Explorar skills

This skill should be used when selecting CrewAI built-in tools, composing agent toolchains, or creating production-ready custom tools with BaseTool or @tool, including schema validation, dependency management, caching, async support, and testing.

IaC misconfig scanning and cloud-aware review for Terraform, CloudFormation, Ansible and Pulumi. Covers tool orchestration (checkov/tfsec/kics/cfn-nag), policy-as-code (OPA/Conftest), CIS benchmark mapping, IAM over-permission detection, drift monitoring.

When the user shows signs of frustration, impatience, or dissatisfaction. Also use proactively to calibrate tone. Triggers on phrases like "this isn't working," "why does this keep," "I already told you," "again?!", "just do it," "stop," "wrong," "that's not what I asked," "are you even listening," or any swearing/ALL CAPS. Detects frustration signals and fundamentally changes approach — not just

Lightweight agent registry and JIT router. Consult BEFORE performing specialized work such as code review, security audit, debugging, refactoring, performance optimization, infrastructure, data analysis, API design, testing, documentation, or any domain-specific engineering task. Maps tasks to specialized subagents, downloading them on demand if not installed locally.

Promote the domain's feature flag from beta to stable (GA) and update Playwright tests to no longer require the flag. This is done in a dedicated GA PR with minimal changes. Trigger: "promote {Domain} to GA", "make {Domain} stable".

Update the installed doccraft skills and openspec instructions to the latest release. Reads the version stamp from doccraft.json, fetches the migration manifest via npx doccraft@latest llm, and either updates silently (dominant path — no migration entries) or summarises and gates on approval (assisted path — migration entries present). Never fabricates steps the manifest did not declare.

Rails security review — Brakeman integration, mass-assignment via strong_parameters, SQL injection in ActiveRecord, template injection via html_safe/raw, Devise hardening, credentials.yml.enc, force_ssl and CSP config, recent Rails/Rack CVE patterns.

Run a comprehensive production readiness audit. Use when a user wants to check if their project is ready for deployment. Covers security, visual QA, code quality, testing, error handling, configuration/build, performance, and accessibility.

Active Directory attack paths — BloodHound path analysis, Kerberos abuse (Kerberoasting/AS-REP roasting/silver/golden ticket classes), delegation flaws (unconstrained/constrained/RBCD), DCSync, ADCS ESC1-8 at pattern level, and Tier-0 hygiene as a defensive model.

Use when creating, testing, or updating active-recall flashcards grounded in session concepts to reinforce retention.

Refresh plugins previously installed by skills-toolkit by re-fetching their GitHub sources and presenting updated .plugin files to Cowork. Use when the user says "update my loaded skills", "refresh skills from github", "pull latest skills", "sync skills-toolkit plugins", "check for skill updates", or runs /skills-update. Identifies target plugins via the skills-toolkit keyword marker embedded in p

Structured thinking skill. Merges ideation, systems analysis, critical reasoning, and convergent planning. Use when a user needs to explore and narrow a vague idea, challenge assumptions, compare approaches, or converge on a practical next move in the same pass. Do not use when sustained divergence alone is the goal or when a candidate plan already exists and needs adversarial stress-testing.