Results for “vorfall”

Incident response mode — diagnose a production issue, write a postmortem, add follow-up tasks to TODO.md. Use when user says "/incident [description]".

Conduz investigação de incidentes com método: triagem, hipóteses, mitigação, RCA e postmortem, priorizando evidências e confirmação humana.

Run a pre-mortem — imagine the project has already failed one year from now and work backward to find the root causes before they happen. Load when the user asks for a pre-mortem, wants to imagine failure before committing, asks "what could go wrong before we start", "assume this fails — why", "risk analysis before launch", "what kills this project", "what could go wrong", or when deep-thinking diagnoses a pre-mortem frame. Based on Gary Klein's prospective hindsight method, which surfaces failure causes more effectively than forward risk analysis. Most useful right before a major commitment.

Mitigate a production incident or urgent regression first, then route to root-cause remediation and a postmortem.

OI-3 spike harness — heavy consumer skill, FORKED arm. Builds an incident post-mortem and sources the readability standard mid-workflow via a forked (context fork) guidance skill. Use only when explicitly invoked by the spike harness with a TRIAL_ID and data path.

Resolves legacy references to the vercel-react-expert capability by routing to the current runtime agent, plugin, or narrower skill.

Ship workflow: detect + merge base branch, run tests, review diff, bump VERSION, update CHANGELOG, commit, push, create PR. Use when asked to "ship", "deploy", "push to main", "create a PR", "merge and push", or "get it deployed". Proactively invoke this skill (do NOT push/PR directly) when the user says code is ready, asks about deploying, wants to push code up, or asks to create a PR. (gstack)

Verifies that tests for already-implemented behavior are meaningful by temporarily breaking the production code and confirming the test fails for the expected reason.

React and Next.js performance optimization patterns adapted from Vercel Engineering's React Best Practices (https://github.com/vercel-labs/agent-skills). Organizes 70+ rules across 8 priority categories — waterfalls, bundle size, server-side, client fetching, re-render, rendering, JS micro-perf, advanced. Use when writing, reviewing, or refactoring React/Next.js code for performance.

Maneja exibicao de documento ou coisa — contra a PARTE (CPC 396-400: pedido 397, resposta em 5 dias 398, recusa nao admitida 399, presuncao de veracidade se recusa ilegitima 400) ou contra TERCEIRO (CPC 401-404: citacao em 15 dias, audiencia especial 402, deposito/apreensao 403, escusas 404) — e a arguicao de FALSIDADE documental (CPC 430-433: suscitada na contestacao/replica/15 dias da juntada 430, motivos e meios 431, exame pericial 432, coisa julgada se questao principal 433; onus da prova 429). Use quando o operador disser exibicao de documento, obrigar a apresentar documento, incidente de falsidade, documento falso nos autos, parte esconde documento, exibicao de coisa.

Analyze RAM dumps with Volatility 3 to detect malware, process injection, network connections, and credential theft during incident response.

Optimizes React and Next.js performance with 70+ rules across 8 priority categories, covering waterfalls, bundle size, server-side, client fetching, re-renders, rendering, JS micro-perf, and advanced patterns. Use when writing, reviewing, or refactoring React/Next.js code.

Structured brainstorming for projects and features. Explores multiple options before implementation.

Identify, collect, and analyze ransomware attack artifacts to determine the variant, initial access vector, encryption scope, and recovery options.

Provides the shared STORM methodology, artifact layout, stage-gating contract, citation hygiene, and retrieval fallback. Use when executing any /storm:* skill (generate, research, outline, write, polish). Internal knowledge; never user-invocable.

Urgent issue classification, root cause analysis, and fast-path routing for production hotfixes

proptest — property-based testing for Rust (Hypothesis-style). Generates thousands of random inputs to find counterexamples to invariants, with shrinking to minimal failing case. Critical for crypto, parsers, state machines, and finance code where edge cases matter. Includes strategies (gen functions), regression tracking, and integration with cargo test. Alternative: quickcheck (simpler API, less powerful). USE WHEN: user mentions "proptest", "property-based test", "proptest!", "Strategy", "Arbitrary", "shrink", "quickcheck", "regression file", "fuzz-light", "proptest-derive" DO NOT USE FOR: Generic Rust unit tests - use `testing/rust-testing` DO NOT USE FOR: Fuzzing with mutator (cargo-fuzz, AFL) - use bitcoin/testing/fuzz DO NOT USE FOR: KMP property testing - use `testing/kotest` (has built-in property)

Provides detailed guidance on Hermes Kanban worker lifecycle, including workspace handling, handoff patterns, retry diagnostics, and edge cases for dispatched workers.

Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.

Runbook skill for failures: cron error, PA failure, cascade, gateway disconnect, semantic DB stale. Walks: detect → classify → diagnose → notify → log. Replaces ad-hoc failure handling. Triggers: "cron failed", "X is broken", "cascade", "incident", "gateway down", "PA failure".

Analyzes prompt injection, retrieval poisoning, memory contamination, planner drift, and tool-boundary abuse in agentic systems, mapping trust boundaries and proving exploit chains.

Analyze Windows memory dumps for signs of compromise using the Rekall memory forensics framework, including process injection, hidden processes, and rootkit detection.

Advanced Tauri event patterns for bidirectional communication, streaming data, window-to-window messaging, and custom event handling

Guides systematic root-cause investigation before proposing fixes for any technical issue, with a four-phase process and red flags to avoid guessing.

Composite skill — emergency bypass of the release branch when production is broken and waiting for the next release-cut is not viable. Chains incident scoping → branch from main (NOT release) → minimal fix → pr-merge-readiness → merge to main → patch-version tag → deploy → cherry-pick to release branch → post-deploy verify (sentry + ci-watch). Use ONLY for production-impacting breakage; routine "small fix" work belongs in /pr-to-release.

Analyzes network traffic captures and flow data to identify adversary activity during security incidents, including command-and-control communications, lateral movement, data exfiltration, and exploitation attempts.

Generate one high-value follow-up workflow proposal when MoonMind execution quality issues are detected in a run.

Ship workflow: detect + merge base branch, run tests, review diff, bump VERSION, update CHANGELOG, commit, push, create PR. (gstack)

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes

Pitfalls, examples, and edge cases for Hermes Kanban workers. The lifecycle itself is auto-injected into every worker's system prompt as KANBAN_GUIDANCE (from agent/prompt_builder.py); this skill is what you load when you want deeper detail on specific scenarios.

Run STORM phase 1 — multi-perspective research. This skill should be used when the user asks to "research a topic for an article", "find sources on X from multiple perspectives", "do storm research on X", or invokes /storm:research. Discovers personas, runs simulated Q&A per persona in parallel, and produces an information table + deduplicated sources.

Conducts digital forensics investigations on compromised endpoints, including memory acquisition, disk imaging, artifact analysis, and timeline reconstruction for incident response and evidence collection.

Returns structured prediction-market data for Polymarket, Kalshi, Limitless, Opinion, Predict.Fun, dFlow, and UMA oracle via a local API, covering markets, cross-venue search, leaderboards, smart money, wallet analytics, identity clustering, and resolution status.

Build event budgets with categories and contingency. TRIGGERS - Use when user needs help with event-budget related tasks.

Composition Patterns