "where are the discriminator hooks?", "did they pick CPFF completion or term form?", "anything suspiciously missing?", or any variant of decoding CO intent. Pulls `requirement`, `deliverable`, `proposal_instruction`, `evaluation_factor`, `clause`, `performance_standard` from the active workspace KG and emits a JSON envelope feeding `proposal-generator`. DO NOT USE FOR proposal prose (`proposal-generator`), pricing (`price-to-win`), clause audit (`compliance-auditor`), or sub SOW (`subcontractor-sow-builder`).

Systematic methodology for auditing the Hermes Skills Hub (and external sources) to identify gaps, overlaps, redundancies, and conflicts when building a skill library for any project. Covers browsing, targeted searching, cross-referencing with web/GitHub, comparing candidates against existing inventory, verifying install safety, and planning installation order. Use when starting a new project and assembling tools, or when evaluating whether to add external skills beyond what's currently installed.

Personal finance review skill for individuals who want to understand their spending, budgets, and financial patterns. Use whenever the user wants to analyze expenses, categorize spending, review a budget, build a budget from scratch, analyze debt, audit subscriptions, understand their savings rate, or track progress toward a financial goal. Triggers: "help me review my spending", "here are my expenses", "can you look at my budget", "help me build a budget", "I want to understand where my money goes", "categorize these transactions", "help me pay off my debt", "audit my subscriptions", "am I saving enough", "am I on track for my goal", "analyze my finances", or any time the user shares financial data (even raw or messy) and wants insight. Does NOT provide investment, tax, or financial planning advice — helps users understand their own data. Trigger proactively when the user pastes transactions, expenses, or any money-related data, even without an explicit request for analysis.

Reviews animation and motion code against a high craft bar derived from Emil Kowalski's design engineering philosophy (see `emil-design-eng`). Default to flagging; approval is earned. Use when reviewing a diff for motion quality — not for writing features, fixing unrelated bugs, or general (non-motion) code review. For building an animation from scratch, use `animate`; for a whole-codebase audit, use `improve-animations`. Source: github.com/emilkowalski/skills.

Systematic API design methodology with 6 validated patterns covering parameter categorization, safe refactoring, audit-first approach, automated validation, quality gates, and example-driven documentation. Use when designing new APIs, improving API consistency, implementing breaking change policies, or building API quality enforcement. Provides deterministic decision trees (5-tier parameter system), validation tool architecture, pre-commit hook patterns. Validated with 82.5% cross-domain transferability, 37.5% efficiency gains through audit-first refactoring.

Write code through a disciplined, BDD-framed Test-Driven Development loop: build a behavior test list, then drive each behavior through red-green-refactor with an enforced observed-failure gate. Use when the user wants to implement, build, or write code test-first, "do TDD", follow "red-green-refactor", drive code from tests, choose the next test by the Transformation Priority Premise (TPP) or ZOMBIES ordering, or grow a feature behavior-by-behavior with tests leading. This skill writes and changes code; it does not produce a test plan document (use automated-test-planning, or manual-test-planning for a plan a person runs by hand), review or audit existing code (use code-review), restructure existing code outside a TDD loop (use refactor), specify what a feature should do (use plan-a-feature), or find the root cause of a bug (use investigate). Runs its loop to completion without pausing for review; to review each behavior as it lands, use pairing.

Unified multi-platform paid media audit with parallel execution. Spawns scored audits for Google Ads, Meta Ads, and Microsoft Ads simultaneously, merges results into a budget-weighted aggregate health score (A-F), adds cross-platform analysis (budget allocation, tracking consistency, creative alignment, attribution overlap), and produces a prioritized action plan. Optionally generates a client-ready deck via pro-deck-builder. Use when the user asks for a full paid media audit, cross-platform review, or multi-channel ad assessment.

Run a comprehensive code review on local source files. Use this skill when the user asks to review, audit, inspect, evaluate, or check code, even if they never use the word "review." Does not post comments to GitHub pull requests — use post-code-review-to-pr for that. Does not analyze architectural structure or module boundaries — use architectural-analysis for that. Does not explain code or a PR to build understanding before reviewing — use code-overview for a written overview, or code-walkthrough to be paced through it one step at a time. Does not capture feedback on Han's own skills — use han-feedback for that.

Expert HIPAA compliance assistant for healthcare and software contexts. Use this skill whenever the user mentions HIPAA, PHI (Protected Health Information), ePHI, covered entities, business associates, healthcare data privacy, medical records, health information security, BAA (Business Associate Agreements), or any compliance review involving patient data. Also trigger for requests to draft privacy notices, HIPAA policies, consent forms, security risk assessments, or breach notification letters. Use for developers building healthcare software who need technical safeguard guidance (encryption, access controls, audit logs), compliance officers reviewing documents or procedures, and anyone asking "is this HIPAA compliant?" or "what does HIPAA require for X?". When in doubt about whether a healthcare or data privacy question falls under this skill — use it.

Mine a codebase or product for underexploited assets — capabilities, infrastructure, data, integrations, and workflows built for one narrow purpose that could produce far more value. Finds platform primitives hiding inside features, internal tooling that could serve customers, and data accumulated but never leveraged. Produces an evidence-gated report (max 5 opportunities, mandatory kill list, one forced answer) plus a wwbd_packet JSON. Use whenever the user says "WWBD", "what would Bezos do", "what are we sitting on", "what did we accidentally build", "what could this become", "find opportunities in this repo", "what are we underexploiting", "is there a product hiding in here", or wants to know if existing infrastructure has a bigger economic surface than it currently serves. Trigger on casual phrasings too ("anything valuable buried in this codebase?"). Analyzes what EXISTS — missing features go to gap-scan, broken code to code-audit, confusing flows to ux-audit, weak persuasion to conversion-audit.

Blog and web-content system for agency work — plan topics, interview the author for their real take, brief the angle, draft the article, plan images, verify claims, score drafts for quality and AI tells, revise, publish, and refresh aging posts. Shorthand "wltbo" also triggers it. Commands share a per-client memory of brand voice, the author's positions and stories, verified facts with expiry dates, and every published post. Use for blog posts, articles, long-form content, refreshes, keyword targeting, search intent, titles and H1s, meta descriptions, internal linking, cannibalization checks, E-E-A-T, and information gain. Also use when the complaint is "it doesn't sound like us", "it reads AI-written", "it's generic", "we already wrote this one", "the facts are made up", "there are no images", "it's too thin", or "nobody thought this through". Not for social posts, emails, internal comms, case studies (case-study-builder), site audits (website-audit), or content calendars (content-strategy).