菜单
Rescore all articles: regenerate keyword-based (regex) threat hunting scores and ML-based hunt scores via CLI. Use when the user says "rs" or asks to rescore all articles or update hunt/ML scores.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Scaffold, apply, and verify a database schema migration for Huntable CTI Studio following the house pattern (standalone idempotent scripts/migrate_*.py, NOT Alembic). Use whenever the user asks to "create a migration", "add a column", "add a table", "migrate the schema", "write a migration script", or any schema change to the PostgreSQL database — even if they mention Alembic (this repo does not use Alembic migrations despite it being a dependency).
Propagate any change under src/prompts/ (agent prompt files, .txt or extensionless) into all 9 quickstart preset JSONs in config/presets/AgentConfigs/quickstart/. Use this EVERY time a prompt file is edited, created, or renamed — editing src/prompts/ alone silently ships stale prompts to anyone who applies a quickstart preset. Trigger even if the user only says "tweak the SigmaAgent prompt" or "update the extraction instructions" without mentioning presets.
Audit and correct the eval fixtures (Eval1 expected counts + Eval2 ground-truth item lists) for one extractor subagent in Huntable CTI Studio: CmdlineExtract, ProcTreeExtract, RegistryExtract, ServicesExtract, ScheduledTasksExtract, or HuntQueriesExtract. Use this skill whenever the user asks to "audit the evals", "run the eval audit", "check/fix/populate ground truth", "reconcile eval fixtures", "are the evals set up right", mentions Eval1/Eval2 counts or expected_items drift, or names any extractor together with evals, fixtures, ground truth, or the evals spreadsheet — even if they don't say "audit". Also use it for re-audits after an extractor contract/spec change. Operator-gated propose-and-confirm: it extracts blind, reports divergences, and writes nothing until the operator approves sink by sink. Interactive-only — it depends on a human answering its STOP gates; do not run it headless or autonomously.
Interactive walkthrough for cutting a new release of Huntable CTI Studio. Use this skill whenever the user says "cut a release", "ship a release", "tag a version", "bump the version", "new release", "do the release", "release vX.Y.Z", "ship v5.4.0", "time to release", or otherwise signals they want to move code from the release branch to main and publish a tagged GitHub Release. Drives scripts/release_cut.py plus the branch unlock/lock dance and the tag push that triggers .github/workflows/release.yml, pausing at every irreversible step so the operator can confirm.
Add a new extraction sub-agent to Huntable CTI Studio as a first-class peer of CmdlineExtract, ProcTreeExtract, HuntQueriesExtract, RegistryExtract, ServicesExtract, and ScheduledTasksExtract. Use this skill whenever the user asks to "add a new agent", "create a sub-agent", "wire up a new extractor", "add a new extraction type", or anything related to adding a new LangGraph extraction sub-agent to the agentic workflow pipeline. This covers the full stack: schema, config pipeline, migration, services, routes, UI templates, config display JS, presets, and tests.
Verify and refresh the model context-window data in CTI Studio against the latest public developer docs from Anthropic and OpenAI. Use this skill whenever the user says "refresh context windows", "are the context windows accurate", "check model context windows", "update MODEL_CONTEXT_TOKENS", "verify the model catalog", "sync models against the docs", "is this catalog stale", or similar. Also use it whenever a new model is added to `config/provider_model_catalog.json` and its context window is unknown, or when the user wonders whether a value in the catalog matches what the provider currently advertises. The skill verifies effective behavior for **this app specifically** — not just spec sheets — by checking which API endpoints and beta headers the code actually sends.
| name | rs |
| description | Rescore all articles: regenerate keyword-based (regex) threat hunting scores and ML-based hunt scores via CLI. Use when the user says "rs" or asks to rescore all articles or update hunt/ML scores. |
When the user says rs, run both rescore commands. Do not commit or push; this is data-only.
Keyword/regex hunt scores — threat_hunting_score in article metadata:
./run_cli.sh rescore --force
ML hunt scores — ml_hunt_score from chunk-level model predictions:
./run_cli.sh rescore-ml --force
./run_cli.sh rescore --article-id ID --force and ./run_cli.sh rescore-ml --article-id ID --force.--dry-run to either command to preview without writing.git add / commit / push (use lg for that).