Orchestra Intake — File New Tools, Never Archive
When the user adds anything new to the ecosystem, this skill files it into the right orchestra so it
is used at 100% efficiency from day one. Nothing gets dumped undifferentiated; nothing gets
archived on arrival.
Process (run for every new install)
1. Security scan FIRST (mandatory, no exceptions)
Run the 5-step ~/.claude/workflows/import-security-scan.md:
source verification → code scan → npm/socket check → skill/MCP source review → SAFE/CAUTION/REJECT.
- REJECT → do not install/keep. Tell the user why. Stop.
- CAUTION → surface the risk, get the user's explicit go before filing.
- SAFE → proceed to classify.
1b. Bulk-install fixture check (MANDATORY after any npx skills add <repo>)
npx skills add walks the entire repo tree and installs every SKILL.md it finds —
including test fixtures. After adding any multi-folder repo, inspect ~/.agents/.skill-lock.json
for entries whose skillPath contains tests/, fixtures/, examples/, or .test-client/.
Those are NOT real skills — quarantine them to ~/.claude/_archive/ and remove their lock entries.
A security-scanner's repo is the most dangerous to bulk-install from: its test suite contains
malware by design (e.g. snyk/agent-scan shipped a malicious base-trading-agent fixture that
loaded a prompt-injection into the roster for 20 days — see
docs/learnings/2026-05-21-malicious-skill-from-scanner-fixtures.md). Also flag the multi-folder
--skill= quirk: targeted flags are IGNORED on multi-folder repos, so the WHOLE repo lands — prune after.
2. Identify what it is
- Skill (
SKILL.md) · Plugin (package w/ agents/skills/commands) · MCP server (settings.json) ·
Connector (claude.ai) · Agent (~/.claude/agents/).
- Read its description/frontmatter to understand WHAT it does and WHEN it triggers.
3. Classify into an orchestra
Match the tool's purpose to one (or more) of the 22 orchestras in
~/.claude/rules/orchestra-system.md. Decision aid:
| If the tool is about… |
File into |
| code, framework, deploy, testing |
① BUILD |
| UI, design, visual, animation |
② DESIGN |
| research, scraping, intel |
③ RESEARCH |
| social, campaigns, brand |
④ MARKETING |
| copy, writing, content |
⑤ CONTENT |
| search ranking, schema, AI-answers |
⑥ SEO+GEO |
| leads, prospecting, CRM, sales |
⑦ LEAD GEN |
| product strategy, PRD, discovery |
⑧ PRODUCT |
| video, image gen, media |
⑨ VIDEO+MEDIA |
| metrics, analytics, experiments |
⑩ ANALYTICS |
| memory, graphs, notes, search |
⑪ KNOWLEDGE |
| docs, decks, spreadsheets |
⑫ DOCUMENTS |
| paid ads, PPC |
⑬ PAID ADS |
| automation, workflows, ops |
⑭ AUTOMATION |
| AI/ML, agents, MCP-building |
⑮ AI/ML |
| iOS, Swift, mobile |
⑯ iOS/SWIFT |
| planning, PM, sprints |
⑰ PLANNING |
| conversion, retention, pricing |
⑱ GROWTH |
| investing, valuation, finance |
⑲ PERSONAL FINANCE |
| strategy, exec counsel, board-level advice |
⑳ EXECUTIVE ADVISORY |
| verification, QA gates, evidence review |
㉑ AUDIT |
| security, pentest, detection, hardening |
㉒ CYBERSECURITY |
| off-domain vertical/game/XR |
⓪ RESERVE BENCH (dormant) |
- A tool can join multiple orchestras (e.g. an MCP useful to BUILD + AI/ML). List all.
- If genuinely off-domain (a new vertical/game/XR tool), file to Reserve Bench — installed,
dormant, named-invoke only. Do NOT archive.
- If no orchestra fits and it's clearly valuable, propose a NEW orchestra to the user.
4. File it
- Add the tool to the relevant orchestra's roster in
~/.claude/rules/orchestra-system.md
(First Chair if core to the orchestra, Section if supporting).
- If it needs a trigger, add it to the router's quick table in
~/.claude/skills/orchestra-router/SKILL.md.
5. Log the assignment
Append to ~/.claude/docs/learnings/orchestra-assignments.md:
YYYY-MM-DD · <tool> · type · → Orchestra(s) · why · scan result
6. Refresh the skill index (mandatory)
After filing, rebuild the skill discovery index so the new tool is immediately visible
to skill-selector's semantic retrieval. Run this before reporting back:
~/.claude/scripts/build-skill-index.sh --no-embed
This takes ~10-30 seconds (writes stubs + updates .orchestra-scan.md). The full vector
re-embed happens automatically at next session start via the SessionStart hook, or
immediately with qmd embed if you want retrieval now.
Why this is mandatory: skill-selector uses qmd semantic search over the stub index
to find the best skill. A newly-filed skill won't be discoverable until the index is rebuilt.
The "no skill wasted" guarantee only holds if the index stays current.
7. Tell the scriber + report back
Per the skills-protocol, inform the scriber so it's documented, then report to the user:
✅ Filed <tool> → <Orchestra> (<role>). Security: SAFE. Triggers on: <phrases>.
Now part of your <orchestra> team alongside <related tools>.
Skill index refreshed — discoverable via semantic retrieval immediately.
Principles
- Never archive on install. Filing > archiving. Even off-domain tools stay live on the bench.
- Security scan is non-negotiable. Nothing is filed before it passes.
- Explain the why. Every assignment is logged with reasoning so it survives sessions.
- Keep the constitution current. The orchestra-system.md rule is the source of truth — update it.
1---2name: orchestra-intake3description: Classify and file every newly installed skill, plugin, MCP, connector, or agent into the right orchestra — never archive. Use whenever the user installs/adds a new repo, skill, plugin, MCP server, or agent ("I installed X", "added Y", "npx skills add Z", "new repo", "set up this MCP", "just got this connector"). Runs the security scan, classifies the tool, places it in an orchestra with usage notes, logs the assignment, and reports back. This is the self-organizing layer of the orchestra system.4---56# Orchestra Intake — File New Tools, Never Archive78When the user adds anything new to the ecosystem, this skill files it into the right orchestra so it9is used at 100% efficiency from day one. **Nothing gets dumped undifferentiated; nothing gets10archived on arrival.**1112## Process (run for every new install)1314### 1. Security scan FIRST (mandatory, no exceptions)15Run the 5-step `~/.claude/workflows/import-security-scan.md`:16source verification → code scan → npm/socket check → skill/MCP source review → SAFE/CAUTION/REJECT.17- **REJECT** → do not install/keep. Tell the user why. Stop.18- **CAUTION** → surface the risk, get the user's explicit go before filing.19- **SAFE** → proceed to classify.2021### 1b. Bulk-install fixture check (MANDATORY after any `npx skills add <repo>`)22`npx skills add` walks the **entire repo tree** and installs every `SKILL.md` it finds —23including test fixtures. After adding any multi-folder repo, inspect `~/.agents/.skill-lock.json`24for entries whose `skillPath` contains **`tests/`, `fixtures/`, `examples/`, or `.test-client/`**.25Those are NOT real skills — quarantine them to `~/.claude/_archive/` and remove their lock entries.26**A security-scanner's repo is the most dangerous to bulk-install from: its test suite contains27malware by design** (e.g. snyk/agent-scan shipped a malicious `base-trading-agent` fixture that28loaded a prompt-injection into the roster for 20 days — see29`docs/learnings/2026-05-21-malicious-skill-from-scanner-fixtures.md`). Also flag the multi-folder30`--skill=` quirk: targeted flags are IGNORED on multi-folder repos, so the WHOLE repo lands — prune after.3132### 2. Identify what it is33- Skill (`SKILL.md`) · Plugin (package w/ agents/skills/commands) · MCP server (settings.json) ·34 Connector (claude.ai) · Agent (`~/.claude/agents/`).35- Read its description/frontmatter to understand WHAT it does and WHEN it triggers.3637### 3. Classify into an orchestra38Match the tool's purpose to one (or more) of the 22 orchestras in39`~/.claude/rules/orchestra-system.md`. Decision aid:4041| If the tool is about… | File into |42|---|---|43| code, framework, deploy, testing | ① BUILD |44| UI, design, visual, animation | ② DESIGN |45| research, scraping, intel | ③ RESEARCH |46| social, campaigns, brand | ④ MARKETING |47| copy, writing, content | ⑤ CONTENT |48| search ranking, schema, AI-answers | ⑥ SEO+GEO |49| leads, prospecting, CRM, sales | ⑦ LEAD GEN |50| product strategy, PRD, discovery | ⑧ PRODUCT |51| video, image gen, media | ⑨ VIDEO+MEDIA |52| metrics, analytics, experiments | ⑩ ANALYTICS |53| memory, graphs, notes, search | ⑪ KNOWLEDGE |54| docs, decks, spreadsheets | ⑫ DOCUMENTS |55| paid ads, PPC | ⑬ PAID ADS |56| automation, workflows, ops | ⑭ AUTOMATION |57| AI/ML, agents, MCP-building | ⑮ AI/ML |58| iOS, Swift, mobile | ⑯ iOS/SWIFT |59| planning, PM, sprints | ⑰ PLANNING |60| conversion, retention, pricing | ⑱ GROWTH |61| investing, valuation, finance | ⑲ PERSONAL FINANCE |62| strategy, exec counsel, board-level advice | ⑳ EXECUTIVE ADVISORY |63| verification, QA gates, evidence review | ㉑ AUDIT |64| security, pentest, detection, hardening | ㉒ CYBERSECURITY |65| off-domain vertical/game/XR | ⓪ RESERVE BENCH (dormant) |6667- A tool can join **multiple** orchestras (e.g. an MCP useful to BUILD + AI/ML). List all.68- If genuinely off-domain (a new vertical/game/XR tool), file to **Reserve Bench** — installed,69 dormant, named-invoke only. Do NOT archive.70- If no orchestra fits and it's clearly valuable, propose a NEW orchestra to the user.7172### 4. File it73- Add the tool to the relevant orchestra's roster in `~/.claude/rules/orchestra-system.md`74 (First Chair if core to the orchestra, Section if supporting).75- If it needs a trigger, add it to the router's quick table in76 `~/.claude/skills/orchestra-router/SKILL.md`.7778### 5. Log the assignment79Append to `~/.claude/docs/learnings/orchestra-assignments.md`:80`YYYY-MM-DD · <tool> · type · → Orchestra(s) · why · scan result`8182### 6. Refresh the skill index (mandatory)83After filing, rebuild the skill discovery index so the new tool is immediately visible84to `skill-selector`'s semantic retrieval. Run this before reporting back:8586```bash87~/.claude/scripts/build-skill-index.sh --no-embed88```8990This takes ~10-30 seconds (writes stubs + updates `.orchestra-scan.md`). The full vector91re-embed happens automatically at next session start via the SessionStart hook, or92immediately with `qmd embed` if you want retrieval now.9394**Why this is mandatory:** `skill-selector` uses qmd semantic search over the stub index95to find the best skill. A newly-filed skill won't be discoverable until the index is rebuilt.96The "no skill wasted" guarantee only holds if the index stays current.9798### 7. Tell the scriber + report back99Per the skills-protocol, inform the scriber so it's documented, then report to the user:100```101✅ Filed <tool> → <Orchestra> (<role>). Security: SAFE. Triggers on: <phrases>.102 Now part of your <orchestra> team alongside <related tools>.103 Skill index refreshed — discoverable via semantic retrieval immediately.104```105106## Principles107- **Never archive on install.** Filing > archiving. Even off-domain tools stay live on the bench.108- **Security scan is non-negotiable.** Nothing is filed before it passes.109- **Explain the why.** Every assignment is logged with reasoning so it survives sessions.110- **Keep the constitution current.** The orchestra-system.md rule is the source of truth — update it.
Momo2323-ui