DataDog

Generate the Agent Supply Chain newsletter by researching team activity on GitHub and Confluence, then creating a Confluence draft and Gmail draft

Give your AI agents something more useful than a prompt. Velocity through clarity.

Extract an Allium specification from an existing codebase. Use when the user has existing code and wants to distil behaviour into a spec, reverse engineer a specification from implementation, generate a spec from code, turn implementation into a behavioural specification, or document what a codebase does in Allium terms.

Run a structured discovery session to build an Allium specification through conversation. Use when the user wants to create a new spec from scratch, elicit or gather requirements, capture domain behaviour, specify a feature or system, define what a system should do, or is describing functionality and needs help shaping it into a specification.

Generate tests from Allium specifications. Use when the user wants to propagate tests, generate test files from a spec, write tests for a specification, create property-based tests, produce state machine tests, check test coverage against spec obligations, or understand what tests a specification requires.

Autonomously work on Jira backlog tickets, creating PRs and shepherding them to merge

Create a new Fx component using the modern def/fx/impl pattern (NOT legacy)

Add a new configuration field to the Datadog Agent (datadog.yaml)

Decide whether a release note is needed, and if so create or update a Reno fragment, following dd-trace-py's conventions (docs/releasenotes.rst).

Register a new environment variable / configuration option in dd-trace-py. Use whenever you add (or rename) a DD_*/_DD_*/OTEL_*/DATADOG_* environment variable so it is documented, validated, and tracked for cross-language feature parity. Covers supported-configurations.json, the generated _supported_configurations.py module, docs/configuration.rst, and the feature-parity registry hand-off.

dd-trace-py integration development guide. Use when creating, modifying, or debugging contrib integrations in the Python tracer. Covers the patch module system, context_with_data, context_with_event (new), registration, testing with riot, and common anti-patterns. LLM/AI integrations should use this skill for APM-side workflow only; use llmobs-integrations for LLMObs-specific lifecycle, extraction, streaming, and VCR guidance. Pin is DEPRECATED. Triggers: "dd-trace-py", "ddtrace", "contrib", "integration", "patch.py", "trace_handlers", "PATCH_MODULES", "context_with_data", "context_with_event", "TracingEvent", "VCR", "cassette", "generative-ai", "LLM integration", "riot", "riotfile", "suitespec", "new integration", "wrap", "unwrap".

dd-trace-py LLMObs integration development guide. Use when creating, modifying, or debugging LLMObs integrations for LLM/AI libraries in the Python tracer. Covers BaseLLMIntegration, stream handling, message extraction, token counting, tool call parsing, and VCR-based testing patterns. Triggers: "llmobs", "LLMObs", "BaseLLMIntegration", "llmobs_set_tags", "_llmobs_set_tags", "BaseStreamHandler", "submit_to_llmobs", "integration.trace", "LLM span", "VCR", "cassette", "anthropic", "openai", "google_genai", "claude_agent_sdk", "generative-ai", "LLM integration", "llmobs_enabled".

Native crash log analysis for dd-trace-py

Run targeted linting, formatting, and code quality checks on modified files. Use this to validate code style, type safety, security, and other quality metrics before committing. Supports running all checks or targeting specific checks on specific files for efficient validation.

Validate code changes by intelligently selecting and running the appropriate test suites. Use this when editing code to verify changes work correctly, run tests, validate functionality, or check for regressions. Automatically discovers affected test suites, selects the minimal set of venvs needed for validation, and handles test execution with Docker services as needed.

Diagnose and fix slow base venv build times caused by unnecessary recompilation of native extensions (CMake, Cython, Rust) across riot generate runs. Use when CI base venv builds are slow, when ext_cache isn't saving time, or when investigating warm build regressions.

Datadog API CLI with 49 command groups, 300+ subcommands. Skills and domain agents for monitoring, logs, APM, security, and infrastructure.

File GitHub issues to the right repository (pup CLI or plugin)

Datadog CLI (pup). OAuth2 auth with token refresh.

Load when investigating a specific flaky test. Gets history, failure pattern, and category, then recommends fix, quarantine, or escalate.

Load when investigating a failing PR CI pipeline or checking PR health. Attributes each CI failure as flaky, infra, or regression, proposes a targeted action, and reports code coverage.

Log management - search, pipelines, archives, and cost control.

Monitor management - create, update, mute, and alerting best practices.

Live Debugger - inspect runtime argument/variable values in production by placing log probes on methods. Use when asked what values a function receives, what parameters look like at runtime, or to capture live data from running services without redeploying.

Improve test coverage for shell features and commands using reference test suites from yash, GNU coreutils, and uutils/coreutils

Read PR review comments, evaluate validity, implement fixes, push changes, and reply/resolve threads

Diagnose and fix CI failures on a GitHub PR by analyzing failing checks, reading logs, and applying fixes

Self-review a PR, fix all issues, and re-review in a loop until clean. Coordinates code-review, address-pr-comments, and fix-ci-tests skills.

Implement a new POSIX command as a builtin in the safe shell interpreter

Systematically review and improve every shell feature and builtin command. Iterates through each feature/command, runs code-review, fixes issues, and re-reviews until clean.

Comprehensive code review covering security, correctness, bash compatibility, test coverage, and code quality. Use for PRs, commits, or any code changes.

Fix failing tests by prioritising shell implementation fixes to match bash behaviour

Use when public API changes have been made to review and update all *_FEATURE.md documentation files, or to audit whether they are still accurate.

Use when writing, reviewing, or renaming Swift APIs, including declarations, call sites, argument labels, Boolean names, protocols, overloads, documentation comments, and small abstractions.

Use when committing changes in dd-sdk-ios. Use when writing commit messages, signing commits, or staging files before a commit.

Use when creating a pull request in dd-sdk-ios. Use when writing PR titles, PR body, or choosing the target branch.

Use when creating a new branch in dd-sdk-ios for a JIRA ticket or feature. Use when choosing a branch name or base branch for development work.

Use when asked to run tests in the dd-sdk-ios project — whether a full module suite, a specific test class, or a single test method. Use when choosing between make, xcodebuild, or Xcode MCP for running iOS/tvOS/visionOS tests.

Use when adding, removing, moving, or renaming Swift source files in the dd-sdk-ios Xcode project. Use when the task involves file creation, deletion, or relocation in any module (DatadogRUM, DatadogLogs, DatadogCore, etc.). Use when you would otherwise reach for Write, Bash mv/mkdir/rm, or manual pbxproj editing for file management.

Review a code diff / branch / PR for technical debt — code duplication, unnecessary complexity / over-engineering, and redundant or dead code. Use whenever the user wants a tech-debt, cleanup, or refactor review, asks to check a branch or PR for duplication / complexity / dead code before opening a PR, or mentions "techdebt". Refactor-only: it reports issues and offers behavior-preserving fixes; it never changes behavior.

Write a new library instrumentation end-to-end. Use when the user ask to add a new APM integration or a library instrumentation.

Performance-overhead review of a code diff / branch / PR for the dd-trace-java tracer. Flags hot-path allocation, unbounded memory, repeated work, escaping objects, native-boundary crossings, and JVM-specific pitfalls (escape analysis, JNI / virtual-thread pinning, backtracking-regex ReDoS, varargs/boxing hashing, String.format, ByteBuddy-Advice anti-patterns) using the tracer performance rubric. Use whenever the user wants a performance / overhead / hot-path review, asks to check a diff or PR for allocation / GC / memory / latency / startup cost, or mentions the "perf rubric" or the "do no harm / assume hot" tracer posture — even if they just say "review this for perf" without naming the rubric. Advisory and READ-ONLY: it reports ranked, verify-first findings; it never edits code.

Converts Spock/Groovy test files in a Gradle module to equivalent JUnit 5 Java tests. Use when asked to "migrate groovy", "convert groovy to java", "g2j", or when a module has .groovy test files that need to be replaced with .java equivalents.

Convert JUnit 5 @MethodSource/@CsvSource/@ValueSource parameterized tests to @TableTest (JDK8)

Post-migration quality review. Checks Java test files produced by migrate-groovy-to-java against the shared quality rules. Use after migration, or on any branch with recently migrated .java test files. Produces structured FINDING blocks grouped by severity, then offers to auto-fix BLOCKERs and WARNINGs.

Update/bump the libdatadog native library version in dd-trace-dotnet. Use when the user asks to bump, update, or upgrade libdatadog, or mentions a new libdatadog release version.

Dev/test workflow for tracer engineers working on the Datadog .NET tracer — build a local Datadog.AzureFunctions NuGet package, deploy it to a test Azure Function App, trigger it, and analyze traces/logs to verify instrumentation behavior. Use this skill whenever the user is working on Azure Functions instrumentation: building or testing the Datadog.AzureFunctions NuGet package, deploying to a test Function App, analyzing instrumentation logs or spans from an Azure Functions app, or configuring Datadog environment variables on Azure — even if they don't explicitly invoke /azure-functions.

Analyze Azure DevOps CI build failures in dd-trace-dotnet pipeline. This skill should be used when the user mentions a failing CI build, PR checks failing, Azure DevOps pipeline failures, test failures in CI, or when they share a build ID or PR number and want to understand what went wrong. Analyzes build failures, categorizes them (infrastructure/flaky/real), and provides actionable recommendations.

Error Stack Trace Analysis for dd-trace-dotnet

Stack Trace Crash Analysis for dd-trace-dotnet

Perform a review on a GitHub PR, leaving comments on the PR

Environment validation checklist. Run this FIRST when starting a new Claude session to verify the environment is ready for optimization work. Checks Rust toolchain, ci/ scripts, build, benchmarking tools, profilers, memory tools, git state, and SMP CLI.

Prepare a lading release. Updates CHANGELOG.md, bumps version in Cargo.toml, updates Cargo.lock, commits, and creates a PR.

Coordinates optimization attempts. Captures baselines, implements changes, invokes review, and records outcomes.

Reviews optimization patches using a 5-persona peer review system. Requires unanimous approval backed by benchmarks.

Full optimization workflow with git branch creation, commits, and optional PR. Wraps /lading-optimize-hunt with git automation.

Finds a valid optimization target in lading. Returns a filled target.yaml template with pattern, technique, target, file, bench, and fingerprint. Use before /lading-optimize-hunt or when selecting a new optimization target.

Use when adding, debugging, fixing, or modifying instrumentation and plugins for third-party libraries in dd-trace-js. Triggers: "add a new integration", "instrument a library", any *Plugin base class (Tracing/Database/Cache/ Client/Server/Consumer/Producer/Composite), "addHook", "shimmer.wrap", "orchestrion", "bindStart"/"bindFinish", "diagnostic channel", "runStores", "subscriber cardinality", "channel.publish gate", "read upstream source", "reference plugin".

Use when adding, modifying, debugging, or reviewing dd-trace-js serverless platform integrations that create root invocation spans for AWS Lambda, Azure Functions, Google Cloud Functions, or similar runtimes. Triggers: serverless integration, function invocation root span, Lambda runtime, Azure Functions, GCP Functions, type = 'serverless', DD_LAMBDA_HANDLER, datadog-lambda-js, deployed serverless verification, manual serverless test.

Use when adding, debugging, or modifying LLMObs plugins for an LLM library in dd-trace-js. Triggers: "add LLMObs support", "instrument chat completions / streaming / embeddings / agent runs / orchestration / tool calls / retrieval", "LLMObsPlugin", "getLLMObsSpanRegisterOptions", "setLLMObsTags", "LlmObsCategory", "LlmObsSpanKind", any provider tag ("openai" / "anthropic" / "genai" / "google" / "langchain" / "langgraph" / "ai-sdk" llmobs), "VCR cassettes".

Use when writing, modifying, or debugging tests for an LLMObs plugin in dd-trace-js. Triggers: "write LLMObs tests", "test an LLMObs plugin", "assertLlmObsSpanEvent", "useLlmObs", "getEvents", any MOCK_* matcher ("MOCK_STRING" / "MOCK_NOT_NULLISH" / "MOCK_NUMBER" / "MOCK_OBJECT"), "VCR cassette", "vcr proxy", "127.0.0.1:9126", any LlmObsCategory test ("LLM_CLIENT" / "MULTI_PROVIDER" / "ORCHESTRATION" / "INFRASTRUCTURE").

Use when instrumenting a Bazel Go repository or monorepo with Datadog Test Optimization and Orchestrion. Applies to WORKSPACE and Bzlmod consumers, large monorepos with local Go wrappers, doctor/uploader validation, and RFC-safe setup that avoids patches, payload proxies, DD_GIT_* test environment variables, and missing remote outputs.

Use when instrumenting a Bazel Java repository or monorepo with Datadog Test Optimization. Applies to Bzlmod and WORKSPACE consumers, direct java_test targets, repository-owned Java/JUnit wrapper macros, doctor/uploader validation, and RFC-safe setup that avoids manual tracer payload wiring, DD_GIT_* test environment variables, uploader credentials in test sandboxes, and missing remote outputs.

Use when instrumenting a Bazel Python repository or monorepo with Datadog Test Optimization. Applies to Bzlmod and WORKSPACE consumers, managed pytest targets, repository-owned pytest wrappers, consumer_runner mode, doctor/uploader validation, and RFC-safe setup that avoids payload proxies, DD_GIT_* test environment variables, and missing remote outputs.

Use when porting this repository's vendored Orchestrion-enabled rules_go fork from its current upstream base to another upstream rules_go tag or commit. Applies to base support lines, metadata regeneration, profile verification, smoke validation, and migration PR preparation.

Analyze a threat-intel blog post or report against Stratus Red Team coverage. Extract cloud TTPs, classify each as Covered / Partial / Open issue / Not covered, produce a markdown coverage report, and suggest GitHub issue drafts for the gaps. Use when the user pastes a threat-intel URL (Microsoft, Mandiant, CrowdStrike, Unit 42, etc.) and asks for a coverage report, gap analysis, TTP extraction, or "what does Stratus cover from this report". Also use when given a local report file (.md, .txt, .pdf) or pasted text.

Create or review Stratus Red Team attack techniques. Use when asked to add, create, or implement a new attack technique for AWS, Azure, GCP, Entra ID, EKS, or Kubernetes in the stratus-red-team project. Also use when reviewing PRs or code that implements attack techniques — the guidelines serve as a review checklist.

Tests and validates Stratus Red Team attack techniques by executing warmup, detonation, and cleanup phases with comprehensive validation. Validates cloud credentials, parses command output, checks expected outcomes, and generates HTML reports. Use when testing attack techniques, validating TTPs, verifying technique behavior, or when user mentions stratus, warmup, detonate, or technique IDs like aws.*, azure.*, gcp.*, k8s.*, or entra-id.*. Supports AWS, Azure, GCP, Kubernetes, and Entra ID.

Monitor GitLab CI and GitHub Actions for this repo: start check-ci, tail results with ci-watch, investigate failures, and report. Use when the user asks to check, watch, or monitor CI, or to see whether a pipeline passed.

Analyze a dd-trace-php crash report (event.json) to identify the crashing binary, correlate stacktraces to source code, and determine root cause. Use when investigating wild crash reports from crash tracking.

Generate release notes for the current version.