codex-plugins

Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path Codex Security scan. Run repeated independent discovery passes over one resolved scope with worker-specific threat models, semantically merge candidates, synthesize one canonical validation threat model, then run validation, attack-path analysis, canonical JSON completion, and generated reporting once. Do not use for PRs, commits, branch diffs, or working-tree diffs.

Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Use when the user explicitly asks to fix and verify a validated or plausible security finding. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Use when the user asks for a security review of a pull request, commit, branch diff, working-tree patch, or other Git-backed change set.

Use when the user asks for a repository-wide or scoped-path security scan.

Track validated Codex Security findings in Linear, Jira, GitHub issues, or draft GitHub security advisories. Use it for one finding or an explicitly selected batch of up to 25 findings tracked as Linear, Jira, or GitHub issues. Includes duplicate checks, exact previews, approval-gated writes, and readback. Do not use it for scans or fixes.

Use when the user supplies or imports existing security findings, vulnerability reports, or security/vulnerability Jira/Linear tickets from scanners, advisories, GitHub, Atlassian Rovo, Linear, or similar backlog sources and wants static repo-impact triage. Do not use for discovery, duplicate-bug triage, validation, or fixes.

Use when Codex is already in the validation phase of a security scan or the user explicitly asks to determine whether one or more candidate security findings are valid. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Produce an Earnings Call Summary HTML report for 2–5 companies using Moody's GenAI MCP tools. Use this skill whenever the user asks to summarize earnings calls, generate an earnings call summary, analyze earnings transcripts across peers, or create an earnings call report. Trigger even if they just name companies and mention "earnings" or "transcript".

Produce a Peer Analysis HTML report for a target company and its credit peers using Moody's GenAI MCP tools. Use this skill whenever the user asks to compare a company against its peers, run a peer analysis, do a credit peer comparison, generate a peer group report, or analyze relative credit positioning. Trigger even if they just name a company and mention "peers", "peer comparison", "credit comparison", "peer group", or "relative value".

Produce a Rating Pitch Deck for a company using Moody's GenAI MCP tools, delivered as an editable PowerPoint (.pptx) saved to disk. Use this skill whenever the user asks to create a rating pitch, rating pitch deck, credit pitch, rating presentation, or rating pitch report. Also trigger when they ask for a comprehensive credit overview combining sector analysis, company financials, SWOT, peer comparison, and ESG into a single deck or presentation. Trigger even if they just name a company and say "pitch deck", "rating deck", or "credit deck".

Produce a Sector Brief HTML report for any industry sector using Moody's GenAI MCP tools and web research. Use this skill whenever the user asks to analyze a sector, write a sector report, do an industry analysis, create a sector overview, or generate a sector deep-dive. Trigger even if they just name a sector and mention "analysis", "overview", "outlook", "report", or "deep-dive". Also trigger for phrases like "what's happening in the retail sector" or "give me a sector breakdown for aerospace".

Canonical rules and HTML/CSS contract for inline `[n]` citation references, end-of-document Citations blocks, and optional per-section citation recaps used across Moody's Agentic Solutions HTML report skills (earnings-brief, peer-analysis, issuer-brief, sector-brief). Parent skills must read BOTH this `SKILL.md` (rules, numbering, hyperlink behavior, source data shape) AND `assets/template.html` (canonical CSS block + literal HTML markup snippets) before emitting citations. The asset file is the single source of truth for the visual/markup implementation; this `SKILL.md` is the single source of truth for the authoring rules. Triggers when the user asks about citations, sources, references, footnotes, hyperlinking [n] markers, or the Sources/Citations block in any HTML report skill.

Canonical rules and HTML/CSS contract for page chrome (head boilerplate, cover, table of contents, section block, sources-section wrapper, footer, outlook-badge, and design tokens) used across Moody's Agentic Solutions HTML report skills (earnings-call-summary, peer-analysis, public-information-book, sector-analysis). Sibling of `skills/shared/citations/` using the same inlining pattern. Parent skills must read BOTH this `SKILL.md` (owned classes/snippets, per-skill overrides, outlook-badge usage) AND `assets/template.html` (canonical CSS + HTML markup snippets) before emitting any HTML report. Asset file is the single source of truth for visual/markup; this `SKILL.md` is the single source of truth for authoring rules. Triggers when the user asks about the template, page chrome, cover, table of contents, footer, layout, design tokens, color palette, fonts, outlook badges, or anything affecting the visual scaffolding of an HTML report skill.

Assess whether tables, query results, files, or dataframes are trustworthy enough for analysis, modeling, dashboards, experiments, or pipelines. Use for grain, freshness, nulls, duplicates, schema drift, broken joins, referential integrity, distribution shifts, leakage, backfills, source mismatches, automated quality checks, and data-quality regressions.

Build source-backed analytical dashboards that help teams monitor performance, explore drivers, and act on product or business metrics. Use when the user needs a dashboard, scorecard, monitoring view, BI dashboard, MCP artifact dashboard, or Streamlit dashboard with clear metrics, filters, validation, and handoff.

Narrow conversion skill. Invoke only when the user explicitly asks to convert an existing local or blob-hosted HTML analytics report into a Google Doc, DOCX, or shareable document.

Narrow conversion skill. Invoke only when the user explicitly asks to convert an existing HTML analytics report into a native Google Slides deck.

Narrow conversion skill. Invoke only when the user explicitly asks to convert an existing Data Analytics report, dashboard, or inline chart export into a PDF artifact.

Build polished analytical reports for executive, product, business, and technical audiences, and act as the completion contract for Data Analytics report runs. Use when the final artifact needs an answer-first narrative, evidence-backed findings, charts/tables, caveats, source metadata, and either an MCP app report or an HTML report with Seaborn-generated charts.

Design KPI frameworks, set targets, and develop measurement plans that help teams make product or business decisions. Use when success metrics, drivers, guardrails, targets, or measurement approach need to be defined or improved. Use $metric-diagnostics when the task is to explain why an existing metric moved.

Gather business context from connected or provided sources so downstream analysis starts with the right framing. Use before deeper analysis when an analytical question depends on context the prompt does not provide, for example to understand what a metric means, how the work is defined, what changed recently, or which sources should be checked.

Primary router for Data Analytics. Use when the plugin is at-mentioned or for data work where source-backed analysis, quantitative reasoning, analytical delivery, or reusable data context may be useful; examples include analyzing data, explaining or diagnosing metrics, validating data or results, creating data visualizations, building analytics reports or dashboards, working with notebooks or spreadsheets, designing KPIs, sizing opportunities, and saving reusable data context for future analysis.

Create, scaffold, edit, refactor, and validate Jupyter notebooks (`.ipynb`) for reproducible SQL/Python analysis, experiments, modeling, tutorials, diagnostics, data-quality checks, market-sizing calculations, and report support. Use when the notebook itself is a deliverable, review artifact, runnable analysis companion, or handoff artifact that other people should be able to skim, rerun, or extend.

Produce leadership-ready KPI updates, scorecards, WBR/MBR/QBR summaries, target and pacing readouts, operating status narratives, and performance updates for known KPIs. Use when the work is to define KPI reporting context, validate metric definitions, present actuals versus comparison or plan, summarize validated drivers, and state implications or next actions.

Estimate a market or opportunity size, such as TAM/SAM/SOM, by defining scope, choosing a sizing model, checking connected context and public sources, and presenting transparent assumptions, sensitivity, uncertainty, and validation priorities. Use for market or opportunity sizing; not for KPI reporting or metric diagnostics.

Diagnose why a metric changed or differs from expectation by reproducing the metric, choosing the right comparison, validating likely drivers, and producing a calibrated explanation. Use when the user needs to understand what drove a metric movement, anomaly, gap, or discrepancy.

Analyze product or business data to inform decisions with focused quantitative work, decision-relevant context, measurable opportunities, and a clear recommendation. Use when the user needs data-backed evidence to choose a direction, prioritize an opportunity, evaluate a change, understand implications, or decide what to do next; not for routine KPI reporting, metric diagnostics, or dashboard building.

Use this skill when a user requests to create, modify, analyze, visualize, or work with spreadsheet files (`.xlsx`, `.xls`, `.csv`, `.tsv`) or Google Sheets-targeted spreadsheet artifacts with formulas, formatting, charts, tables, and recalculation.

Load or manage the Data Analytics plugin's durable source-routing preferences, onboarding logic, setup progress, and semantic-layer registry.

QA an analysis before sharing: review methodology, metric definitions, SQL/query logic, calculation checks, chart integrity, bias risks, caveats, reproducibility, and whether conclusions are supported by evidence. Use when reviewing a report, notebook, spreadsheet, SQL query/results, dashboard, chart, recommendation, or stakeholder-ready analysis before presentation or publication.

Design, specify, implement, revise, and QA quantitative visuals and chart choices. Use when an analytical answer needs visual judgment; for example comparing values, showing how a total breaks apart, reading concentration in a ranking, or understanding movement over time. This may mean rendering a chart for a report or dashboard, or simply choosing, rendering and QAing the right chart form for an inline answer.

Use when building public-equity-investing catalyst calendars. Do not use for full event underwriting; use event-driven-analyzer.

Use when creating source-backed public issuer tearsheets. Do not use for private diligence, fund diligence, vendors, or market maps.

Produce Public Equity Investing comparable-company valuation in report or workbook mode. Use for peer selection, multiple analysis, valuation read-throughs, implied prices, comps dashboards, Excel or Sheets comps, refreshable peer tables, model updates, and comps workbook QA. Do not use for DCF-only, credit-security, or generic market commentary requests.

Use when building public-equity DCF valuation workbooks. Default to the banker formula workbook path for new model builds; use deterministic exports only for controlled support calculations or explicit lightweight runs. Do not use for standalone workbook audits; use model-audit-tieout.

Use when running first-pass QC on Public Equity Investing decks or reports. Do not use as external-circulation certification.

Use when analyzing public-company earnings after results, guidance, transcript, or call commentary. Do not use for pre-print previews.

Use when preparing full pre-earnings preview reports with executive summary, expectation bar, guidance credibility, KPI dashboard, scenarios, and call questions. Do not use after results or for short summaries unless the user explicitly asks for a summary/short version.

Use when translating a specific event, policy change, macro shock, or industry development into public-equity issuer, sector, earnings, valuation, positioning, and portfolio implications. Do not use for standalone macro strategy, rates, FX, credit, futures, or generic market commentary.