Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. Builds KQL queries for threat hunting in Azure environments. Use when investigating suspicious Azure tenant activity or building cloud SIEM detections.

Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.

Use when main results pass result-to-claim (`claim_supported = yes` or `partial`) and ablation studies are needed for paper submission. A secondary Codex agent designs ablations from a reviewer's perspective; the local executor reviews feasibility and implements.

Optimizes application performance. Use when performance requirements exist, when you suspect performance regressions, or when Core Web Vitals or load times need improvement. Use when profiling reveals bottlenecks that need fixing.

Use when creating new skills, editing existing skills, or verifying skills work before deployment

Use when you need to set up Java application profiling to detect and measure performance issues — including automated async-profiler v4.0 setup, problem-driven profiling (CPU, memory, threading, GC, I/O), interactive profiling scripts, JFR integration with Java 25 (JEP 518, JEP 520), or collecting profiling data with flamegraphs and JFR recordings. This should trigger for requests such as Improve the code with profiling; Apply Profiling; Refactor the code with profiling; Add profiling support. Part of cursor-rules-java project

Use when you need to generate an AGENTS.md file for a Java repository — covering project conventions, tech stack, file structure, commands, Git workflow, and contributor boundaries — through a modular, step-based interactive process that adapts to your specific project needs. This should trigger for requests such as Create AGENTS.md; Update AGENTS.md file; Add agent instructions. Part of cursor-rules-java project

Use when you need to verify Java performance optimizations by comparing profiling results before and after refactoring — including baseline validation, post-refactoring report generation, quantitative before/after metrics comparison, side-by-side flamegraph analysis, regression detection, or creating profiling-comparison-analysis and profiling-final-results documentation. This should trigger for requests such as Verify performance fix; Verify the performance; Verify the memory; Verify the threading. Part of cursor-rules-java project

Use when you need to generate Architecture Decision Records (ADRs) for a Java project through an interactive, conversational process that systematically gathers context, stakeholders, options, and outcomes to produce well-structured ADR documents. This should trigger for requests such as Generate ADR; Create Architecture Decision Record; Document architecture decision; Architecture Decision Record for Java. Part of cursor-rules-java project

Render a documentation-style Cursor Canvas that organizes architecture notes, API references, walkthroughs, and how-tos into a navigable layout with sections, tables of contents, and cross-references. Use when the user asks for a docs canvas, documentation overview, architecture walkthrough, API reference page, or wants to render structured documentation as an interactive canvas.

CRITICAL: Use for type-driven design. Triggers: type state, PhantomData, newtype, marker trait, builder pattern, make invalid states unrepresentable, compile-time validation, sealed trait, ZST, 类型状态, 新类型模式, 类型驱动设计

CRITICAL: Use for domain modeling. Triggers: domain model, DDD, domain-driven design, entity, value object, aggregate, repository pattern, business rules, validation, invariant, 领域模型, 领域驱动设计, 业务规则

Guides the creation of agile user stories and Gherkin feature files. Use when the user wants to create a user story, write acceptance criteria, define Gherkin scenarios, or author BDD feature files. This should trigger for requests such as Create a user story; Write a user story; I need to write a user story. Part of cursor-rules-java project

This skill should be used when the user says "feature spec teams", "arness code feature spec teams", "team feature spec", "debate this feature", "collaborative feature spec", "spec with agent teams", "multi-agent feature spec", "feature spec debate", or wants to develop a feature idea through structured debate between multiple specialist agents (architects, UX experts, and security specialists) before writing the specification. Uses Claude Code's experimental Agent Teams feature. Requires Agent Teams to be enabled. For standard single-agent feature spec, use arn-code-feature-spec instead.

This skill should be used when the user says "static prototype", "arn static prototype", "visual validation", "pixel perfect", "component showcase", "static screens", "build a static prototype", "create a component showcase", "visual review", "validate the visuals", "check the design", "validate components", "review the design visuals", or wants to create a static component showcase and validate it through iterative expert review cycles with per-criterion scoring, an independent judge verdict, and versioned output.

This skill should be used when the user says "use cases", "arn use cases", "write use cases", "define use cases", "Cockburn use cases", "actor goals", "behavioral requirements", "system behavior", "what does the app do", "describe the behavior", "use case document", "document the behavior", "define system behavior", or wants to create structured use case documents that describe the application's behavior from actor perspectives, producing a use-cases/ directory with individual Cockburn fully-dressed use case files and a README index.

Optional customization tool for infrastructure projects. This skill should be used when the user says "infra init", "arn infra init", "initialize infra", "setup infrastructure", "arn-infra-init", "configure infra", "init infra", "infrastructure setup", "set up infrastructure", "infra setup", "start infra", "configure arn infra", "add infrastructure to this project", "review infra config", "customize infra config", "infra settings", or wants to configure providers, environments, IaC tools, CI/CD platform, or review current infrastructure settings. Arness Infra auto-configures with sensible defaults on first skill invocation — this init is optional for basic usage but required for provider/environment configuration.

This skill should be used when the user says "discover", "product discovery", "arn discover", "help me define this product", "what should I build", "product concept", "define the product", "let's figure out what to build", "vision for this project", "shape this idea", "new project idea", "brainstorm this product", "starting from scratch", or wants to explore and structure a greenfield product idea through guided conversation. Produces a product-concept.md document capturing the product vision, core experience, target users, trust model, platforms, and scope boundaries.

This skill should be used when the user says "refresh infra references", "update tool versions", "check for new MCPs", "update infra patterns", "refresh registries", "arn infra refresh", "infra refresh", "update references", "check for updates", "refresh infrastructure tools", "update MCP servers", "refresh CLI versions", "update base images", "arn-infra-refresh", or wants to update the version-sensitive infrastructure reference files (tool versions, MCP packages, CLI commands, base image tags, IaC patterns) using online research.

This skill should be used when the user says "feature spec", "arness code feature spec", "arn-code-feature-spec", "spec this feature", "help me spec", "design this feature", "feature design", "write a spec", "create a specification", "I have an idea for a feature", "let's flesh out this feature", "decompose feature", "spec XL feature", "resume spec", "continue spec", "finish my spec", "break down feature", or wants to iteratively develop a feature idea into a well-formed specification through guided conversation with architectural analysis. For XL features with decomposition hints, creates multiple sub-feature specs with full traceability. Produces specification documents capturing WHAT to build and WHY, which then feed into plan creation.