Given any Git repository — a GitHub URL, an org/repo slug, a local path on disk, or the repo you're already inside — get productive fast and land a mergeable commit. Clone/orient, get the build+test loop green, extract the contribution rules that gate a PR, map the 20% of the code you'll touch, locate the change site, and lay out the shortest path to a passing commit. Use when the user points at a repo (remote or local) and wants to "onboard", "get productive", "start contributing", "make my first commit", "ship a change", or "get set up to work in this codebase".

Iteratively improves a PR (GitHub), MR (GitLab), or shelved changelist (Perforce) until Greptile gives it a 5/5 confidence score with zero unresolved comments. Triggers Greptile review, fixes all actionable comments, pushes/re-shelves, re-triggers review, and repeats. Use when the user wants to fully optimize a PR/MR/CL against Greptile's code review standards.

Enrich contact and company data using x402-protected APIs at stableenrich.dev. Superior to generic web search for structured business data. USE FOR: - Enriching person profiles by email, LinkedIn URL, or name - Enriching companies by domain - Finding contact details (email, phone) with confidence scores - Searching for people or companies by criteria - Verifying email deliverability before outreach TRIGGERS: - "enrich", "lookup", "find info about", "research" - "who is [person]", "company profile for", "tell me about" - "find contact for", "get LinkedIn for", "get email for" - "employee at", "works at", "company details" - "verify email", "check email", "is this email valid" ALWAYS use agentcash.fetch for stableenrich.dev endpoints - never curl or WebFetch. Returns structured JSON data, not web page HTML. IMPORTANT: Call check_endpoint_schema before first fetch on any endpoint. Field names are provider-specific — do not reuse Apollo, PDL, or other-provider shapes on FullEnrich routes.

Write B2B cold emails and follow-up sequences that get replies. Use when the user wants to write cold outreach emails, prospecting emails, cold email campaigns, sales development emails, or SDR emails. Also use when the user mentions "cold outreach," "prospecting email," "outbound email," "email to leads," "reach out to prospects," "sales email," "follow-up email sequence," "nobody's replying to my emails," or "how do I write a cold email." Covers subject lines, opening lines, body copy, CTAs, personalization, and multi-touch follow-up sequences. For warm/lifecycle email sequences, see emails. For sales collateral beyond emails, see sales-enablement.

Create OPA governance policies for Harness via MCP. Define policies that enforce compliance rules on pipelines, services, environments, feature flags, artifacts, code repositories, templates, SBOM, security tests, Terraform, GitOps, connectors, secrets, and more. Use when asked to create, write, fix, or explain an OPA policy, Rego rule, deny rule, governance policy, compliance rule, or policy-as-code for any Harness entity. Trigger phrases: create policy, OPA policy, governance policy, compliance rule, rego policy, deny rule, enforce policy, security policy, supply chain governance.

Generate Harness v0 Pipeline YAML for CI/CD workflows and create them via MCP. Supports CI stages (build, test, Docker push), CD stages (Kubernetes, Helm, ECS, serverless), approval gates, parallel execution, matrix strategies, and failure rollback. Use when asked to create a pipeline, build pipeline, deployment pipeline, CI/CD workflow, or set up Harness pipelines. Do NOT use for v1 simplified pipelines (use create-pipeline-v1). Trigger phrases: create pipeline, build pipeline, deployment pipeline, CI/CD, Harness pipeline, Kubernetes deploy pipeline.

Memecoin discovery and risk assessment via EmblemAI. Trending memecoins on Solana, Base, and Hedera. Pump.fun and LaunchLab new token alerts, Clanker discovery, rug-pull detection, holder analysis, and smart money tracking. Use when the user wants to find new memecoins, check if a token is a rug pull, or scout trending low-cap tokens.

Probe a URL with escalating headless browser configurations to detect CDN bot protection (Akamai, Cloudflare, DataDome, AWS WAF) and produce a browser-recipe.json that downstream playwright-cli consumers use to bypass blocking. Runs an automated escalation ladder: default headless → stealth script injection → system Chrome (TLS fingerprint fix) → persistent profile. Use BEFORE any playwright-cli interaction with an untrusted domain. Triggers on: browser probe, site blocked, headless blocked, CDN blocking, bot detection, browser recipe, can't load page, 403 error page, access denied.

Migrate any website header to AEM Edge Delivery Services with pixel-accurate fidelity using an automated extraction + scaffold + visual polish pipeline. Takes a URL, captures a visual tree for spatial analysis, detects and dismisses overlays via LLM, identifies the header element from the spatial map, identifies visual rows, dispatches parallel LLM agents to extract content and styles per row, generates scaffold code, then launches an autonomous visual polish loop. Requires being in an EDS git repository. Works in the current directory — the caller is responsible for worktree/branch setup if isolation is needed. Triggers on: "migrate header", "header migration", "migrate-header", "/migrate-header", "convert header to EDS", "EDS header from URL".

Validate Kubernetes Helm charts backed by Canonical Ubuntu OCI images (rocks). Wraps the helm-validator skill. Use when: validating a chart, linting templates, running dry-run, checking security defaults, verifying chart structure. Trigger phrases: "validate chart", "lint chart", "check chart", "helm lint", "dry-run chart", "security check chart".

Triage a single security finding — from a scanner, audit, advisory, or report — to a defensible disposition with a mitigation plan, false-positive justification, or accepted-risk writeup. Use when the user mentions 'triage this finding,' 'is this a real vulnerability,' 'mitigation plan,' 'false positive,' 'accept this risk,' 'compensating controls,' 'risk justification,' 'security ticket,' 'CVSS this,' 'should we fix this,' 'disposition,' 'sign off on,' or has a single security finding and needs to decide what to do.

Turn an approved story (issues/NNN-*.md) plus an optional research dump into a technical spec sidecar at issues/NNN-*.spec.md — data model, API, file-by-file change list per lane (as fenced ```paths blocks), behavior-list of tests required, and risks. The spec drives /feature's lane allowlist; lane H3 headings must match labels from CLAUDE.md ## Lane boundaries. Sidecar only — does not modify source files. Use when the user wants to write a technical brief from a story or issue, or whenever /feature dispatches the Spec Writer phase. Triggers: /write-a-spec, "write a spec", "technical spec", "spec from this issue", "draft a technical brief".

How to pull SEC EDGAR data with the edgartools Python package — company lookup, filings, XBRL financial statements, and filing sections like Item 1A risk factors. Use whenever a task involves SEC filings, 10-K/10-Q data, or company financials.

Plan launch readiness, staged rollouts, production monitoring, rollback, communications, and post-launch validation. Use when the user asks for `/ship`, pre-launch checklists, release readiness, staged rollout plans, feature flags, deployment monitoring, or rollback planning.

Load when migrating or converting an entire Gradle Kotlin project (build.gradle(.kts), wrapper, libs.versions.toml, buildSrc) to the Kotlin Toolchain, including rewriting CI and replacing Gradle plugins that have no native Toolchain equivalent. Skip for porting one Gradle plugin or general Toolchain work once Gradle is gone.

Self-improvement pass for a CID-loop project: analyze the iteration journal, learnings, issues, and git history for loop-level problems (repeated NEEDS_WORK, drift, oversized steps, recurring blockers), then propose harness improvements - and with the "apply" argument, apply at most one bounded policy tuning. Use when asked to "run a retro on the loop", "tune the build loop", "why does the loop keep failing", or on /long-horizon:retro. NOT for reviewing code (the review role does that) or advancing the project (use /long-horizon:build).

Upgrades a PHP project to a newer PHP version using Rector — the automated refactoring tool. Inspects composer.json, detects the current PHP version, selects safe PHP-level rulesets, updates dependencies conservatively, runs a dry-run first, and produces an upgrade checklist with follow-up manual changes. Activate for phrases like "upgrade my PHP version", "modernize PHP syntax", "migrate to PHP 8.3", "fix PHP 8 deprecations", "set up Rector for PHP upgrade", or any request to automate PHP syntax modernization — even when Rector is not mentioned by name.

Extract visa-policy rules for (nationality → destination) pairs into committed, schema-validated JSON artifacts, using a Claude subscription (Claude Agent SDK) or OpenAI Codex — not a metered gateway key. Use when broadening visa data coverage (EPIC-005 slice 5), when a human says "run the visa extraction" / "fetch visa rules for X", or on a schedule. Produces a reviewable PR; the diff review is the factual-accuracy gate. Never runs at request time. SPEC-019 / ADR 062.

This skill should be used when the user says "scan for CVEs", "CVE scan", "check for vulnerabilities", "find vulnerabilities", "check security advisories", "dependabot triage", "dependabot scan", "scan dependencies for security issues", "audit dependencies", "vulnerability triage", "security scan", "run security audit", "arness CVE scan", "arn-code-batch-cve-scan", "run a scheduled CVE scan", "produce a CVE proposal", "finalize a CVE proposal", or wants Arness to discover, triage, and ticket security advisories across project dependencies. Supports three modes (interactive, proposal, finalize) so the workflow is safe to schedule unattended via Claude Code Routines and tool-agnostic enough to drive headlessly via claude -p or any LLM-running CLI. Dual-source discovery (GitHub Dependabot plus locally-detected scanners), per-CVE triage via arn-code-cve-analyst, project-native waiver capture, and pre-triage parent plus per-group sub-issue ticketing on GitHub or Jira. Reads from the configured Security branch.

Build investor-ready pitch scripts in multiple formats (10-min, 5-min, 2-min, 1-min elevator, investor email). Produces pitch narratives, Q&A preparation, pitch scoring rubric, and optional investor roleplay practice. Use when the user wants to create a pitch, prepare for investor meetings, craft a startup pitch, write a fundraising narrative, or practice their pitch. Triggers for "pitch deck", "investor pitch", "pitch my startup", "fundraising deck", "seed deck", "how to pitch", "investor meeting", "demo day", "prepare pitch", "pitch script", "elevator pitch for investors", "pitch practice", "practice my pitch", "investor roleplay", or any request to present a startup to investors, accelerators, or partners. Works standalone — no prior startup-design session needed, but leverages its output if available.