plugins

Use this skill when implementing a Figma design as code (design → code) — the read-FROM-Figma direction. Triggers: 'implement this Figma design', 'build this screen from Figma', 'turn this Figma into code', 'code this up from Figma', 'design to code', or a figma.com design URL provided alongside a codebase. Encodes the workflow for reading a node out of Figma with get_design_context and adapting its reference output to the target project — reusing existing components, tokens, and conventions, and honoring Code Connect mappings, component docs, design annotations, and design tokens by priority. Complements figma-code-connect (component mapping) and figma-generate-design / figma-use (the reverse, code → design direction).

Use when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and calibrate severity. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path Codex Security scan. Run repeated independent discovery passes over one resolved scope with worker-specific threat models, semantically merge candidates, synthesize one canonical validation threat model, then run validation, attack-path analysis, canonical JSON completion, and generated reporting once. Do not use for PRs, commits, branch diffs, or working-tree diffs.

Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Use when the user explicitly asks to fix and verify a validated or plausible security finding. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Develop evidence-backed structural and architectural security hardening proposals from vulnerability disclosures, supplied findings, incident or assessment documents, source code, or a completed Codex Security scan. Use when a user asks for systemic improvements, alternatives beyond per-finding patches, before-and-after security architecture views, engineering tradeoff analysis, or an implementation-ready plan for a selected hardening option. Also use automatically after a Codex Security scan with reportable findings when the top-level scan workflow requests final-report hardening guidance.

Use when the user asks for a security review of a pull request, commit, branch diff, working-tree patch, or other Git-backed change set.

Use for a standard, single-pass security audit of an entire repository or a scoped path, package folder, or submodule with no diff to review. This is the default repository scan. Do not use for PR/commit/branch/working-tree diffs, or for deep, multi-pass, or variance-reducing scans.

Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Track validated Codex Security findings in Linear, Jira, GitHub issues, or draft GitHub security advisories. Use it for one finding or an explicitly selected batch of up to 25 findings tracked as Linear, Jira, or GitHub issues. Includes duplicate checks, exact previews, approval-gated writes, and readback. Do not use it for scans or fixes.

Use when the user supplies or imports existing security findings, vulnerability reports, or security/vulnerability Jira/Linear tickets from scanners, advisories, GitHub, Atlassian Rovo, Linear, or similar backlog sources and wants static repo-impact triage. Do not use for discovery, duplicate-bug triage, validation, or fixes.

Use when Codex is already in the validation phase of a security scan or the user explicitly asks to determine whether one or more candidate security findings are valid. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Write up vulnerabilities from disclosure documents, rough notes, supplied findings, PoCs, source code, or Codex Security scan output into polished, self-contained, source-backed reports. Use for one vulnerability or a disclosure campaign; a Codex Security scan is optional.

Produce an Earnings Call Summary HTML report for 2–5 companies using Moody's GenAI MCP tools. Use this skill whenever the user asks to summarize earnings calls, generate an earnings call summary, analyze earnings transcripts across peers, or create an earnings call report. Trigger even if they just name companies and mention "earnings" or "transcript".

Produce a Peer Analysis HTML report for a target company and its credit peers using Moody's GenAI MCP tools. Use this skill whenever the user asks to compare a company against its peers, run a peer analysis, do a credit peer comparison, generate a peer group report, or analyze relative credit positioning. Trigger even if they just name a company and mention "peers", "peer comparison", "credit comparison", "peer group", or "relative value".

Produce a Rating Pitch Report for a company using Moody's GenAI MCP tools, delivered as a self-contained HTML file saved to disk. Use this skill whenever the user asks to create a rating pitch, rating pitch deck, credit pitch, rating presentation, rating pitch report, or rating HTML report. Also trigger when they ask for a comprehensive credit overview combining sector analysis, company financials, SWOT, peer comparison, and ESG into a single report or presentation. Trigger even if they just name a company and say "pitch deck", "rating deck", "credit deck", or "rating report".

Produce a Sector Brief HTML report for any industry sector using Moody's GenAI MCP tools and web research. Use this skill whenever the user asks to analyze a sector, write a sector report, do an industry analysis, create a sector overview, or generate a sector deep-dive. Trigger even if they just name a sector and mention "analysis", "overview", "outlook", "report", or "deep-dive". Also trigger for phrases like "what's happening in the retail sector" or "give me a sector breakdown for aerospace".

Canonical rules and HTML/CSS contract for inline `[n]` citation references, end-of-document Citations blocks, and optional per-section citation recaps used across Moody's Agentic Solutions HTML report skills (earnings-brief, peer-analysis, issuer-brief, sector-brief, etc.). Parent skills must read BOTH this `SKILL.md` (rules, numbering, hyperlink behavior, source data shape) AND `assets/template.html` (canonical CSS block + literal HTML markup snippets) before emitting citations. The asset file is the single source of truth for the visual/markup implementation; this `SKILL.md` is the single source of truth for the authoring rules. Triggers when the user asks about citations, sources, references, footnotes, hyperlinking [n] markers, or the Sources/Citations block in any HTML report skill.

Canonical rules and HTML/CSS contract for the page chrome (head boilerplate, cover, table of contents, section block, sources-section wrapper, footer, outlook-badge, design tokens) shared across Moody's Agentic Solutions HTML report skills (earnings-call-summary, peer-analysis, public-information-book, sector-analysis, etc.). Sibling of `skills/shared/citations/` using the same inlining pattern. Parent skills must read BOTH this `SKILL.md` (authoring rules: shared-layer classes, allowed per-skill overrides, outlook-badge usage) AND `assets/template.html` (canonical CSS + literal HTML snippets) before emitting any report. The asset is the source of truth for markup; this file is the source of truth for rules. Triggers on questions about the template, page chrome, cover, table of contents, footer, layout, design tokens, color palette, fonts, outlook badges, or any visual scaffolding of an HTML report skill.

Use when the user wants to spin up / create / launch / provision a DigitalOcean droplet (or "a remote dev box on DO") and connect to it from Codex as a remote SSH workspace.

Search through Microsoft Teams chats or channels, triage unread or recent activity, draft follow-ups, and manage Planner tasks through connected Teams data.

Produce a comprehensive Issuer Brief HTML report for a company using Moody's GenAI MCP tools. Use this skill whenever the user asks to create an Issuer Brief, company profile report, credit memo, investment book, or comprehensive company analysis. Also trigger when they ask for a report combining company overview, financials, peer comparison, industry overview, strategic developments, management, credit profile, risks, and ESG into a single document. Trigger even if they just name a company and say "Issuer Brief", "info book", "company book", "credit book", or "full company report".

Use when calling Replay QA's REST API directly from Codex. Covers bearer-token setup, Replay recording prerequisites, project creation from Replay recordings or target URLs, polling, bug retrieval, journeys, test runs, explorations, and fix workflow discipline.

Use when you need to record or inspect an agent browser run in Replay, test a local app with the host agent browser using Replay Chromium, or use the Replay MCP server for deeper debugging of an uploaded recording.

Boltz job status and result recovery. Use when listing jobs, checking progress, resuming downloads, recovering results, or downloading an existing job ID. Not for starting new jobs.

Boltz CLI setup and auth. Use when installing, updating, verifying, or authenticating `boltz-api`, or fixing missing CLI, PATH, sandbox, browser login, or auth errors.

Design new protein binders with Boltz. Use when generating protein, peptide, antibody, nanobody, or custom binder candidates for a target. Not for screening existing proteins or small molecules.

Screen existing protein binders with Boltz. Use when ranking a supplied protein, peptide, antibody, nanobody, or binder library against a target. Not for designing new proteins or screening small molecules.

Predict Tier-1 ADME/ADMET for small molecules with Boltz from bare SMILES — no target, no docking. Use when the user wants solubility, permeability, or lipophilicity/logD for a molecule or list of molecules. Not for ranking molecules against a protein target (use boltz-small-molecule-screen, which already returns ADME free).

Design new small-molecule binders with Boltz. Use when generating novel ligands or hits for a target without a fixed compound library. Not for screening existing molecules or one-off docking.

Screen existing small-molecule libraries with Boltz. Use when docking, scoring, or ranking a supplied SMILES or compound library against a target; also returns free Tier-1 ADME/ADMET (solubility, permeability, lipophilicity/logD) per molecule. Not for de novo molecule design, one-off docking, or ADME on bare SMILES with no target (use boltz-small-molecule-adme).

Predict structures and binding for one defined complex with Boltz. Use when folding a protein, RNA, DNA, or ligand complex, docking one ligand, predicting an interface, or scoring binding. Not for screening libraries or design.

Bulk Q&A Answers skill for Datasite deal rooms. Use this skill whenever a sell-side deal team wants to answer multiple buyer questions at once, generate AI draft responses from VDR content, produce a Q&A tracker spreadsheet, or build a Q&A management dashboard. Triggers include: "answer the Q&A", "draft responses to buyer questions", "process the question list", "generate Q&A tracker", "answer all questions", "bulk answer", "Q&A management dashboard", "respond to diligence questions", or any request to systematically work through a list of buyer questions using data room content as the source. Use this skill proactively whenever a buyer has submitted questions and the deal team wants AI-assisted drafting. Do not use for individual one-off questions outside a structured Q&A process. Do not draft answers from general knowledge — all responses must come from the data room.

Document Quality Check skill for Datasite deal rooms. Use this skill whenever a deal team wants to audit document quality before going live to buyers. Triggers include: "check document quality", "flag bad documents", "find password protected files", "check for blank documents", "PII check", "redaction review", "find corrupted files", "document audit", "quality check the data room", "are there any blank or broken files", "check for unredacted personal data", or any request to verify that documents in the data room are complete, accessible, and safe to share. Use this skill proactively before a data room goes live. Do not use for renaming files (use smart-file-renaming) or for identifying missing sections (use gap-analysis).

Data Room Gap Analysis skill for Datasite deal rooms. Use this skill whenever a sell-side deal team wants to audit what is missing, sparse, or incomplete in their data room before going live to buyers. Triggers include: "run a gap analysis", "what's missing from the data room", "check the data room coverage", "flag empty folders", "what haven't we uploaded yet", "data room readiness check", "find gaps before we go live", "are all the contracts in there", "check we have everything", or any request to assess completeness of the data room by section. Use this skill proactively whenever a deal team is preparing to launch a data room and wants to know what still needs to be uploaded or organised. Do not use for document quality issues such as PII or redaction (use document-quality-check), or for drafting Q&A responses (use bulk-qa-answers).

Information Request List (IRL) Tracker skill for Datasite deal rooms. Use this skill whenever a deal team wants to compare VDR content against a buyer's information request list, track document delivery status, or build a due diligence tracker dashboard. Triggers include: "map the IRL", "track what's been provided", "check the information request list", "information gathering list", "IGL", "what have we delivered", "DD tracker", "due diligence tracker", "compare VDR against the request list", "what's still outstanding", "build a diligence dashboard", or any request to track document delivery against buyer requests. Use proactively whenever a buyer has submitted a request list and the deal team needs to manage and track responses. Do not use for overall data room structural gap analysis — use gap-analysis for that.

Launch Readiness Orchestrator skill for Datasite deal rooms. Use this skill whenever a deal team wants a single pre-go-live readiness check across their data room — combining gap analysis, document quality audit, and risk review into one consolidated "is the room ready?" view. Triggers include: "are we ready to go live", "launch readiness check", "pre-launch audit", "data room readiness", "can we launch", "is the data room ready", "run a full readiness check", "go-live checklist", "pre-launch checklist", or any request to get a single overall assessment before opening the data room to buyers. Use proactively whenever a deal team is approaching their go-live date and wants a structured sign-off view. Do not use other individual audit skills (gap-analysis, document-quality-check, risk-analysis-audit) when this skill is active — this skill orchestrates all three in one pass.

Risk Analysis Audit skill for Datasite deal rooms. Use this skill whenever a sell-side deal team wants to audit, review, or flag risks across a data room before going live. Triggers include: "run a risk audit", "flag risks in the data room", "risk review", "what are the risks in this deal", "audit the data room", "risk analysis", "flag issues before we go live", "what should we fix before launch", or any request to analyse deal risk by workstream (Tax, Finance, Legal, HR, IP, Commercial, Regulatory, ESG). Use this skill proactively whenever the user is preparing a data room for launch and wants a structured view of what might concern a buyer. Do not use for document quality issues like PII or redaction (use document-quality-check), or for identifying missing sections (use gap-analysis).

Smart File Renaming skill for Datasite deal rooms. Use this skill whenever a deal team wants to standardise document names, clean up scanned file names, normalise naming across similar document types, or improve the professionalism of the data room before going live. Triggers include: "rename the files", "clean up the file names", "standardise naming", "the file names are a mess", "fix the document names", "rename scanned documents", "make the naming consistent", "tidy up the data room", or any request to improve, clean, or normalise document naming across a Datasite project. Never apply any rename without explicit user confirmation. Do not use for document quality or PII checks — use document-quality-check for that. Never rename files without explicit user confirmation.

VDR Index Setup skill for Datasite deal rooms. Use this skill whenever a user wants to create, propose, design, or set up a Virtual Data Room (VDR) index or folder structure for a deal. Triggers include: "set up a data room", "create a VDR index", "build a deal room structure", "prepare the index", "set up the fileroom", "I need a data room for [deal/company]", or any request to organise or structure documents for due diligence. Also triggers when a user wants to replicate an existing deal room structure or import an index from a spreadsheet or reference deal. This skill MUST be used whenever the user is starting a new deal room or wants to customise the folder hierarchy before documents are uploaded. Do not use to audit or review an existing data room — use gap-analysis, document-quality-check, or risk-analysis-audit for that.