菜单
Performs full pre-commit hygiene (changelog, docs, deps, security, Vulture dead-code check), then stages, commits, and pushes to the current branch. Use when the user says "lg" or "LG"; do not commit or push on "go" or "implement" unless they also say LG.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Scaffold, apply, and verify a database schema migration for Huntable CTI Studio following the house pattern (standalone idempotent scripts/migrate_*.py, NOT Alembic). Use whenever the user asks to "create a migration", "add a column", "add a table", "migrate the schema", "write a migration script", or any schema change to the PostgreSQL database — even if they mention Alembic (this repo does not use Alembic migrations despite it being a dependency).
Propagate any change under src/prompts/ (agent prompt files, .txt or extensionless) into all 9 quickstart preset JSONs in config/presets/AgentConfigs/quickstart/. Use this EVERY time a prompt file is edited, created, or renamed — editing src/prompts/ alone silently ships stale prompts to anyone who applies a quickstart preset. Trigger even if the user only says "tweak the SigmaAgent prompt" or "update the extraction instructions" without mentioning presets.
Audit and correct the eval fixtures (Eval1 expected counts + Eval2 ground-truth item lists) for one extractor subagent in Huntable CTI Studio: CmdlineExtract, ProcTreeExtract, RegistryExtract, ServicesExtract, ScheduledTasksExtract, or HuntQueriesExtract. Use this skill whenever the user asks to "audit the evals", "run the eval audit", "check/fix/populate ground truth", "reconcile eval fixtures", "are the evals set up right", mentions Eval1/Eval2 counts or expected_items drift, or names any extractor together with evals, fixtures, ground truth, or the evals spreadsheet — even if they don't say "audit". Also use it for re-audits after an extractor contract/spec change. Operator-gated propose-and-confirm: it extracts blind, reports divergences, and writes nothing until the operator approves sink by sink. Interactive-only — it depends on a human answering its STOP gates; do not run it headless or autonomously.
Interactive walkthrough for cutting a new release of Huntable CTI Studio. Use this skill whenever the user says "cut a release", "ship a release", "tag a version", "bump the version", "new release", "do the release", "release vX.Y.Z", "ship v5.4.0", "time to release", or otherwise signals they want to move code from the release branch to main and publish a tagged GitHub Release. Drives scripts/release_cut.py plus the branch unlock/lock dance and the tag push that triggers .github/workflows/release.yml, pausing at every irreversible step so the operator can confirm.
Add a new extraction sub-agent to Huntable CTI Studio as a first-class peer of CmdlineExtract, ProcTreeExtract, HuntQueriesExtract, RegistryExtract, ServicesExtract, and ScheduledTasksExtract. Use this skill whenever the user asks to "add a new agent", "create a sub-agent", "wire up a new extractor", "add a new extraction type", or anything related to adding a new LangGraph extraction sub-agent to the agentic workflow pipeline. This covers the full stack: schema, config pipeline, migration, services, routes, UI templates, config display JS, presets, and tests.
Verify and refresh the model context-window data in CTI Studio against the latest public developer docs from Anthropic and OpenAI. Use this skill whenever the user says "refresh context windows", "are the context windows accurate", "check model context windows", "update MODEL_CONTEXT_TOKENS", "verify the model catalog", "sync models against the docs", "is this catalog stale", or similar. Also use it whenever a new model is added to `config/provider_model_catalog.json` and its context window is unknown, or when the user wonders whether a value in the catalog matches what the provider currently advertises. The skill verifies effective behavior for **this app specifically** — not just spec sheets — by checking which API endpoints and beta headers the code actually sends.
| name | lg-workflow |
| description | Performs full pre-commit hygiene (changelog, docs, deps, security, Vulture dead-code check), then stages, commits, and pushes to the current branch. Use when the user says "lg" or "LG"; do not commit or push on "go" or "implement" unless they also say LG. |
When the user says lg or LG, run the full workflow yourself from hygiene through push to the current branch. Do not stop at commit or ask the user to push manually.
docs/CHANGELOG.md) with this session's changes.pip check, lockfiles).pip-audit and safety scan (requires pip install -r requirements-test.txt)..venv/bin/vulture src scripts for dead-code detection. Fix or whitelist findings before commit.git add (or equivalent) so all changes are staged.git push origin HEAD or git push). Complete the push; do not hand off to the user.If the environment's git wrapper breaks (e.g. unsupported --trailer), use the real git binary (e.g. /usr/local/bin/git) so the workflow completes.
Only run this workflow when the user has said LG. Do not commit/push on "go" or "implement" unless they also say LG.