Scaffold, apply, and verify a database schema migration for Huntable CTI Studio following the house pattern (standalone idempotent scripts/migrate_*.py, NOT Alembic). Use whenever the user asks to "create a migration", "add a column", "add a table", "migrate the schema", "write a migration script", or any schema change to the PostgreSQL database — even if they mention Alembic (this repo does not use Alembic migrations despite it being a dependency).
Propagate any change under src/prompts/ (agent prompt files, .txt or extensionless) into all 9 quickstart preset JSONs in config/presets/AgentConfigs/quickstart/. Use this EVERY time a prompt file is edited, created, or renamed — editing src/prompts/ alone silently ships stale prompts to anyone who applies a quickstart preset. Trigger even if the user only says "tweak the SigmaAgent prompt" or "update the extraction instructions" without mentioning presets.
Audit and correct the eval fixtures (Eval1 expected counts + Eval2 ground-truth item lists) for one extractor subagent in Huntable CTI Studio: CmdlineExtract, ProcTreeExtract, RegistryExtract, ServicesExtract, ScheduledTasksExtract, or HuntQueriesExtract. Use this skill whenever the user asks to "audit the evals", "run the eval audit", "check/fix/populate ground truth", "reconcile eval fixtures", "are the evals set up right", mentions Eval1/Eval2 counts or expected_items drift, or names any extractor together with evals, fixtures, ground truth, or the evals spreadsheet — even if they don't say "audit". Also use it for re-audits after an extractor contract/spec change. Operator-gated propose-and-confirm: it extracts blind, reports divergences, and writes nothing until the operator approves sink by sink. Interactive-only — it depends on a human answering its STOP gates; do not run it headless or autonomously.
Interactive walkthrough for cutting a new release of Huntable CTI Studio. Use this skill whenever the user says "cut a release", "ship a release", "tag a version", "bump the version", "new release", "do the release", "release vX.Y.Z", "ship v5.4.0", "time to release", or otherwise signals they want to move code from the release branch to main and publish a tagged GitHub Release. Drives scripts/release_cut.py plus the branch unlock/lock dance and the tag push that triggers .github/workflows/release.yml, pausing at every irreversible step so the operator can confirm.
Add a new extraction sub-agent to Huntable CTI Studio as a first-class peer of CmdlineExtract, ProcTreeExtract, HuntQueriesExtract, RegistryExtract, ServicesExtract, and ScheduledTasksExtract. Use this skill whenever the user asks to "add a new agent", "create a sub-agent", "wire up a new extractor", "add a new extraction type", or anything related to adding a new LangGraph extraction sub-agent to the agentic workflow pipeline. This covers the full stack: schema, config pipeline, migration, services, routes, UI templates, config display JS, presets, and tests.
Verify and refresh the model context-window data in CTI Studio against the latest public developer docs from Anthropic and OpenAI. Use this skill whenever the user says "refresh context windows", "are the context windows accurate", "check model context windows", "update MODEL_CONTEXT_TOKENS", "verify the model catalog", "sync models against the docs", "is this catalog stale", or similar. Also use it whenever a new model is added to `config/provider_model_catalog.json` and its context window is unknown, or when the user wonders whether a value in the catalog matches what the provider currently advertises. The skill verifies effective behavior for **this app specifically** — not just spec sheets — by checking which API endpoints and beta headers the code actually sends.
Fix non-complex CodeQL note-severity alerts — unused imports, unused local variables, unused global variables — in Python files. Run this skill when CodeQL surfaces py/unused-import, py/unused-local-variable, py/unused-global-variable, or py/repeated-import alerts. Produces only minimal, targeted edits; never refactors unrelated code.
Summarizes problems or bugs from the open chat (or uses user-provided content), proposes a Todoist issue with Title and Description and optionally subtasks, then creates tasks in the Huntable CTI Studio Todoist project via Todoist MCP after user approval. Use when the user says "Create Issue", "create issue", or asks to turn chat discussion into Todoist tasks in Huntable CTI Studio.