Menu
Check content/ mql.yaml query packs for usage of deprecated resources or fields from .lr definitions
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Verify mql provider resource/field changes against real cloud infrastructure. Given a pull request or a commit range, this provisions Terraform infra in the affected cloud(s), runs mql queries against every new or changed resource and field, reports the hourly cost (pausing for approval above $2/hr), opens a fix PR for any provider bugs it uncovers, and tears the infrastructure back down. Use this whenever someone wants to test, verify, smoke-test, or "prove out" a provider PR or a range of commits against live cloud APIs — e.g. "verify PR #7701 works", "spin up infra to test the new GCP resources", "check the azure changes against real infrastructure", "test resources changed between these commits". Trigger it even when the user only says "test this PR" in the context of an mql provider change.
Scaffold a new mql provider. Use when the user wants to create a new provider, bootstrap a provider, or add a new integration target (e.g., "create a provider for Datadog", "scaffold a new provider", "add a new provider").
Bump Microsoft Azure SDK Go dependencies in the azure provider to their latest stable major versions, audit CHANGELOGs for breaking changes and deprecations, and patch our call sites. Triggers on requests like "update azure deps", "bump azure SDK versions", "upgrade azure provider dependencies", "check for new azure SDK majors".
Add staged discovery support to a provider. Use when the user wants to implement staged/phased discovery, break down discovery into stages, add OptionStagedDiscovery support, or optimize a provider's memory usage during discovery. Triggers on requests like "add staged discovery to gcp", "implement staged discovery for aws", "break down discovery for <provider>", or "optimize <provider> discovery".
Release mql providers by bumping their versions. Use when the user wants to release providers, bump provider versions, check which providers have changes, or prepare a provider release PR. Triggers on requests like "release providers", "bump provider versions", "check provider changes", "release aws provider", or "prepare provider release".
| name | check-querypack-deprecations |
| description | Check content/ mql.yaml query packs for usage of deprecated resources or fields from .lr definitions |
| disable-model-invocation | true |
| argument-hint | [path-to-mql-yaml (optional, defaults to all)] |
Audit MQL query pack files (*.mql.yaml in content/) against the provider .lr resource definitions to find queries that reference deprecated resources or fields.
Search all providers/*/resources/*.lr files for comments containing "Deprecated" (case-insensitive). For each match, extract:
microsoft.organizations)createdTime)Use Grep to find lines with // Deprecated or / Deprecated in .lr files, then read surrounding context to get the resource/field names.
$ARGUMENTS is provided, check only that file*.mql.yaml files under content/Read each mql.yaml file and examine every mql: block. Check if any deprecated resource name or field appears in the query string. Be thorough:
microsoft.organizations.createdTime, .vpcId, .staticWebsiteHostingcreatedTime on aws.s3.bucket would appear as something accessing .createdTime in a query that operates on s3 bucketsFor each deprecated usage found, report in a markdown table:
If no deprecated usage is found, say so.
Do NOT make any changes to files. This skill is read-only — it only reports findings.