sigil

Automated security auditing for AI agent code. Scans repos, packages, MCP servers, and installed skills for malicious patterns using eight-phase analysis: install hooks, dangerous code patterns, network exfiltration, credential access, obfuscation, provenance, prompt injection, and skill security. Use when: cloning repos, installing packages, reviewing MCP servers, auditing skills, scanning code before execution, or when asked to check if something is safe, audit code, scan for malware, review dependencies.

Act as a brutally honest McKinsey-level strategy consultant to diagnose the real underlying problems hurting a business's growth, profitability, or traction. Use this skill whenever someone asks to diagnose their business, wants honest feedback on why their business isn't growing, says things like 'what's wrong with my business', 'why isn't this working', 'roast my startup', 'tear apart my business', 'honest assessment', 'brutal feedback', 'diagnose my company', or asks for a strategy consultant perspective. Also trigger when users share a business description and ask what's holding them back.

Identify a founder's biggest blind spots — flawed assumptions, strategic misjudgments, and decisions that feel right but are damaging the business long-term. Use this skill whenever someone asks about their blind spots, wants to know what they're missing, says things like 'what am I not seeing', 'where am I wrong', 'challenge my assumptions', 'play devil's advocate on my business', 'what would I regret in 2 years', 'poke holes in my strategy', or asks for a fresh perspective from someone who's seen startups fail. Also trigger when a founder seems very confident and asks for feedback — confidence is often where blind spots hide.

Identify the single biggest bottleneck preventing faster business growth by examining the offer, audience targeting, distribution channels, messaging, pricing, and funnel structure. Use this skill whenever someone asks why they aren't growing faster, wants to find their growth bottleneck, says things like 'what's limiting our growth', 'why are we stuck', 'we've plateaued', 'growth has stalled', 'how do we grow faster', 'what's the constraint', 'find the bottleneck', 'why aren't we scaling', or describes a business that should be growing but isn't. Also trigger when a founder shares decent traction but frustration about pace.

Evaluate a business idea or offer through the lens of real market demand — is the problem truly painful, the solution compelling, and the positioning differentiated? Use this skill whenever someone asks for a market reality check, wants to validate a business idea, says things like 'is there a market for this', 'will people pay for this', 'is my idea viable', 'validate my concept', 'is this a real problem', 'market validation', 'demand check', 'would you buy this', or shares a new business concept and wants honest market feedback. Also trigger when someone is about to invest significant time or money into an unvalidated idea.

Analyze a product or service offer with ruthless objectivity to determine if the value proposition is strong enough to drive real demand. Use this skill whenever someone asks to evaluate their offer, test their value proposition, says things like 'is my offer good enough', 'rate my offer', 'test my pricing', 'is this compelling', 'would you buy this', 'critique my product', 'evaluate my service', 'offer teardown', 'value prop test', 'is my pricing right', or shares a product/service and wants to know if it will sell. Also trigger when someone is about to launch a new offer, restructuring their pricing, or struggling with low conversion rates that may be offer-related.

Perform a top-tier consulting firm strategic audit evaluating competitive positioning, value proposition clarity, defensibility, and scalability — identifying the weakest areas competitors could exploit. Use this skill whenever someone asks for a strategic audit, wants to evaluate competitive vulnerability, says things like 'audit my strategy', 'where are we vulnerable', 'can competitors beat us', 'strategic weaknesses', 'how defensible is my business', 'competitive vulnerability assessment', 'what would you attack if you were my competitor', 'SWOT analysis', 'strategic risk', or wants to understand how their business holds up under competitive pressure. Also trigger when a founder is preparing for investor due diligence or entering a market with well-funded incumbents.

Foundation skill. Loads project context from SOLUTION.md, BUSINESS-CONTEXT.md, and GTM specs. Auto-invoked by all growth and business-strategy skills before doing anything. Provides product identity, brand voice, buyer context, and GTM motion to every downstream skill. Never hardcodes business knowledge.

Produces content strategy and individual content pieces calibrated to a product's GTM motion. Covers SEO (traditional), AEO (AI search optimisation), and distribution. Reads business context and GTM spec first. Use for blog posts, LinkedIn content, GitHub documentation, technical write-ups, community posts.

Defines the correct metrics for a product's GTM motion and reviews actuals against thresholds. Reads the GTM spec. Produces a weekly metrics snapshot. Flags when leading indicators are below threshold. Use for weekly growth reviews.

Builds a precise Ideal Customer Profile for a product. Reads the GTM spec and BUSINESS-CONTEXT.md, then produces a detailed ICP document. Use before outreach, content, or launch work. Auto-invoked by outreach-engine.

Produces a launch checklist and sequencing plan for a product, calibrated to its GTM motion. Reads business context and GTM spec. Covers pre-launch, launch day, and 30-day post-launch. Use when preparing to ship or announce a product.

When the user wants to plan a product launch, feature announcement, or release strategy. Also use when the user mentions 'launch,' 'Product Hunt,' 'feature release,' 'announcement,' 'go-to-market,' 'beta launch,' 'early access,' 'waitlist,' 'product update,' 'how do I launch this,' 'launch checklist,' 'GTM plan,' or 'we're about to ship.' For ongoing marketing after launch, see marketing-ideas.

Produces B2B outreach sequences calibrated to the product's GTM motion and ICP. Reads business context, GTM spec, and ICP before writing a single word. Refuses to produce cold outreach for relationship-led motions (Operable, Smart Settle). Use for Sigil developer outreach, InstaIndex SEO community outreach.

When the user wants to create or update their product marketing context document. Also use when the user mentions 'product context,' 'marketing context,' 'set up context,' 'positioning,' 'who is my target audience,' 'describe my product,' 'ICP,' or 'ideal customer profile.' Use at the start of any new project before using other marketing skills — it creates the GTM context file that all other skills reference.

Tactical layout and data visualization patterns for building dashboards, analytics views, executive summaries, KPI displays, and any data-heavy UI. Use this skill whenever the user asks to build a dashboard, analytics page, metrics view, reporting UI, admin panel with data, or any interface that displays KPIs, charts, tables, or operational data. Also trigger when reviewing or improving an existing dashboard layout, or when the user mentions "dashboard", "metrics", "KPIs", "analytics", "data visualization", "charts", "reporting view", or "executive summary". Works alongside frontend-design (which handles aesthetics) — this skill handles information architecture and data presentation patterns specifically.

Generate or improve a project-specific data analysis skill by extracting tribal knowledge. Use when someone says "create a data context skill", "set up data analysis for our warehouse", "help me create a skill for our database", "generate a data skill", "add context about our data", "the skill needs more info about our tables", or wants Claude to understand their specific data warehouse, terminology, metrics, and common query patterns.

Build self-contained interactive HTML dashboards with Chart.js, dropdown filters, and professional styling. Use when someone asks to create a dashboard, build an interactive report, generate a shareable HTML file with charts and filters, or needs a visual data summary that works without a server.

Full Empathy Engine — evidence-grounded persona panel construction, synthetic interviews, and insight extraction. Use when the owner runs /discover, asks 'who is this for', 'build personas', 'create the panel', 'who should we interview', 'run discovery', 'empathy engine', or when a new product/Epic needs evidence-grounded understanding of human and AI agent consumers. NOT for bug fixes, tech debt, or incremental features within validated Epics. This is the heavyweight DISCOVER tool — for quick checks use /empathy instead.

Bridges insight statements to opportunity questions. Use when generating How Might We variants from insight statements, problem descriptions, or during brainstorming prep. Triggered by '/hmw', 'how might we', 'reframe as opportunities', 'generate HMW', 'opportunity framing'. Produces scoped variants for both human and AI agent consumers.

Mandatory adversarial persona that breaks sycophancy bias in synthetic interviews. Auto-activated during empathy-engine persona panel construction — cannot be omitted. Also triggered by 'hostile critic', 'stress test the concept', 'devil's advocate persona', 'what would the hater say', 'attack this idea'. Sources exclusively from negative evidence: 1-star reviews, complaint threads, churn reasons, rejection explanations.

Bias detection — identifies who is missing from the evidence base and what that absence means. Auto-triggered during /discover after persona panel construction. Also triggered by 'who is missing', 'silence audit', 'blind spots', 'bias check', 'who aren't we hearing from', 'who did we miss'. Cannot be skipped during full DISCOVER.

Enterprise infrastructure patterns for AWS VPC, ECS, and PrivateLink deployments

Security-focused differential code review analyzing git diffs in context of the broader codebase. Part of the Nomark Method Layer 2 security verification. Use whenever reviewing a PR, preparing to merge, or someone asks for a 'security review of this diff', 'review these changes for security', or 'is this PR safe to merge'.

Mandatory false positive gate review for security findings. Part of the Nomark Method Layer 2 verification. Use after security scans produce findings, when triaging vulnerability reports, or when someone asks 'is this a real issue', 'false positive check', 'triage these findings'.

Detect insecure default configurations, hardcoded credentials, fail-open security patterns, and dangerous defaults in code and config files. Part of the Nomark Method Layer 1 security scanning. Use whenever code is committed, config files change, or someone says 'check for secrets', 'credential scan', 'security defaults check', or 'are there any hardcoded keys'.

Multi-model independent security review — routes code to a second LLM for review without sharing the primary model's analysis. Part of the Nomark Method Layer 3 verification. Use for security-critical changes (auth, payment, PII, crypto, infra), when someone asks for 'second opinion', 'independent review', 'multi-model check', or when Layer 1/2 findings flag critical issues.

Identify error-prone APIs, dangerous configurations, and footgun designs in code. Part of the Nomark Method Layer 1 security scanning. Use whenever reviewing code for safety, someone asks 'is this code safe', 'dangerous patterns', 'footgun check', or when analyzing code that uses complex or risky APIs.

Audit the supply-chain threat landscape of project dependencies. Part of the Nomark Method Layer 1 security scanning. Use whenever dependency files change (package.json, requirements.txt, go.mod, Cargo.toml), someone adds a new dependency, or someone asks 'are our dependencies safe', 'dependency audit', 'supply chain risk'.

Analyze a Sigil scan finding and propose a code fix with explanation

Generate a Sigil sandbox policy YAML from scan results for secure agent execution

Review items in Sigil quarantine and help decide whether to approve or reject them. Use when scan results are available or when managing quarantined code.

Scan a pip or npm package before installation using Sigil. Use when installing dependencies, adding new packages, or when package behavior seems suspicious. Auto-invoke before pip install or npm install commands.

Scan a repository or directory for security threats using Sigil. Use when auditing AI agent code, reviewing cloned repositories, checking dependencies, or analyzing suspicious packages. Auto-invoke when users clone repos or install packages from untrusted sources.