Review and refine the user's own writing so it reads as natural, native English while staying unmistakably his — fixing grammar and unnatural (Portuguese-influenced) phrasing, and stripping AI-generated patterns (overused vocabulary, formulaic structures, hype, hedging, sycophancy), then teaching the recurring mistakes. Trigger whenever the user shares a draft (blog post, .qmd, LinkedIn post, email, notes, any prose) and asks to review, polish, refine, proofread, "make it sound natural / more like me / less AI / less robotic", "fix my English", or "humanize this", whether the text is in a file or pasted into the prompt.
Scaffold a complete Quarto revealjs presentation for lopes.id from a rough outline, a talk brief, or an existing blog post. Use this skill whenever the user mentions a talk, deck, slides, presentation, keynote, conference, or says "turn this post into a talk," "scaffold a deck," "make slides for X," "reveal.js deck," "presentation from this post," or shares an outline and asks for a deck. This skill produces a `decks/<slug>/index.qmd` with duration-aware slide budgeting, correct front matter (tlp/duration/theme), the vigil-reveal theme wired in, and slide conventions (mono kicker, progressive code reveal, columns, iframed escape-hatch apps) applied. Always emits a slide budget and refuses to overfill.
Review and improve periodic career checkpoint notes (weekly impact, quarterly performance, yearly review, or CV updates). Use this skill whenever the user shares a weekly note, quarterly review, yearly summary, or CV update for feedback. Also trigger when the user mentions "checkpoint," "weekly review," "quarterly review," "yearly review," "impact note," "career review," or asks for help writing or improving periodic self-assessment notes. This includes helping the user decide what to promote, cut, or reframe across checkpoint levels.
Analyse ingestion and detection timing for one or more Chronicle (Google SecOps) SOAR cases. Surface delays between event_timestamp → ingested_timestamp (ingestion delay) and ingested_timestamp → detection_timestamp (SIEM/rule-engine delay), and flag any `DETECTION_TIMING_DETAILS_*` tags on individual alerts (e.g. REPROCESSING, BACKFILL). Use whenever the user runs `/analyse-chronicle-delays <caseId> [<caseId>...]`, says "analyse delays in case <id>", "ingestion timing for case <id>", "why is case <id> slow", "check detection latency for cases <ids>", or shares one or more Chronicle case URLs with timing questions. Read-only by design: never closes cases, never posts comments.
Brutally honest CV / résumé review for a Lead Security Engineer. Use this skill whenever the user shares a CV draft (LaTeX, Typst, Markdown, or plain text) and asks for review, polish, or critical feedback. Also trigger when the user says "review my CV," "CV review," "review my résumé," "review my resume," "is my CV ok," "check my CV against best practices," or shares a Typst CV / LaTeX CV file for feedback. Specializes in senior-IC / engineering- leadership positioning, accomplishment-language bullets, credibility checks (CEFR/ILR mapping, future-dated achievements), and cross-referencing against the author's Master CV.md. For upstream weekly / quarterly / yearly career notes, use the review-checkpoint skill instead.
Analyse a Chronicle (Google SecOps) SOAR case and produce a tight, IR/SOC-grade summary with three sections: Analysis, Evidences, References. Use this skill whenever the user runs `/analyse-chronicle-case <caseId>`, says "analyse case <id>", "triage case <id>", "review SOAR case <id>", or shares a Chronicle case URL like `https://<tenant>.backstory.chronicle.security/cases/<id>/overview`. Read-only by design: never closes the case, never posts comments.
Audit and improve an Obsidian vault's organizational health: tag consistency, folder placement, naming conventions, and structural integrity. Use this skill whenever the user asks to review their Obsidian vault, check tags, audit note organization, find misplaced notes, clean up their knowledge base, or mentions "note guardian," "vault audit," "tag review," "obsidian cleanup," or "vault health." Also trigger when the user shares a vault tree listing, a note for placement advice, or asks where a note should live or how it should be tagged.
Scaffold a complete Detection-as-Code YAML rule from minimal input (logic + context). Use this skill whenever the user shares raw detection logic, a partial YAML rule, or messy notes about a detection idea and wants a full rule YAML generated. Also trigger when the user mentions "scaffold a rule," "generate rule YAML," "fill in my rule," "create a detection rule," "DaC template," or shares a YAML file with placeholder fields and asks to complete it. This skill infers metadata, MITRE mappings, deployment settings, and investigation guides from the logic and context provided.