Huntable-CTI-Studio

Scaffold, apply, and verify a database schema migration for Huntable CTI Studio following the house pattern (standalone idempotent scripts/migrate_*.py, NOT Alembic). Use whenever the user asks to "create a migration", "add a column", "add a table", "migrate the schema", "write a migration script", or any schema change to the PostgreSQL database — even if they mention Alembic (this repo does not use Alembic migrations despite it being a dependency).

Propagate any change under src/prompts/ (agent prompt files, .txt or extensionless) into all 9 quickstart preset JSONs in config/presets/AgentConfigs/quickstart/. Use this EVERY time a prompt file is edited, created, or renamed — editing src/prompts/ alone silently ships stale prompts to anyone who applies a quickstart preset. Trigger even if the user only says "tweak the SigmaAgent prompt" or "update the extraction instructions" without mentioning presets.

Audit and correct the eval fixtures (Eval1 expected counts + Eval2 ground-truth item lists) for one extractor subagent in Huntable CTI Studio: CmdlineExtract, ProcTreeExtract, RegistryExtract, ServicesExtract, ScheduledTasksExtract, or HuntQueriesExtract. Use this skill whenever the user asks to "audit the evals", "run the eval audit", "check/fix/populate ground truth", "reconcile eval fixtures", "are the evals set up right", mentions Eval1/Eval2 counts or expected_items drift, or names any extractor together with evals, fixtures, ground truth, or the evals spreadsheet — even if they don't say "audit". Also use it for re-audits after an extractor contract/spec change. Operator-gated propose-and-confirm: it extracts blind, reports divergences, and writes nothing until the operator approves sink by sink. Interactive-only — it depends on a human answering its STOP gates; do not run it headless or autonomously.

Interactive walkthrough for cutting a new release of Huntable CTI Studio. Use this skill whenever the user says "cut a release", "ship a release", "tag a version", "bump the version", "new release", "do the release", "release vX.Y.Z", "ship v5.4.0", "time to release", or otherwise signals they want to move code from the release branch to main and publish a tagged GitHub Release. Drives scripts/release_cut.py plus the branch unlock/lock dance and the tag push that triggers .github/workflows/release.yml, pausing at every irreversible step so the operator can confirm.

Add a new extraction sub-agent to Huntable CTI Studio as a first-class peer of CmdlineExtract, ProcTreeExtract, HuntQueriesExtract, RegistryExtract, ServicesExtract, and ScheduledTasksExtract. Use this skill whenever the user asks to "add a new agent", "create a sub-agent", "wire up a new extractor", "add a new extraction type", or anything related to adding a new LangGraph extraction sub-agent to the agentic workflow pipeline. This covers the full stack: schema, config pipeline, migration, services, routes, UI templates, config display JS, presets, and tests.

Verify and refresh the model context-window data in CTI Studio against the latest public developer docs from Anthropic and OpenAI. Use this skill whenever the user says "refresh context windows", "are the context windows accurate", "check model context windows", "update MODEL_CONTEXT_TOKENS", "verify the model catalog", "sync models against the docs", "is this catalog stale", or similar. Also use it whenever a new model is added to `config/provider_model_catalog.json` and its context window is unknown, or when the user wonders whether a value in the catalog matches what the provider currently advertises. The skill verifies effective behavior for **this app specifically** — not just spec sheets — by checking which API endpoints and beta headers the code actually sends.

Fix non-complex CodeQL note-severity alerts — unused imports, unused local variables, unused global variables — in Python files. Run this skill when CodeQL surfaces py/unused-import, py/unused-local-variable, py/unused-global-variable, or py/repeated-import alerts. Produces only minimal, targeted edits; never refactors unrelated code.

Summarizes problems or bugs from the open chat (or uses user-provided content), proposes a Todoist issue with Title and Description and optionally subtasks, then creates tasks in the Huntable CTI Studio Todoist project via Todoist MCP after user approval. Use when the user says "Create Issue", "create issue", or asks to turn chat discussion into Todoist tasks in Huntable CTI Studio.

Diagnose and repair troubled CTI intelligence sources in Huntable CTI Studio — sources that ingest 0 articles or rack up recurring fetch failures. Use this skill whenever the user says "heal a source", "fix a broken/failing source", "this source has 0 articles", "why isn't <source> collecting", "diagnose troubled sources", "source-healing", or whenever a source has stopped producing articles, has stale content, redirects, switched to JS rendering, or is accumulating failures — even if the user doesn't say the word "heal". Operator-invoked and propose-and-confirm: it diagnoses, proposes one concrete config fix, and applies it only after the operator approves. It never auto-applies, never runs on a schedule.

Add a new CTI intelligence source to Huntable CTI Studio for article ingestion. Use this skill when the user says "add a source", "add a feed", "new source", "add this blog", "ingest from <url>", or wants to configure a new RSS/scraping source for the ingestion pipeline.

Register a new OpenAI or Anthropic model in CTI Studio so it appears in the Workflow Agent configuration dropdown. Use this skill whenever the user says "add a model", "make gpt-X available", "why isn't model X in the dropdown", "register claude X", "add support for o4", "I want to use gpt-5-pro", or anything about making a specific cloud model selectable in the UI. Also use it when a new model has been released and the user wants to start using it in their pipelines.

Update all Markdown documentation to reflect code and session changes. Use this skill whenever the user says "mdu", asks to "update docs", "sync documentation", "refresh changelog", "update the changelog", "docs are stale", "add this to the changelog", or any request to align documentation with recent code changes. Also trigger when the user mentions MkDocs build, doc drift, nav sync, or documentation freshness after making code changes -- even if they just say something like "ok the feature is done, clean up the docs" or "make sure the docs match". Also trigger for quality-pass requests like "clean up the docs", "the docs feel sloppy", "audit what we just added", or "review the section we just wrote" -- these invoke a single-file quality pass applying write-clean rules without a full changelog sync. Handles changelog entries, README updates, docs/ page updates, mkdocs.yml nav sync, strict build verification, and prose quality enforcement.

Audit test coverage gaps and generate unit tests to close them. Use when the user says "test trueup", "coverage gaps", "test coverage audit", "fill coverage", "write missing tests", "backfill tests", "scope tests", "test what I changed", or any request to identify and fill test gaps. Three modes: audit (report only), fill (generate tests for worst gaps), scope (cover changes from current session).

Proposes 2–3 high-level feature-set themes for a minor or point release compared to the previous minor—user-facing capability or UX shifts, not patches or commit lists. Use when cutting release notes, tagging a minor/point version, summarizing “what changed since x.y.0”, or when the user asks for dot/minor release messaging.

Runs the standard test sequence (smoke, unit, api, integration, then ui). UI uses --skip-playwright-js (pytest tests/ui only; no npx tests/playwright). Agent/workflow config-mutating tests stay excluded by run_tests.py ui defaults. Parses pass counts; does not fix failures.

Performs full pre-commit hygiene (changelog, docs, deps, security, Vulture dead-code check), then stages, commits, and pushes to the current branch. Use when the user says "lg" or "LG"; do not commit or push on "go" or "implement" unless they also say LG.

Lite commit and push to current branch (git add ., commit, push)

Rescore all articles: regenerate keyword-based (regex) threat hunting scores and ML-based hunt scores via CLI. Use when the user says "rs" or asks to rescore all articles or update hunt/ML scores.

When the user invokes "LGTest", reviews the most recent changes (especially from the current chat, but not limited to it) and proposes adding new tests—unit, UI, smoke, API, or integration—as appropriate. Use when the user says "LGTest" or asks to review changes and propose tests.