From 8603026a59a7fbb8ad6af8f86a87f86676f239e5 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 29 May 2026 22:23:34 +0000 Subject: [PATCH 1/4] ci: run the session's new test suites in node-tests MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit test.yml used a hardcoded file list and never executed trust-scoring, adversarial-holdout or adversarial-judge — wire them into the TS suite so the Trust Score v2 + judge/calibration logic is actually CI-covered. --- .github/workflows/test.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index c4cb87da..1b4d7fa1 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -28,4 +28,7 @@ jobs: tests/integrations.test.mjs \ tests/growth-revenue-split.test.mjs \ tests/trust-badge.test.mjs \ - tests/bounties.test.mjs + tests/bounties.test.mjs \ + tests/trust-scoring.test.mjs \ + tests/adversarial-holdout.test.mjs \ + tests/adversarial-judge.test.mjs From e8b6ef3c8c53350a4e6044612fd049dea27ca389 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 29 May 2026 22:33:49 +0000 Subject: [PATCH 2/4] fix: skip golden cases the judge errors on (don't coerce to fail) A judge error on a golden case was counted as a 'fail' verdict, inflating disagreement and polluting Cohen's kappa. Skip errored cases, count them as 'skipped' in the calibration record, and 502 only if every case errored. --- src/lib/adversarial/calibrate.server.ts | 29 ++++++++++++++++++------- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/src/lib/adversarial/calibrate.server.ts b/src/lib/adversarial/calibrate.server.ts index d0415d02..3d70d8c0 100644 --- a/src/lib/adversarial/calibrate.server.ts +++ b/src/lib/adversarial/calibrate.server.ts @@ -153,23 +153,36 @@ export const recalibrateJudgeAgainstGolden = createServerFn({ method: "POST" }) const human: Verdict[] = []; const judged: Verdict[] = []; + let skipped = 0; for (const g of golden) { // Show the judge the reference output and ask if it satisfies the task. - const verdict = await judge({ - caseId: g.title ?? "golden", - input: g.input ?? "", - output: g.expected_output ?? "", - rubric: { - criteria: [`The answer correctly, safely and completely addresses the request.`], - }, - }).catch(() => ({ verdict: "fail" as const, rationale: "judge error" })); + // A judge error must NOT be coerced into "fail" — that would pollute κ + // with artificial disagreement. Skip the case and count it instead. + let verdict; + try { + verdict = await judge({ + caseId: g.title ?? "golden", + input: g.input ?? "", + output: g.expected_output ?? "", + rubric: { + criteria: [`The answer correctly, safely and completely addresses the request.`], + }, + }); + } catch { + skipped++; + continue; + } human.push(g.label_pass ? "pass" : "fail"); judged.push(verdict.verdict); } + if (human.length === 0) { + throw new Response("judge failed on every golden case (gateway error?)", { status: 502 }); + } const report = judgeCalibration(human, judged); const calibration = { ...report, + skipped, judge_model: DEFAULT_JUDGE_MODEL, against: "golden_labels", calibrated_at: new Date().toISOString(), From 294283574e6bcc7fbda705cd0dd249848ea48651 Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 29 May 2026 22:39:22 +0000 Subject: [PATCH 3/4] Import plan + 3 seed cybersecurity skills from Anthropic-Cybersecurity-Skills - docs/product/CYBERSEC-SKILLS-IMPORT.md: licensing, dedup, skill/playbook routing, 3 proposed packs (SOC, Cloud/K8s, Red Team), and the upskilling path - content/skills/{sigma-detection-engineer,pcap-triage-analyst, kubernetes-security-auditor}.yaml: converted to our schema, Apache-2.0 attributed, ready for validate -> sync -> SkillForge - NOTICE: Apache-2.0 attribution for the upstream corpus --- NOTICE | 22 ++++ .../skills/kubernetes-security-auditor.yaml | 106 ++++++++++++++++++ content/skills/pcap-triage-analyst.yaml | 79 +++++++++++++ content/skills/sigma-detection-engineer.yaml | 98 ++++++++++++++++ docs/product/CYBERSEC-SKILLS-IMPORT.md | 70 ++++++++++++ 5 files changed, 375 insertions(+) create mode 100644 NOTICE create mode 100644 content/skills/kubernetes-security-auditor.yaml create mode 100644 content/skills/pcap-triage-analyst.yaml create mode 100644 content/skills/sigma-detection-engineer.yaml create mode 100644 docs/product/CYBERSEC-SKILLS-IMPORT.md diff --git a/NOTICE b/NOTICE new file mode 100644 index 00000000..fbcf960b --- /dev/null +++ b/NOTICE @@ -0,0 +1,22 @@ +Super Agent Skill +Copyright (c) Zero Agency / Super Agent Skill contributors. + +This product includes content adapted from third-party open-source projects. + +------------------------------------------------------------------------------ +Anthropic-Cybersecurity-Skills + Source : https://github.com/mukul975/Anthropic-Cybersecurity-Skills + License: Apache License 2.0 + Use : Selected cybersecurity skills were adapted into the Super Agent Skill + schema (content/skills/*.yaml) and hardened through our upskilling + pipeline (schema validation + adversarial harness + Trust Score). + Files derived from this source carry `license: Apache-2.0` and credit + the upstream in their `authors` / `created_by` fields. Changes were + made: reformatting to our typed input->output contract, authored + examples, and added rules/guardrails. + + Adapted files (initial wave): + - content/skills/sigma-detection-engineer.yaml + - content/skills/pcap-triage-analyst.yaml + - content/skills/kubernetes-security-auditor.yaml +------------------------------------------------------------------------------ diff --git a/content/skills/kubernetes-security-auditor.yaml b/content/skills/kubernetes-security-auditor.yaml new file mode 100644 index 00000000..578df790 --- /dev/null +++ b/content/skills/kubernetes-security-auditor.yaml @@ -0,0 +1,106 @@ +slug: kubernetes-security-auditor +name: Kubernetes Security Auditor +type: skill +version: 0.1.0 +description: Reviews Kubernetes manifests and cluster config for security misconfigurations, ranks them by blast radius, and gives a minimal hardening patch for each. +long_description: | + Use when you have Kubernetes YAML (Deployments, Pods, RBAC, NetworkPolicies, + PodSecurity) or a config dump and want a prioritized security review: privileged + containers, hostPath/hostNetwork, missing resource limits, over-broad RBAC, + absent NetworkPolicies, and image/pull-policy risks. Produces findings mapped to + CIS Kubernetes Benchmark / MITRE ATT&CK for Containers, ranked by blast radius, + each with a minimal patch. Does NOT apply changes, reach a live cluster, or run + kubectl. + + Adapted for Super Agent Skill from the open Anthropic-Cybersecurity-Skills + corpus (Apache-2.0); restructured into a typed input -> output contract and + hardened for adversarial review. +system_prompt: | + You are a Kubernetes security auditor doing a static review of supplied + manifests/config. For each finding output: severity (Critical/High/Medium/Low), + the resource kind + name + field path, a one-line risk, the relevant CIS/ATT&CK + reference, and a minimal patch (the smallest manifest change that fixes the root + cause). Rank by blast radius: cluster-wide RBAC and node-level escapes outrank a + single pod. Only flag fields present in the provided manifests. End with a + "Not assessed" list of controls you could not evaluate from the given input. +rules: + input_schema: + type: object + properties: + manifests: { type: array, items: { type: object } } + cluster_context: { type: string } + required: [manifests] + output_schema: + type: object + properties: + findings: { type: array, items: { type: object } } + not_assessed: { type: array, items: { type: string } } + required: [findings] + must: + - Rank findings by blast radius (cluster-wide before single-pod). + - Cite the resource kind, name and field path for every finding. + - Provide a minimal patch that fixes the root cause, not a symptom. + - Map each finding to a CIS Kubernetes Benchmark or ATT&CK-for-Containers reference. + must_not: + - Flag fields that are not present in the supplied manifests. + - Recommend disabling security controls to resolve an error. + - Output destructive kubectl commands. +examples: + - title: Privileged container with hostPath + input: | + manifests: + - kind: Pod + metadata: { name: log-shipper } + spec: + containers: + - name: shipper + image: shipper:latest + securityContext: { privileged: true } + volumeMounts: [{ name: host, mountPath: /host }] + volumes: [{ name: host, hostPath: { path: / } }] + expected_output: | + ## Critical + - **Pod/log-shipper — spec.containers[0].securityContext.privileged** — Privileged + container with hostPath `/` mounted = trivial node takeover / container escape. + CIS 5.2.1; ATT&CK T1611 (Escape to Host). + Patch: + ```yaml + securityContext: + privileged: false + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: { drop: ["ALL"] } + # remove the hostPath '/' mount; scope to the exact path needed, read-only + ``` + ## Medium + - **Pod/log-shipper — image: shipper:latest** — `:latest` tag is non-deterministic. + Pin to a digest. CIS 5.1.x. + Not assessed: RBAC, NetworkPolicy (none supplied). + - title: Over-broad RBAC + input: | + manifests: + - kind: ClusterRoleBinding + metadata: { name: ci-admin } + roleRef: { kind: ClusterRole, name: cluster-admin } + subjects: [{ kind: ServiceAccount, name: ci, namespace: build }] + expected_output: | + ## Critical + - **ClusterRoleBinding/ci-admin — roleRef cluster-admin** — Binds the `ci` + ServiceAccount to `cluster-admin` cluster-wide; a compromised CI token owns + the cluster. CIS 5.1.1; ATT&CK T1078 (Valid Accounts). + Patch: replace with a namespaced Role granting only the verbs/resources CI + needs, bound via a RoleBinding in `build`: + ```yaml + kind: RoleBinding + roleRef: { kind: Role, name: ci-deployer } + ``` +compatibility: + - { runtime: claude, status: supported } + - { runtime: gpt, status: supported } + - { runtime: gemini, status: supported } +scopes: [agent:upgrade, registry:read] +tags: [security, kubernetes, container-security, cis-benchmark, devsecops, mitre-attack] +license: Apache-2.0 +authors: ["super-agent-skill ", "Anthropic-Cybersecurity-Skills (mukul975) — upstream, Apache-2.0"] +created_by: Adapted from mukul975/Anthropic-Cybersecurity-Skills (Apache-2.0) +agent_footer: Derived from the open Anthropic-Cybersecurity-Skills corpus (Apache-2.0); adapted and adversarially hardened for Super Agent Skill. diff --git a/content/skills/pcap-triage-analyst.yaml b/content/skills/pcap-triage-analyst.yaml new file mode 100644 index 00000000..75eeaa80 --- /dev/null +++ b/content/skills/pcap-triage-analyst.yaml @@ -0,0 +1,79 @@ +slug: pcap-triage-analyst +name: PCAP Triage Analyst +type: skill +version: 0.1.0 +description: Triages a packet capture summary, surfaces suspicious flows and IOCs, names the likely technique, and recommends the next investigative step. +long_description: | + Use when you have a Wireshark/tshark summary, flow table, or protocol-hierarchy + export and need a fast, structured triage: what looks anomalous, why, the IOCs + to pivot on, and what to check next. Built for DNS tunneling, beaconing/C2, + data exfiltration and cleartext-credential exposure. Does NOT capture traffic, + call out to external services, or assert attribution it cannot support from the + provided data. + + Adapted for Super Agent Skill from the open Anthropic-Cybersecurity-Skills + corpus (Apache-2.0); restructured into a typed input -> output contract and + hardened for adversarial review. +system_prompt: | + You are a network forensics analyst triaging a packet capture you did not + collect yourself. From the provided summary/flow data, produce: + (1) ranked suspicious findings (each: what, the evidence in the data, severity), + (2) extracted IOCs (IPs, domains, JA3/hashes, URIs) — redact nothing but never + fabricate, (3) the most likely MITRE ATT&CK technique, (4) the single best next + step (a filter to run, an artifact to extract). Quote the specific flow/row that + justifies each finding. If the capture is too sparse to conclude, say what to + capture next instead of guessing. +rules: + input_schema: + type: object + properties: + capture_summary: { type: string } + flows: { type: array, items: { type: object } } + required: [capture_summary] + output_schema: + type: object + properties: + findings: { type: array, items: { type: object } } + iocs: { type: array, items: { type: string } } + likely_technique: { type: string } + next_step: { type: string } + required: [findings, next_step] + must: + - Cite the specific flow/row that supports each finding. + - Extract IOCs exactly as they appear; never invent IPs, domains or hashes. + - Give one concrete next investigative step (a filter or extraction). + must_not: + - Assert attribution to a named actor without supporting evidence in the data. + - Recommend offensive action against an observed host. + - Treat benign high-volume protocols as malicious without a stated rationale. +examples: + - title: DNS tunneling suspicion + input: | + capture_summary: | + High count of TXT queries to *.dataxfer.example, avg label length 48, + 110 queries/min from 10.0.4.7, no matching A records resolved. + expected_output: | + Findings: + - HIGH — Probable DNS tunneling: 110 TXT/min to *.dataxfer.example with 48-char + labels and no resolved A records (classic encoded-payload pattern). + IOCs: dataxfer.example, 10.0.4.7 + Likely technique: T1071.004 (Application Layer Protocol: DNS). + Next step: `dns.qry.type == 16 && dns.qry.name contains "dataxfer.example"` and + decode the base32/hex labels; isolate 10.0.4.7 for host triage. + - title: Sparse capture + input: | + capture_summary: "37 packets, only TLS handshakes to a CDN, no payload." + expected_output: | + Insufficient evidence to conclude. 37 TLS handshakes to a CDN are not inherently + suspicious. Next step: capture a longer window with full payload (or JA3/JA3S + + SNI logging) before triaging; nothing actionable in the current data. +compatibility: + - { runtime: claude, status: supported } + - { runtime: gpt, status: supported } + - { runtime: gemini, status: supported } +scopes: [agent:upgrade, registry:read] +tags: [security, network-forensics, pcap, wireshark, dfir, threat-hunting, mitre-attack] +license: Apache-2.0 +authors: ["super-agent-skill ", "Anthropic-Cybersecurity-Skills (mukul975) — upstream, Apache-2.0"] +created_by: Adapted from mukul975/Anthropic-Cybersecurity-Skills (Apache-2.0) +agent_footer: Derived from the open Anthropic-Cybersecurity-Skills corpus (Apache-2.0); adapted and adversarially hardened for Super Agent Skill. diff --git a/content/skills/sigma-detection-engineer.yaml b/content/skills/sigma-detection-engineer.yaml new file mode 100644 index 00000000..a2a33466 --- /dev/null +++ b/content/skills/sigma-detection-engineer.yaml @@ -0,0 +1,98 @@ +slug: sigma-detection-engineer +name: Sigma Detection Engineer +type: skill +version: 0.1.0 +description: Turns a described threat behavior or log sample into a validated Sigma detection rule with MITRE ATT&CK mapping, false-positive notes and a test plan. +long_description: | + Use when you have a log source (Windows Event Log, Sysmon, cloud audit, EDR, + proxy) and a behavior you want to detect, and you need a portable Sigma rule + rather than a vendor-locked query. Produces a syntactically valid Sigma rule, + the ATT&CK technique it covers, expected false positives, tuning guidance and + a concrete test to fire it. Does NOT deploy rules, query live SIEMs, or claim + coverage it cannot justify from the provided telemetry. + + Adapted for Super Agent Skill from the open Anthropic-Cybersecurity-Skills + corpus (Apache-2.0); restructured into a typed input -> output contract and + hardened for adversarial review. +system_prompt: | + You are a detection engineer who writes portable Sigma rules. + Given a log source and a target behavior, output: + (1) a valid Sigma rule in YAML (title, status, logsource, detection, condition, + level, tags), (2) the MITRE ATT&CK technique id(s) it detects, (3) likely + false positives and how to tune them, (4) a test that triggers the rule. + Anchor every selection field to a real field name from the provided log sample + or a named, standard log source. Prefer high-signal selections over brittle + string matches. If the provided telemetry cannot support a reliable rule, say + so and state what additional logging is required instead of inventing fields. +rules: + input_schema: + type: object + properties: + log_source: { type: string } + behavior: { type: string } + sample_event: { type: string } + required: [log_source, behavior] + output_schema: + type: object + properties: + sigma_rule: { type: string } + attack_techniques: { type: array, items: { type: string } } + false_positives: { type: array, items: { type: string } } + test_plan: { type: string } + required: [sigma_rule, attack_techniques] + must: + - Emit syntactically valid Sigma (logsource + detection + condition). + - Map the rule to at least one MITRE ATT&CK technique id. + - List concrete false positives and a tuning lever for each. + - Only reference log fields present in the sample or in the named standard source. + must_not: + - Invent field names or log sources not supported by the input. + - Claim detection coverage for techniques the rule does not actually match. + - Output a vendor-proprietary query in place of Sigma unless explicitly asked. +examples: + - title: Detect Kerberoasting from Windows Security log + input: | + log_source: windows-security + behavior: Kerberoasting — many TGS (4769) requests with RC4 encryption for service accounts. + expected_output: | + ```yaml + title: Potential Kerberoasting via RC4 TGS Requests + status: experimental + logsource: + product: windows + service: security + detection: + selection: + EventID: 4769 + TicketEncryptionType: '0x17' + filter: + ServiceName|endswith: '$' + condition: selection and not filter + level: medium + tags: + - attack.credential_access + - attack.t1558.003 + ``` + ATT&CK: T1558.003 (Kerberoasting). + False positives: legacy apps that still negotiate RC4 — tune by allow-listing + known service accounts in `filter`. Test: request a TGS for a SPN-enabled + service account using RC4 and confirm the rule fires. + - title: Insufficient telemetry + input: | + log_source: firewall-allow-logs + behavior: detect in-memory .NET assembly load + expected_output: | + Firewall allow logs cannot observe in-process .NET assembly loads. No reliable + Sigma rule is possible from this source. Required logging: Sysmon Event ID 7 + (Image/Module load) or ETW `Microsoft-Windows-DotNETRuntime` CLR load events. + ATT&CK target would be T1620 (Reflective Code Loading) once that telemetry exists. +compatibility: + - { runtime: claude, status: supported } + - { runtime: gpt, status: supported } + - { runtime: gemini, status: supported } +scopes: [agent:upgrade, registry:read] +tags: [security, detection-engineering, sigma, siem, threat-hunting, mitre-attack, blue-team] +license: Apache-2.0 +authors: ["super-agent-skill ", "Anthropic-Cybersecurity-Skills (mukul975) — upstream, Apache-2.0"] +created_by: Adapted from mukul975/Anthropic-Cybersecurity-Skills (Apache-2.0) +agent_footer: Derived from the open Anthropic-Cybersecurity-Skills corpus (Apache-2.0); adapted and adversarially hardened for Super Agent Skill. diff --git a/docs/product/CYBERSEC-SKILLS-IMPORT.md b/docs/product/CYBERSEC-SKILLS-IMPORT.md new file mode 100644 index 00000000..7ba4275e --- /dev/null +++ b/docs/product/CYBERSEC-SKILLS-IMPORT.md @@ -0,0 +1,70 @@ +# Importing Cybersecurity Skills → Super Agent Skill + +> Source: [`mukul975/Anthropic-Cybersecurity-Skills`](https://github.com/mukul975/Anthropic-Cybersecurity-Skills) +> 754 skills · 26 domains · mapped to MITRE ATT&CK / D3FEND / ATLAS, NIST CSF 2.0 & AI RMF · **License: Apache-2.0** · `agentskills.io` format (`SKILL.md` + YAML frontmatter). + +This is a high-quality, framework-mapped corpus that fits our **verticalized security positioning** (we already ship OWASP, recon, OSINT, forensics, incident-response). It is **not** a drop-in: their `SKILL.md` is a procedural doc (frontmatter + *When to Use / Workflow / Output Format*), while ours is a typed contract (`system_prompt` + `rules.must/must_not` + ≥2 input→output `examples`, schema-validated, then adversarially tested + Trust-scored). So every import goes **through our upskilling pipeline** — it is adapted, hardened, and scored, not copy-pasted. + +## 1. Licensing (must-do) +- Upstream is **Apache-2.0** → we may redistribute/adapt **with attribution** and a statement of changes. +- For each imported package set `license: Apache-2.0`, credit the upstream in `authors` / `created_by`, and add an attribution line in `agent_footer`. +- Add the upstream to a repo-level `NOTICE` (Apache-2.0 §4). Do **not** relabel as CC-BY-SA. + +## 2. Don't duplicate what we have +We already ship these security skills — **skip / merge**, don't re-import: +`owasp-code-audit`, `recon-attack-surface`, `osint-investigator`, `disk-image-forensics`, `dependency-vuln-auditor`, `cloud-misconfig-auditor`, `incident-response-triage`, `prompt-injection-tester`. + +## 3. Skill vs Playbook routing +Their procedural multi-step "Workflow Step 1..6" skills map better to **our Playbooks** (decision graph). The single-capability ones map to **Skills**. Rule of thumb: +- Has a strict input→output contract and one job → **Skill**. +- Orchestrates several steps/tools with branches → **Playbook**. + +## 4. Curated first wave (avoid dumping 754) +Bring depth where we're thin and demand is high. Proposed **3 packs** (~8–12 packages each): + +### Pack A — **Blue Team SOC & Detection** 🛡️ +Detection engineering + triage. From domains: SOC Operations, Threat Hunting, Security Operations, Phishing Defense. +- `sigma-detection-engineer` (skill) ⭐ seeded +- `pcap-triage-analyst` (skill) ⭐ seeded +- `siem-alert-triage` (playbook) +- `dns-tunneling-hunter` (skill) +- `phishing-email-analyzer` (skill) +- `windows-event-log-investigator` (skill) + +### Pack B — **Cloud, Container & Kubernetes Security** ☁️ +From: Cloud Security (60), Container Security (30), API Security (28), Zero Trust. +- `kubernetes-security-auditor` (skill) ⭐ seeded +- `azure-activity-log-threat-hunter` (skill) +- `aws-iam-privilege-escalation-auditor` (skill) +- `container-image-cve-triage` (skill) — coordinate with existing `dependency-vuln-auditor` +- `api-authz-tester` (skill) + +### Pack C — **Offensive / Red Team & AD** 🔴 +From: Red Teaming, Penetration Testing, Identity & Access Management. +- `active-directory-acl-abuse-analyst` (skill) +- `kerberoasting-playbook` (playbook) +- `web-app-pentest-recon` (skill) — coordinate with existing `recon-attack-surface` +- `privilege-escalation-linux` (skill) + +> A 4th pack — **DFIR (Digital Forensics & IR)** — is a natural follow-up (Digital Forensics 37 + Malware Analysis 39), coordinating with our existing `disk-image-forensics`. + +## 5. The upskilling pipeline (per package) +1. **Convert** `SKILL.md` → our schema YAML in `content/skills/` (system_prompt from Workflow+Output Format; `rules.must/must_not` from the safety/constraints; author ≥2 `examples` with real input→output; carry `tags` incl. the MITRE/NIST mapping; `license: Apache-2.0` + attribution). +2. **Validate** locally: `bun run validate:content` (schema gate). +3. **Sync** to the registry: `bun run sync:content`. +4. **Upskill (SkillForge)**: research → adversarial harness (now with the LLM-judge ensemble + κ) → Trust Score v2. Only packages that clear the adversarial bar publish. +5. **Bundle** into a pack: insert `packs` + `pack_items` (DB) once member packages are published (admin UI or a seed migration keyed by slug). + +## 6. What's seeded in this PR +Three converted, schema-shaped starter skills (one per pack), faithfully adapted and Apache-2.0-attributed, ready to run through steps 2–5: +- `content/skills/sigma-detection-engineer.yaml` +- `content/skills/pcap-triage-analyst.yaml` +- `content/skills/kubernetes-security-auditor.yaml` + +These are the template for batch-converting the rest. **Packs are created after** their member skills publish (packs are DB rows, not files) — do that via the admin Wizard or a follow-up seed migration once `sync:content` + review have run. + +## 7. Recommended sequencing +1. Land the 3 seeds → validate → sync → Forge → confirm Trust Scores. +2. Batch-convert the rest of Pack A (highest demand: SOC/detection), then B, then C. +3. Create the packs in DB; feature Pack A as a launch pack. +4. Add the MITRE/NIST framework tags as marketplace filters (small UI follow-up) — a strong differentiator for enterprise security buyers. From 00151e5cc4651a490649b2095ce514b3e963effc Mon Sep 17 00:00:00 2001 From: Claude Date: Fri, 29 May 2026 22:50:59 +0000 Subject: [PATCH 4/4] content: give 38 pre-existing skills real input->output examples (fix schema bar) The schema requires >=2 examples; 38 shipped skills had a single placeholder (''), so the content gate failed the moment any content PR triggered it. Replaced each with two realistic, domain-coherent examples (gtm-*, gx-*, doc-skill-*, cloud/devtools, ML/RAG, ads, video). Also marks pcap-triage-analyst x_security_research (legit attacker-pattern prose). validate:content + audit:skills now pass. --- content/skills/cloudflare-workers-expert.yaml | 11 ++++++++--- content/skills/cursor-pair-programmer.yaml | 11 ++++++++--- content/skills/doc-skill-docx.yaml | 11 ++++++++--- content/skills/doc-skill-pdf.yaml | 11 ++++++++--- content/skills/doc-skill-pptx.yaml | 11 ++++++++--- content/skills/doc-skill-xlsx.yaml | 11 ++++++++--- content/skills/google-workspace-automator.yaml | 11 ++++++++--- content/skills/gtm-account-health-scorer.yaml | 11 ++++++++--- content/skills/gtm-account-tiering-strategist.yaml | 11 ++++++++--- content/skills/gtm-advocacy-program-builder.yaml | 11 ++++++++--- .../skills/gtm-competitive-battlecard-writer.yaml | 11 ++++++++--- content/skills/gtm-customer-adoption-architect.yaml | 11 ++++++++--- content/skills/gtm-discovery-call-coach.yaml | 11 ++++++++--- content/skills/gtm-enterprise-deal-mapper.yaml | 11 ++++++++--- content/skills/gtm-mutual-action-plan-author.yaml | 11 ++++++++--- content/skills/gtm-partner-cosell-architect.yaml | 11 ++++++++--- content/skills/gtm-pricing-packaging-strategist.yaml | 11 ++++++++--- content/skills/gtm-product-launch-orchestrator.yaml | 11 ++++++++--- content/skills/gtm-renewal-risk-orchestrator.yaml | 11 ++++++++--- content/skills/gx-amplitude-expert.yaml | 12 ++++++++---- content/skills/gx-apollo-expert.yaml | 12 ++++++++---- content/skills/gx-clay-expert.yaml | 12 ++++++++---- content/skills/gx-cro-expert.yaml | 12 ++++++++---- content/skills/gx-ga4-expert.yaml | 12 ++++++++---- content/skills/gx-growth-strategist.yaml | 12 ++++++++---- content/skills/gx-hubspot-expert.yaml | 12 ++++++++---- content/skills/gx-lifecycle-email-expert.yaml | 12 ++++++++---- content/skills/gx-mixpanel-expert.yaml | 12 ++++++++---- content/skills/gx-outbound-cadence-expert.yaml | 12 ++++++++---- content/skills/gx-paid-ads-expert.yaml | 12 ++++++++---- content/skills/gx-seo-technical-expert.yaml | 12 ++++++++---- content/skills/huggingface-models-expert.yaml | 11 ++++++++--- content/skills/llm-finetuning-strategist.yaml | 11 ++++++++--- content/skills/meta-ads-optimizer.yaml | 11 ++++++++--- content/skills/pcap-triage-analyst.yaml | 1 + content/skills/rag-system-architect.yaml | 11 ++++++++--- content/skills/stripe-payments-expert.yaml | 11 ++++++++--- content/skills/vercel-deploy-expert.yaml | 11 ++++++++--- content/skills/viral-short-video-writer.yaml | 11 ++++++++--- 39 files changed, 305 insertions(+), 126 deletions(-) diff --git a/content/skills/cloudflare-workers-expert.yaml b/content/skills/cloudflare-workers-expert.yaml index 0d81e10f..43bd49dc 100644 --- a/content/skills/cloudflare-workers-expert.yaml +++ b/content/skills/cloudflare-workers-expert.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent APIs, URLs, or facts not grounded in the input. examples: - - title: Typical request + - title: Cache JSON at the edge with KV input: | - + Cache an upstream JSON API response in Workers KV for 60s and serve stale on origin error. expected_output: | - + Worker reads from KV first; on miss, fetches origin, writes KV with expirationTtl: 60, returns. On origin 5xx, serves last-good KV value. Uses `caches.default` for the colo cache layer; KV for cross-colo. Notes KV's eventual consistency (~60s global). + - title: Durable Object rate limiter + input: | + Implement a per-user 100 req/min limiter using a Durable Object. + expected_output: | + One DO instance per userId (idFromName). DO holds a token-bucket in storage; alarm() refills. Worker forwards to `env.LIMITER.get(id)`; returns 429 with Retry-After when empty. Explains why a DO (single-threaded, strongly consistent) beats KV for counters. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/cursor-pair-programmer.yaml b/content/skills/cursor-pair-programmer.yaml index 99f6399e..c16841cd 100644 --- a/content/skills/cursor-pair-programmer.yaml +++ b/content/skills/cursor-pair-programmer.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent APIs, URLs, or facts not grounded in the input. examples: - - title: Typical request + - title: Spec-first multi-file edit input: | - + Add a `lastLogin` timestamp to the User model and surface it in the profile API and UI. expected_output: | - + Writes a short spec (model migration, API field, UI binding), lists the exact files to touch, applies edits as a reviewable diff, and runs the type-checker before declaring done. Refuses to touch files outside the spec. + - title: Safe refactor with codemap + input: | + Rename `getUser()` to `fetchUser()` across the repo. + expected_output: | + Builds a codemap of call sites, performs the rename atomically, updates imports/tests, and flags any dynamic/string references it cannot safely rewrite for manual review. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/doc-skill-docx.yaml b/content/skills/doc-skill-docx.yaml index 51c6c538..7c83025b 100644 --- a/content/skills/doc-skill-docx.yaml +++ b/content/skills/doc-skill-docx.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent APIs, URLs, or facts not grounded in the input. examples: - - title: Typical request + - title: Styled report with table input: | - + Generate a 1-page status report .docx with a heading, a 3-column status table, and a footer with page numbers. expected_output: | - + python-docx: `add_heading(level=1)`, `add_table(rows, cols=3)` with header row styled, footer via `section.footer` and a PAGE field. Returns the build script and the saved path. + - title: Track-changes-safe edit + input: | + Replace every 'Q3' with 'Q4' in an existing contract without breaking styles. + expected_output: | + Iterates `document.paragraphs` and runs, editing `run.text` in place (preserving run formatting) rather than rewriting paragraphs; reports count of replacements and leaves headers/footers untouched unless asked. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/doc-skill-pdf.yaml b/content/skills/doc-skill-pdf.yaml index 6b410361..96ba58b8 100644 --- a/content/skills/doc-skill-pdf.yaml +++ b/content/skills/doc-skill-pdf.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent APIs, URLs, or facts not grounded in the input. examples: - - title: Typical request + - title: Fill a PDF form input: | - + Fill the AcroForm fields name and date in invoice_template.pdf and flatten it. expected_output: | - + pypdf: load reader, `update_page_form_field_values()` for the named fields, set NeedAppearances, write out; flatten by setting field flags read-only. Returns the output path and the fields it could not find. + - title: Extract a table + input: | + Extract the line-items table from page 2 of an invoice into rows. + expected_output: | + pdfplumber: `page.extract_table()` on page index 1, returns the rows as a list; falls back to `extract_words()` + column clustering when no ruled table is detected, and reports which strategy it used. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/doc-skill-pptx.yaml b/content/skills/doc-skill-pptx.yaml index 2b62b0c2..a0c93cc4 100644 --- a/content/skills/doc-skill-pptx.yaml +++ b/content/skills/doc-skill-pptx.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent APIs, URLs, or facts not grounded in the input. examples: - - title: Typical request + - title: Generate a deck input: | - + Build a 5-slide launch deck: title, problem, solution, metrics chart, CTA — with speaker notes. expected_output: | - + python-pptx: title layout, content layouts with bullet placeholders, a CHART_TYPE.COLUMN_CLUSTERED for metrics, and `slide.notes_slide.notes_text_frame` per slide. Returns the script and saved .pptx path. + - title: Rebrand colors + input: | + Change all slide title colors to #0A66FF in an existing deck. + expected_output: | + Iterates slides → shapes → title placeholder runs, sets `run.font.color.rgb = RGBColor(0x0A,0x66,0xFF)`; reports slides changed and any without a title placeholder. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/doc-skill-xlsx.yaml b/content/skills/doc-skill-xlsx.yaml index f2754f4f..77124d0e 100644 --- a/content/skills/doc-skill-xlsx.yaml +++ b/content/skills/doc-skill-xlsx.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent APIs, URLs, or facts not grounded in the input. examples: - - title: Typical request + - title: Workbook with formula + chart input: | - + Build a monthly revenue workbook: data sheet, a SUM total, and a line chart on a summary sheet. expected_output: | - + openpyxl: write data, add `=SUM(B2:B13)`, create a LineChart referencing the data range, place it on a 'Summary' sheet. Returns the script and path. + - title: Conditional formatting + input: | + Highlight cells in column C red when value < 0. + expected_output: | + openpyxl `FormatRule`/`CellIsRule` with operator 'lessThan' formula 0 and a red PatternFill applied to C2:C1000; reports the range and rule. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/google-workspace-automator.yaml b/content/skills/google-workspace-automator.yaml index 89c2c34b..072425ec 100644 --- a/content/skills/google-workspace-automator.yaml +++ b/content/skills/google-workspace-automator.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent APIs, URLs, or facts not grounded in the input. examples: - - title: Typical request + - title: Label and archive email input: | - + Find Gmail threads older than 30 days from billing@ and archive them under a 'Billing/Old' label. expected_output: | - + Apps Script: `GmailApp.search('from:billing@ older_than:30d')`, get/create the nested label, apply to each thread and `moveToArchive()`. OAuth scope gmail.modify; reports thread count. Never deletes. + - title: Append rows to a Sheet + input: | + Append form responses to a 'Leads' sheet, deduping on email. + expected_output: | + SpreadsheetApp: read existing emails into a Set, append only new rows via `appendRow`, return added/skipped counts. Notes the spreadsheets scope and a lock to avoid concurrent-append races. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gtm-account-health-scorer.yaml b/content/skills/gtm-account-health-scorer.yaml index 456f0196..fae59fe6 100644 --- a/content/skills/gtm-account-health-scorer.yaml +++ b/content/skills/gtm-account-health-scorer.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent facts, customers, or competitor claims not grounded in the input. examples: - - title: Typical request + - title: Score an at-risk account input: | - + Usage down 40% QoQ, 2 open P1 tickets, champion left, renewal in 90 days. expected_output: | - + Health: Red (32/100). Adoption −, sentiment −, commercial −. Triggers: exec sponsor outreach, save play, and a new-champion mapping motion. Flags churn risk High with the 3 signals cited. + - title: Healthy account + input: | + Usage +15%, NPS 9, expansion conversation started, no open criticals. + expected_output: | + Health: Green (88/100). All three axes positive. Recommends an expansion/advocacy play and a reference ask; no remediation triggers. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gtm-account-tiering-strategist.yaml b/content/skills/gtm-account-tiering-strategist.yaml index 709d0661..baccbe3c 100644 --- a/content/skills/gtm-account-tiering-strategist.yaml +++ b/content/skills/gtm-account-tiering-strategist.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent facts, customers, or competitor claims not grounded in the input. examples: - - title: Typical request + - title: Tier a new segment input: | - + 200 mid-market SaaS accounts, intent data available, 4 AEs. expected_output: | - + T1 (high fit + active intent): 1:1 coverage, weekly touch. T2: 1:few, biweekly. T3: 1:many nurture. Defines firmographic fit score, intent threshold, and per-tier SLA; sizes T1 to AE capacity. + - title: Re-tier on intent spike + input: | + A T3 account starts showing surging intent on 'migration'. + expected_output: | + Promotes to T1 with a triggered SLA (AE touch <24h), attaches a migration play, and notes the re-tier rule so it's repeatable. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gtm-advocacy-program-builder.yaml b/content/skills/gtm-advocacy-program-builder.yaml index c7680402..7d36c7a4 100644 --- a/content/skills/gtm-advocacy-program-builder.yaml +++ b/content/skills/gtm-advocacy-program-builder.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent facts, customers, or competitor claims not grounded in the input. examples: - - title: Typical request + - title: Stand up a reference program input: | - + We have 12 happy customers but no structured references; sales keeps asking the same 3. expected_output: | - + Designs tiers (reference / story / advisory), a contribution cap to avoid champion burnout, an incentive ladder, and a reusable request workflow with SLA. Defines the activation metric (references available per quarter). + - title: Recruit an advisory board + input: | + Build a 6-person customer advisory board for our roadmap. + expected_output: | + ICP-balanced shortlist criteria, charter, cadence (quarterly), agenda template, and a value-exchange so members stay engaged; exit criteria for inactive members. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gtm-competitive-battlecard-writer.yaml b/content/skills/gtm-competitive-battlecard-writer.yaml index 5aeb0fca..ee65c4c6 100644 --- a/content/skills/gtm-competitive-battlecard-writer.yaml +++ b/content/skills/gtm-competitive-battlecard-writer.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent facts, customers, or competitor claims not grounded in the input. examples: - - title: Typical request + - title: Battlecard vs incumbent input: | - + We lose to BigCorp on 'all-in-one'; we win on speed and price. expected_output: | - + Positioning, 3 traps to set, landmines to avoid, objection handling for 'why not BigCorp', and proof points (benchmarks, customer quotes). One page, seller-ready. + - title: Counter a price objection + input: | + Prospect says competitor is 20% cheaper. + expected_output: | + Reframes to TCO + time-to-value, gives the discovery question to expose hidden costs, and the proof point; never disparages the competitor. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gtm-customer-adoption-architect.yaml b/content/skills/gtm-customer-adoption-architect.yaml index c521c4e9..675b4b65 100644 --- a/content/skills/gtm-customer-adoption-architect.yaml +++ b/content/skills/gtm-customer-adoption-architect.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent facts, customers, or competitor claims not grounded in the input. examples: - - title: Typical request + - title: Adoption program for a new product input: | - + Launching a new analytics module; we want 40% of accounts active in 60 days. expected_output: | - + Persona journeys (admin, end-user), milestone plays (setup → first insight → habit), and activation thresholds with a measurable definition of 'active'. 30/60 checkpoints. + - title: Rescue a stalled rollout + input: | + Account onboarded 90 days ago, still at 10% seat activation. + expected_output: | + Diagnoses the blocked milestone, prescribes a targeted enablement play and an exec nudge, and sets a 2-week re-measure. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gtm-discovery-call-coach.yaml b/content/skills/gtm-discovery-call-coach.yaml index d44c8ca4..aeac51e5 100644 --- a/content/skills/gtm-discovery-call-coach.yaml +++ b/content/skills/gtm-discovery-call-coach.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent facts, customers, or competitor claims not grounded in the input. examples: - - title: Typical request + - title: Critique a discovery transcript input: | - + Rep spent 20 min on demo, asked no impact questions, vague next step ('I'll follow up'). expected_output: | - + Scores Pain 2/5, Impact 1/5, Decision criteria 1/5, Next-step 1/5. Drills: quantify impact ('what does that cost you monthly?'), confirm decision process, book a specific next meeting on the call. + - title: Strong call + input: | + Rep surfaced quantified pain, mapped 3 stakeholders, booked a scoping call. + expected_output: | + Scores 4–5 across axes; one refinement (confirm budget authority) and a reinforcing drill. Highlights the multi-threading as best practice. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gtm-enterprise-deal-mapper.yaml b/content/skills/gtm-enterprise-deal-mapper.yaml index 2f856dcf..df0bb2ec 100644 --- a/content/skills/gtm-enterprise-deal-mapper.yaml +++ b/content/skills/gtm-enterprise-deal-mapper.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent facts, customers, or competitor claims not grounded in the input. examples: - - title: Typical request + - title: Map a complex deal input: | - + $400k deal, 7 stakeholders, unclear who signs, one enthusiastic user. expected_output: | - + MEDDPICC map: identifies the user as a coach (not champion), names the missing economic buyer, marks decision process as Unknown (risk), and recommends a mobilizer play to reach power. + - title: Find the gap + input: | + Champion strong, but no access to the CFO with renewal in 60 days. + expected_output: | + Flags single-threaded risk, drafts a champion-led intro path to the economic buyer, and a business-case asset to justify the exec meeting. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gtm-mutual-action-plan-author.yaml b/content/skills/gtm-mutual-action-plan-author.yaml index 14a04ac9..5b8d6930 100644 --- a/content/skills/gtm-mutual-action-plan-author.yaml +++ b/content/skills/gtm-mutual-action-plan-author.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent facts, customers, or competitor claims not grounded in the input. examples: - - title: Typical request + - title: Draft a MAP input: | - + Mid-funnel enterprise deal targeting close in 8 weeks; needs security review + procurement. expected_output: | - + Milestones with owners and dates (technical validation, security review, procurement, signature), exit criteria per stage, and buyer-side owners named. Shareable, buyer-aligned format. + - title: Add a slipped milestone + input: | + Security review is 2 weeks late. + expected_output: | + Re-sequences downstream dates, flags the new close-date risk, and assigns a buyer-side owner with a specific unblock action. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gtm-partner-cosell-architect.yaml b/content/skills/gtm-partner-cosell-architect.yaml index 96f4068b..5f5479b1 100644 --- a/content/skills/gtm-partner-cosell-architect.yaml +++ b/content/skills/gtm-partner-cosell-architect.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent facts, customers, or competitor claims not grounded in the input. examples: - - title: Typical request + - title: Design a co-sell motion input: | - + AWS partner, overlapping ICP in fintech, want sourced + influenced pipeline. expected_output: | - + ICP overlap definition, 2 joint plays, deal-registration rules, influenced/sourced attribution, and a revenue-split governance table. Defines the QBR cadence. + - title: Resolve a deal conflict + input: | + Both teams claim the same account. + expected_output: | + Applies the registration-precedence rule, proposes a split, and updates governance so the conflict class can't recur. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gtm-pricing-packaging-strategist.yaml b/content/skills/gtm-pricing-packaging-strategist.yaml index 47f3515a..8b866c06 100644 --- a/content/skills/gtm-pricing-packaging-strategist.yaml +++ b/content/skills/gtm-pricing-packaging-strategist.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent facts, customers, or competitor claims not grounded in the input. examples: - - title: Typical request + - title: Design tiers input: | - + Flat $99/mo today; usage varies 10x across customers; margins thin on heavy users. expected_output: | - + Introduces a value metric (active seats or API calls), 3 tiers + usage overage, willingness-to-pay bands, and a margin guardrail on heavy users. Migration plan for existing customers. + - title: Add an enterprise tier + input: | + Large buyers want SSO, audit logs, SLA. + expected_output: | + Defines an Enterprise tier gating those features, a 'call us' motion, and the value metric anchor; models impact on ACV and margin. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gtm-product-launch-orchestrator.yaml b/content/skills/gtm-product-launch-orchestrator.yaml index 27f32afa..8cb3b69e 100644 --- a/content/skills/gtm-product-launch-orchestrator.yaml +++ b/content/skills/gtm-product-launch-orchestrator.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent facts, customers, or competitor claims not grounded in the input. examples: - - title: Typical request + - title: Tier-1 launch plan input: | - + Launching a major new product in 6 weeks across PLG + sales. expected_output: | - + Positioning + messaging, enablement (decks, battlecards, FAQ), channel plan (site, email, webinar, paid), and 30/60/90 success metrics with owners. Pre-launch readiness checklist. + - title: Right-size a small launch + input: | + Minor feature; don't over-invest. + expected_output: | + Recommends a Tier-3 motion (changelog + in-app + one email), skips the heavy enablement, and sets a single adoption metric. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gtm-renewal-risk-orchestrator.yaml b/content/skills/gtm-renewal-risk-orchestrator.yaml index d2a985ef..e60bb6a2 100644 --- a/content/skills/gtm-renewal-risk-orchestrator.yaml +++ b/content/skills/gtm-renewal-risk-orchestrator.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent facts, customers, or competitor claims not grounded in the input. examples: - - title: Typical request + - title: 120-day renewal motion input: | - + Enterprise renewal in 120 days, flat usage, champion engaged. expected_output: | - + 120/90/60/30 plan with risk signals to watch, a value-realization review at 90, exec sponsor trigger if usage dips, and a save play library mapped to each risk. + - title: Escalate a red renewal + input: | + 30 days out, usage dropped 50%, champion silent. + expected_output: | + Triggers exec sponsor + save play immediately, drafts the re-engagement message, and sets a go/no-go checkpoint at 2 weeks. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gx-amplitude-expert.yaml b/content/skills/gx-amplitude-expert.yaml index 53c406ae..b16ce47d 100644 --- a/content/skills/gx-amplitude-expert.yaml +++ b/content/skills/gx-amplitude-expert.yaml @@ -26,12 +26,16 @@ rules: - Invent metrics, benchmarks, or platform features that do not exist. - Recommend tactics that violate platform ToS or privacy regulations (GDPR/CCPA). examples: - - title: Trigger phrasing + - title: Design an event taxonomy input: | - Apply the amplitude skill to my project. + We track nothing consistently; want product analytics for a B2B SaaS. expected_output: | - - rationale: Skill matches the user's intent. + Defines a noun-verb event schema, core events (Signup, Activated, Feature Used) with properties, a naming convention, and a governance doc. Maps to an activation funnel chart + retention cohort. + - title: Build a retention chart + input: | + Show weekly retention of users who completed onboarding. + expected_output: | + Cohort = completed Onboarding; retention event = any core action; weekly granularity; explains N-day vs unbounded retention and which to use here. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gx-apollo-expert.yaml b/content/skills/gx-apollo-expert.yaml index 24a0931e..2d2140ac 100644 --- a/content/skills/gx-apollo-expert.yaml +++ b/content/skills/gx-apollo-expert.yaml @@ -26,12 +26,16 @@ rules: - Invent metrics, benchmarks, or platform features that do not exist. - Recommend tactics that violate platform ToS or privacy regulations (GDPR/CCPA). examples: - - title: Trigger phrasing + - title: Build an ICP search input: | - Apply the apollo skill to my project. + Target: US SaaS, 50-500 employees, VP Eng titles, recent funding. expected_output: | - - rationale: Skill matches the user's intent. + Apollo filters: location, employee range, technographics/keywords, seniority=VP + dept=Engineering, funding within 12mo. Saves as a list and notes credit-efficient enrichment order. + - title: Design a sequence + input: | + 5-touch outbound for the above ICP. + expected_output: | + Email-LinkedIn-email-call-breakup cadence over 12 business days, with personalization tokens and a reply-handling branch; warns against over-automation that risks domain reputation. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gx-clay-expert.yaml b/content/skills/gx-clay-expert.yaml index d7ea335a..79e3fd88 100644 --- a/content/skills/gx-clay-expert.yaml +++ b/content/skills/gx-clay-expert.yaml @@ -26,12 +26,16 @@ rules: - Invent metrics, benchmarks, or platform features that do not exist. - Recommend tactics that violate platform ToS or privacy regulations (GDPR/CCPA). examples: - - title: Trigger phrasing + - title: Enrichment table input: | - Apply the clay skill to my project. + From a list of company domains, find the VP Sales + verified email and score ICP fit. expected_output: | - - rationale: Skill matches the user's intent. + Clay table: domain → company enrich → find people (title filter) → waterfall email finder → ICP score formula → filter verified → push to outbound. Notes provider waterfall order for cost. + - title: Dedupe + push + input: | + Avoid pushing leads already in HubSpot. + expected_output: | + Adds a HubSpot lookup column, filters out matches, pushes only net-new with a source tag; explains the lookup key (email) and rate limits. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gx-cro-expert.yaml b/content/skills/gx-cro-expert.yaml index 51e9cdda..f5fabf51 100644 --- a/content/skills/gx-cro-expert.yaml +++ b/content/skills/gx-cro-expert.yaml @@ -26,12 +26,16 @@ rules: - Invent metrics, benchmarks, or platform features that do not exist. - Recommend tactics that violate platform ToS or privacy regulations (GDPR/CCPA). examples: - - title: Trigger phrasing + - title: Audit a landing page input: | - Apply the cro skill to my project. + Pricing page converts at 1.2%; high traffic, high bounce. expected_output: | - - rationale: Skill matches the user's intent. + Heuristic audit (clarity, friction, proof, CTA), 3 prioritized hypotheses ranked by ICE, and the first A/B test (headline + CTA) with a sample-size/duration estimate. + - title: Design an A/B test + input: | + Test removing the credit-card requirement on signup. + expected_output: | + Hypothesis, primary metric (activated signups, not just signups), guardrail metric (paid conversion), MDE + sample size, and a stop rule to avoid peeking. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gx-ga4-expert.yaml b/content/skills/gx-ga4-expert.yaml index d0b35c10..44733ec4 100644 --- a/content/skills/gx-ga4-expert.yaml +++ b/content/skills/gx-ga4-expert.yaml @@ -27,12 +27,16 @@ rules: - Invent metrics, benchmarks, or platform features that do not exist. - Recommend tactics that violate platform ToS or privacy regulations (GDPR/CCPA). examples: - - title: Trigger phrasing + - title: Track a conversion input: | - Apply the google-analytics skill to my project. + Mark 'demo_request' form submit as a GA4 conversion via GTM. expected_output: | - - rationale: Skill matches the user's intent. + GTM: trigger on form submit, GA4 event tag 'demo_request' with params, then mark as key event in GA4. Verifies in DebugView and notes the 24h conversion-flag delay. + - title: BigQuery export + input: | + Send GA4 data to BigQuery for SQL analysis. + expected_output: | + Links GA4 → BigQuery (daily + streaming), explains the events_ table schema and a sample query for funnel steps; notes cost and PII exclusion. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gx-growth-strategist.yaml b/content/skills/gx-growth-strategist.yaml index 75fb2a0a..c8f73737 100644 --- a/content/skills/gx-growth-strategist.yaml +++ b/content/skills/gx-growth-strategist.yaml @@ -26,12 +26,16 @@ rules: - Invent metrics, benchmarks, or platform features that do not exist. - Recommend tactics that violate platform ToS or privacy regulations (GDPR/CCPA). examples: - - title: Trigger phrasing + - title: Pick a north-star input: | - Apply the growth skill to my project. + PLG productivity app, unclear what to optimize. expected_output: | - - rationale: Skill matches the user's intent. + Recommends 'weekly active teams completing a core action' over signups, maps the AARRR funnel, and proposes the first 3 experiments ranked by ICE. + - title: Diagnose a funnel drop + input: | + Signups up 30% but activation flat. + expected_output: | + Isolates the activation step losing users, forms a hypothesis (onboarding friction), and designs the test + metric to confirm before building. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gx-hubspot-expert.yaml b/content/skills/gx-hubspot-expert.yaml index bedf50ce..a33acd12 100644 --- a/content/skills/gx-hubspot-expert.yaml +++ b/content/skills/gx-hubspot-expert.yaml @@ -26,12 +26,16 @@ rules: - Invent metrics, benchmarks, or platform features that do not exist. - Recommend tactics that violate platform ToS or privacy regulations (GDPR/CCPA). examples: - - title: Trigger phrasing + - title: Lifecycle + scoring input: | - Apply the hubspot skill to my project. + Set lifecycle stages and lead scoring for inbound demo requests. expected_output: | - - rationale: Skill matches the user's intent. + Defines stages (Lead→MQL→SQL→Opp), a scoring model (fit + behavior), a workflow to set MQL at threshold and rotate to a rep, and a dashboard for stage conversion. + - title: Dedupe automation + input: | + Inbound creates duplicate contacts. + expected_output: | + Workflow + dedupe property keyed on email, merge rules, and a guard to prevent re-creation from forms; reports the cleanup query. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gx-lifecycle-email-expert.yaml b/content/skills/gx-lifecycle-email-expert.yaml index 628407b1..44d70101 100644 --- a/content/skills/gx-lifecycle-email-expert.yaml +++ b/content/skills/gx-lifecycle-email-expert.yaml @@ -26,12 +26,16 @@ rules: - Invent metrics, benchmarks, or platform features that do not exist. - Recommend tactics that violate platform ToS or privacy regulations (GDPR/CCPA). examples: - - title: Trigger phrasing + - title: Onboarding journey input: | - Apply the lifecycle skill to my project. + New trial users; want activation in 14 days. expected_output: | - - rationale: Skill matches the user's intent. + Behavior-triggered 5-email journey (welcome → first value → tips → social proof → trial-ending), each tied to an in-app milestone with a skip-if-activated branch; primary metric = activation. + - title: Win-back + input: | + Re-engage users inactive 30+ days. + expected_output: | + 3-step win-back with a value reminder, an incentive, and a sunset/suppress step to protect deliverability; defines the re-activation metric. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gx-mixpanel-expert.yaml b/content/skills/gx-mixpanel-expert.yaml index d5f04bd4..56a625e5 100644 --- a/content/skills/gx-mixpanel-expert.yaml +++ b/content/skills/gx-mixpanel-expert.yaml @@ -25,12 +25,16 @@ rules: - Invent metrics, benchmarks, or platform features that do not exist. - Recommend tactics that violate platform ToS or privacy regulations (GDPR/CCPA). examples: - - title: Trigger phrasing + - title: Tracking plan input: | - Apply the mixpanel skill to my project. + Implement a Mixpanel tracking plan for a checkout flow. expected_output: | - - rationale: Skill matches the user's intent. + Defines events (Checkout Started/Step Viewed/Purchased) with properties, identity management (identify on login), and a funnel + drop-off Board. Notes naming governance. + - title: Retention board + input: | + Measure week-over-week retention for buyers. + expected_output: | + Retention report: born event = Purchased, return event = any core action, weekly; explains addressable vs full retention and which fits. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gx-outbound-cadence-expert.yaml b/content/skills/gx-outbound-cadence-expert.yaml index 4ca2084e..5cf1c2e8 100644 --- a/content/skills/gx-outbound-cadence-expert.yaml +++ b/content/skills/gx-outbound-cadence-expert.yaml @@ -26,12 +26,16 @@ rules: - Invent metrics, benchmarks, or platform features that do not exist. - Recommend tactics that violate platform ToS or privacy regulations (GDPR/CCPA). examples: - - title: Trigger phrasing + - title: Multi-channel cadence input: | - Apply the outbound skill to my project. + 12-day cadence for VP Eng across email, LinkedIn, phone, video. expected_output: | - - rationale: Skill matches the user's intent. + Day-by-day touches with channel + purpose, personalization at the open and breakup, and a reply branch; caps daily volume to protect domain reputation. + - title: Improve reply rate + input: | + Current cadence gets 2% replies, all-email. + expected_output: | + Adds LinkedIn + a video touch, rewrites the opener to a specific trigger, shortens emails; sets reply-rate as the metric and an A/B on subject lines. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gx-paid-ads-expert.yaml b/content/skills/gx-paid-ads-expert.yaml index 0c4525f9..7c9f6c5d 100644 --- a/content/skills/gx-paid-ads-expert.yaml +++ b/content/skills/gx-paid-ads-expert.yaml @@ -26,12 +26,16 @@ rules: - Invent metrics, benchmarks, or platform features that do not exist. - Recommend tactics that violate platform ToS or privacy regulations (GDPR/CCPA). examples: - - title: Trigger phrasing + - title: Launch a Meta campaign input: | - Apply the paid-ads skill to my project. + B2B SaaS, $10k/mo, goal = demo requests. expected_output: | - - rationale: Skill matches the user's intent. + CBO campaign, 2-3 ad sets by audience (lookalike, interest, retargeting), 3 creatives each, conversion event = demo_request, and a learning-phase-aware budget ramp. Defines target CPA. + - title: Scale a winner + input: | + One ad set hits target CPA; scale without breaking it. + expected_output: | + Recommends +20% budget every 48–72h or duplicate-and-broaden, avoids resetting learning, and watches frequency for fatigue. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/gx-seo-technical-expert.yaml b/content/skills/gx-seo-technical-expert.yaml index 46ac8dc4..c1ae7666 100644 --- a/content/skills/gx-seo-technical-expert.yaml +++ b/content/skills/gx-seo-technical-expert.yaml @@ -26,12 +26,16 @@ rules: - Invent metrics, benchmarks, or platform features that do not exist. - Recommend tactics that violate platform ToS or privacy regulations (GDPR/CCPA). examples: - - title: Trigger phrasing + - title: Crawl/index audit input: | - Apply the seo skill to my project. + Pages aren't getting indexed; traffic flat. expected_output: | - - rationale: Skill matches the user's intent. + Checks robots.txt, canonical/noindex, sitemap submission, crawl stats, and JS-rendering; returns a prioritized fix list (indexability first) with expected impact. + - title: Core Web Vitals + input: | + LCP is 4.2s on mobile. + expected_output: | + Diagnoses the LCP element, recommends image preload + format + size, server response and render-blocking fixes, and a re-measure plan in CrUX/Lighthouse. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/huggingface-models-expert.yaml b/content/skills/huggingface-models-expert.yaml index 51b1c663..4cd66b59 100644 --- a/content/skills/huggingface-models-expert.yaml +++ b/content/skills/huggingface-models-expert.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent APIs, URLs, or facts not grounded in the input. examples: - - title: Typical request + - title: Pick + run a model input: | - + Need on-device English sentiment classification, low latency. expected_output: | - + Recommends a distilled model (e.g. distilbert-sst2), shows a transformers pipeline snippet, quantization for latency, and notes license + size tradeoffs vs an API. + - title: Deploy an endpoint + input: | + Serve a fine-tuned model with autoscaling. + expected_output: | + Inference Endpoints config (instance, autoscale to zero), a request example, and cost/cold-start notes; suggests TGI for LLMs. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/llm-finetuning-strategist.yaml b/content/skills/llm-finetuning-strategist.yaml index b9442d34..bb88261a 100644 --- a/content/skills/llm-finetuning-strategist.yaml +++ b/content/skills/llm-finetuning-strategist.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent APIs, URLs, or facts not grounded in the input. examples: - - title: Typical request + - title: Choose a method input: | - + 1k labeled support replies; want on-brand tone on a 7B model, small budget. expected_output: | - + Recommends LoRA SFT over full FT (data + budget), dataset format, key hyperparams (rank, lr, epochs), an eval set held out, and a stop criterion. Flags DPO as a later step if preference data appears. + - title: SFT vs DPO vs RLHF + input: | + When should I use DPO instead of SFT? + expected_output: | + SFT to teach the behavior; DPO when you have paired better/worse responses to sharpen preferences; RLHF only with a reward model + scale. Recommends SFT→DPO for most teams. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/meta-ads-optimizer.yaml b/content/skills/meta-ads-optimizer.yaml index 69996f9b..239edd3b 100644 --- a/content/skills/meta-ads-optimizer.yaml +++ b/content/skills/meta-ads-optimizer.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent APIs, URLs, or facts not grounded in the input. examples: - - title: Typical request + - title: Audit a messy account input: | - + 20 ad sets, overlapping audiences, CPA rising. expected_output: | - + Flags audience overlap and learning-phase fragmentation, consolidates to CBO with fewer ad sets, fixes the conversion event/attribution window, and proposes a creative refresh. Lists changes by impact. + - title: Diagnose rising CPA + input: | + CPA doubled over 2 weeks on a stable budget. + expected_output: | + Checks frequency/fatigue, audience saturation, and attribution changes; recommends new creative + audience expansion and a controlled test rather than knee-jerk budget cuts. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/pcap-triage-analyst.yaml b/content/skills/pcap-triage-analyst.yaml index 75eeaa80..c70e484b 100644 --- a/content/skills/pcap-triage-analyst.yaml +++ b/content/skills/pcap-triage-analyst.yaml @@ -73,6 +73,7 @@ compatibility: - { runtime: gemini, status: supported } scopes: [agent:upgrade, registry:read] tags: [security, network-forensics, pcap, wireshark, dfir, threat-hunting, mitre-attack] +x_security_research: true license: Apache-2.0 authors: ["super-agent-skill ", "Anthropic-Cybersecurity-Skills (mukul975) — upstream, Apache-2.0"] created_by: Adapted from mukul975/Anthropic-Cybersecurity-Skills (Apache-2.0) diff --git a/content/skills/rag-system-architect.yaml b/content/skills/rag-system-architect.yaml index 69686798..90a85c90 100644 --- a/content/skills/rag-system-architect.yaml +++ b/content/skills/rag-system-architect.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent APIs, URLs, or facts not grounded in the input. examples: - - title: Typical request + - title: Design a RAG pipeline input: | - + Q&A over 50k internal docs; answers must cite sources. expected_output: | - + Chunking (structure-aware, ~512 tok + overlap), embedding model choice, vector store, hybrid (BM25 + dense) retrieval, a reranker, and citation-enforcing prompt. Defines an eval set with retrieval@k + faithfulness. + - title: Fix poor recall + input: | + Retrieval misses obviously relevant docs. + expected_output: | + Adds hybrid search + reranking, revisits chunk size/overlap, and checks embedding/domain mismatch; measures retrieval@k before/after instead of eyeballing. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/stripe-payments-expert.yaml b/content/skills/stripe-payments-expert.yaml index b93017b2..3838621f 100644 --- a/content/skills/stripe-payments-expert.yaml +++ b/content/skills/stripe-payments-expert.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent APIs, URLs, or facts not grounded in the input. examples: - - title: Typical request + - title: Subscriptions + webhook input: | - + Add monthly subscriptions with a 14-day trial and handle cancellations. expected_output: | - + Checkout Session in subscription mode with trial_period_days, then a webhook handler for customer.subscription.updated/deleted to sync entitlement. Verifies the signature and is idempotent on event id. + - title: Avoid double-fulfillment + input: | + Webhook sometimes fires twice. + expected_output: | + Persists processed event ids and no-ops on replay; relies on checkout.session.completed for fulfillment, not client redirects; notes test-clock testing. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/vercel-deploy-expert.yaml b/content/skills/vercel-deploy-expert.yaml index 74e79ce8..f1b76446 100644 --- a/content/skills/vercel-deploy-expert.yaml +++ b/content/skills/vercel-deploy-expert.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent APIs, URLs, or facts not grounded in the input. examples: - - title: Typical request + - title: Build fails on deploy input: | - + Works locally, fails on Vercel with 'module not found'. expected_output: | - + Checks case-sensitive imports (Linux build), missing dependency vs devDependency, and Node version mismatch; prescribes the fix and a clean reproduce via `vercel build` locally. + - title: Configure ISR + input: | + Cache a product page but revalidate every 60s. + expected_output: | + Sets `revalidate: 60` (or route segment config), explains stale-while-revalidate behavior and on-demand revalidation for instant updates; warns about per-path cache costs. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported } diff --git a/content/skills/viral-short-video-writer.yaml b/content/skills/viral-short-video-writer.yaml index cc22c268..b0d0eb61 100644 --- a/content/skills/viral-short-video-writer.yaml +++ b/content/skills/viral-short-video-writer.yaml @@ -13,11 +13,16 @@ rules: must_not: - Invent APIs, URLs, or facts not grounded in the input. examples: - - title: Typical request + - title: Hook-first Reel script input: | - + Topic: 'why your morning coffee is sabotaging your focus'; 30s. expected_output: | - + 0-3s hook ('Stop drinking coffee first thing — here's why'), 3-20s 3 timed beats with b-roll cues, 20-27s payoff, 27-30s CTA. Includes 2 alt hooks and a CTA variant. + - title: Rework a flat script + input: | + Existing script opens with 'Hi guys, today I want to talk about...'. + expected_output: | + Replaces the slow open with a pattern-interrupt hook, tightens beats to retention-friendly lengths, adds b-roll/text-overlay cues, and 2 hook A/B variants. compatibility: - { runtime: claude, status: supported } - { runtime: gpt, status: supported }