Build AI agents and knowledge bases for Falcon Foundry apps. TRIGGER when user asks to "create an AI agent", "add a Foundry agent", "build a knowledge base", "give my agent documents", "expose a collection as an agent tool", "expose an API operation to an agent", "put my agent in Charlotte", "expose an agent as a tool for other agents", "delete an agent or knowledge base", runs `foundry agents create`, `foundry agents delete`, `foundry knowledge-bases create`, or `foundry knowledge-bases delete`, or needs help with the `ai.agents` / `ai.knowledge_bases` manifest blocks, agent system prompts, agent input/output formats, agent exposure, or agent tool references. DO NOT TRIGGER for Fusion SOAR workflow YAML — use workflows-development. DO NOT TRIGGER for serverless function handlers — use functions-development. DO NOT TRIGGER for designing a collection schema itself — use collections-development, then return here to wire the collection up as an agent tool.

Automate Agiled tasks via Rube MCP (Composio). Always search tools first for current schemas.

Finds, reads, and reconstructs coding-agent sessions across Codex, Claude, OpenCode, OMO/Senpi, and other local agent logs. Use when asked to find or search past sessions, transcripts, or subagent runs, or to recover what an earlier session did.

MUST USE for ANY git operations: atomic commits, rebase/squash/fixup, and history search (blame, bisect, log -S, reflog). Load it before running git yourself, or pass load_skills=['git-master'] to the task that commits. Triggers: 'commit', 'rebase', 'squash', 'who wrote', 'when was X added', 'find the commit that'.

MUST USE for ANY git operations: atomic commits, rebase/squash/fixup, and history search (blame, bisect, log -S, reflog). Load it before running git yourself, or pass load_skills=['git-master'] to the task that commits. Triggers: 'commit', 'rebase', 'squash', 'who wrote', 'when was X added', 'find the commit that'.

Audit application source code against the OWASP Top 10:2025 categories — broken access control (incl. SSRF), security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, software and data integrity, logging and alerting failures, mishandling of exceptional conditions — with recon, a coverage ledger, per-finding verification, and a findings.json report. Use when the user mentions 'OWASP,' 'OWASP Top 10,' 'security audit,' 'security review,' 'secure code review,' 'code security review,' 'vulnerability audit,' 'find vulnerabilities,' 'appsec review,' 'application security audit,' 'check for security issues,' 'review this PR for security,' 'pre-merge security check,' 'diff review,' 'broken access control,' 'IDOR,' 'SQL injection,' 'XSS,' 'SSRF,' 'webhook security,' or wants to check their codebase for common security weaknesses.

Writes a Flyway database migration for this project following the team's rules for naming, editing and renaming, so migrations from different developers don't collide and deployed databases stay valid. Use whenever a change needs a new table, column, index or data fix, or the user mentions a schema change or migration.

You are an accessibility expert specializing in WCAG compliance, inclusive design, and assistive technology compatibility. Conduct audits, identify barriers, and provide remediation guidance.

Playwright E2E tests: page objects, cross-browser projects, traces and CI setup. Use when writing or debugging Playwright specs, or configuring Playwright in CI.

Nx workspace rules: running targets, affected commands, generators, project.json and the Nx MCP tools. Use when running or generating anything in an Nx monorepo, editing project.json, or reading its dependency graph.

Notion pages, databases and team knowledge bases through the hosted Notion MCP, with templates for research docs, ADRs, specs and meeting notes. Use when reading, creating or updating Notion pages or querying a Notion database.

Research crypto perpetual swaps, dated futures and options from live public exchange data: funding rates, open interest, basis, liquidations, put/call ratios and max pain. Read-only, no API keys. Use when checking funding across exchanges, comparing open interest, reading the futures term structure, reviewing recent liquidations, or summarizing the options market for BTC or ETH. Trigger with phrases like "funding rate", "open interest", "perpetual swap", "futures basis", "liquidations", "put call ratio", "max pain", "derivatives analysis", or "BTC perps".

Create or refine game UI kits with SpriteCook's concept, component-sheet, extraction, and finalization tools. Use for a requested screen or matching set of reusable controls, including work from an existing SpriteCook concept. Pair with spritecook-workflow-essentials.

Run the upstream Flux controller patch release procedure for helm-controller, image-automation-controller, image-reflector-controller, kustomize-controller, notification-controller, source-controller, and source-watcher. Use when preparing a new controller patch release from a release series branch, drafting changelog entries, tagging releases, and opening the follow-up changelog PRs back to main.

Manage third-party libraries, runtimes, and SaaS dependencies. Use this skill when setting an update cadence, responding to security advisories, dealing with deprecated dependencies, evaluating new dependencies, auditing what's installed, or unblocking a dependency upgrade. Triggers on dependency, package update, security patch, lockfile, deprecated, breaking change, supply chain, dependency audit, npm audit, dependabot, renovate. Also triggers when a build breaks after an update or when an advisory is published for a used package.

Single entry point for IWSDK development. Invoke first for every IWSDK implementation request. Routes fresh builds to an internal planning playbook and bounded changes to an established app to an internal iteration playbook.

Luzmo MCP Server (hosted at /0.1.0/mcp) - connect Claude, Cursor, ChatGPT, Codex, or your own agent to Luzmo, or expose a white-labeled, per-user MCP server to your own end users. Use for MCP client config, Luzmo login (OAuth) vs API key-token vs embed key-token, which tools a session gets and how to enable more (tools, permissions), saved Agent MCP URLs (agentId), product name and chart theme, MCP App chart and dashboard previews, and setting up a workspace through MCP tools (connections, datasets, metadata and AI context, formulas, dashboards, docs search). Triggers on: "Luzmo MCP", "/mcp", "MCP server", "MCP connector for our customers", answer_question, create_chart, generate_dashboard, search_docs, update_dataset_metadata, "agentId in the MCP URL", "tool missing in Claude/Cursor". Not for direct /aiprompt calls, IQ Chat/Answer components, or creating saved Agents and Rules (use ai-analytics), or tenant row isolation in the embed token (use multitenancy).

Triage router for all Luzmo problems. Use first whenever anything is broken, not working, or behaving unexpectedly. Triggers on: "not working", "broken", "why is X failing", "debug", chart "0 height", "chart not loading", "wrong data showing", API errors. Diagnoses root cause by symptom and routes to the right implementation skill. Does NOT implement fixes. Use this skill first - even if you think you know the fix - for any Luzmo error, rendering failure, data anomaly, or unexpected behavior.

This skill should be used when the user says "pick issue", "work on issue", "arness code pick", "arness code pick issue", "arn-code-pick-issue", "grab issue", "pick from backlog", "what should I work on", "show issues", "find issue", "browse issues", "next issue", "select issue", "choose issue", "what's unblocked", "work on next feature", "pick from feature tracker", or wants to browse issues filtered by Arness labels, select one, and route it to the appropriate Arness pipeline skill for implementation. Supports local-first dependency resolution from a greenfield feature backlog when available. Requires an issue tracker (GitHub or Jira) to be configured for remote issue browsing. Do NOT use this for creating new issues — use /arn-code-create-issue for that.

Review frontend code under `web/` or `packages/dify-ui/` when the user explicitly requests a review or audit. Supports PRs, branches, pending changes, files, and pasted diffs. Do not use for implementation-only requests, diagnosis without review intent, or backend-only code.