Debugging

Socratic deep interview with mathematical ambiguity gating before explicit execution approval

Extract a learned skill from the current conversation

Worktree-first dev environment manager for issues, PRs, and features with optional tmux sessions

Turn a repeatable workflow from the current session into a reusable OMC skill draft

LLM Wiki — persistent markdown knowledge base that compounds across sessions (Karpathy model)

Expert-level browser automation, debugging, and performance analysis using Chrome DevTools MCP. Use for interacting with web pages, capturing screenshots, analyzing network traffic, and profiling performance.

Creates, reads, updates, and deletes Arize AI integrations that store LLM provider credentials used by evaluators and other Arize features. Supports any LLM provider (e.g. OpenAI, Anthropic, Azure OpenAI, AWS Bedrock, Vertex AI, Gemini, NVIDIA NIM). Use when the user mentions AI integration, LLM provider credentials, create integration, list integrations, update credentials, delete integration, or connecting an LLM provider to Arize.

Creates and manages annotation configs (categorical, continuous, freeform label schemas) and annotation queues (human review workflows) on Arize. Applies human annotations to project spans via the Python SDK. Use when the user mentions annotation config, annotation queue, label schema, human feedback, bulk annotate spans, update_annotations, labeling queue, annotate record, or human review.

Set up the Discord channel — save the bot token and review access policy. Use when the user pastes a Discord bot token, asks to configure Discord, asks "how do I set this up" or "who can reach me," or wants to check channel status.

Set up the Telegram channel — save the bot token and review access policy. Use when the user pastes a Telegram bot token, asks to configure Telegram, asks "how do I set this up" or "who can reach me," or wants to check channel status.

Iterate on the Cardputer-Adv MicroPython app bundle (Claude Buddy, Snake, Hello) after the device is already provisioned via m5-onboard. Use when the user wants to add a new app, push a single changed .py without re-flashing, watch device serial logs, or run a one-shot REPL command. Trigger on "add an app", "push to the cardputer", "tail the device", "run on the device", or follow-up work after /maker-setup.

Internal guidance for composing Codex and GPT-5.4 prompts for coding, review, diagnosis, and research tasks inside the Codex Claude Code plugin

Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through

Analyze advanced persistent threat (APT) group techniques using MITRE ATT&CK Navigator to create layered heatmaps

Analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached

Campaign attribution analysis involves systematically evaluating evidence to determine which threat actor or

Monitor Certificate Transparency logs using crt.sh and Certstream to detect phishing domains, lookalike certificates,

Extract and analyze Cobalt Strike beacon configuration from PE files and memory dumps to identify C2 infrastructure,

'Analyzes malware command-and-control (C2) communication protocols to understand beacon patterns, command structures,

'Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases

Parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity, and identify

Reverse engineer Go-compiled malware using Ghidra with specialized scripts for function recovery, string extraction,

'Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware,

Examine Linux system artifacts including auth logs, cron jobs, shell history, and system configuration to uncover