Comprehensive security scan with full reachability analysis. Builds call graphs to determine which vulnerabilities are actually exploitable in your code. Use when the user says "full scan", "deep scan", "reachability scan", "which vulns are actually reachable", "endor scan full", or before a release. Takes 2-5 minutes. Do NOT use for quick daily scans (/endor-scan) or checking individual packages (/endor-check).

Pre-PR security review of your current branch or git diff. Use when the user says "review my changes", "ready to merge", "pre-PR check", "security review before PR", "endor review", or is about to create a pull request. Runs dependency checks, SAST, secrets detection, and license compliance as a security gate. Do NOT use for scanning repos outside the current branch (/endor-scan) or checking individual packages (/endor-check).

Scan a repository's GitHub Actions workflows for insecure patterns and vulnerable third-party action versions using Endor Labs. Use when the user says "scan GitHub Actions", "workflow security", "endor ghactions", "insecure CI workflow", "vulnerable action version", "harden my GHA workflows", or focuses on `.github/workflows` without asking for a full dependency or secrets scan. Do NOT use for combined supply chain reports (/endor-supply-chain), generic quick scans (/endor-scan), adding Endor to pipelines (/endor-cicd), or dependency-only checks (/endor-check).

Remediate security vulnerabilities by finding safe upgrade paths. Use when the user says "fix this vulnerability", "how do I fix CVE-XXXX", "remediate this finding", "patch this vuln", "endor fix", or wants step-by-step fix instructions for a specific CVE, finding, or vulnerable package. Can apply fixes automatically. Do NOT use for general scanning (/endor-scan) or just viewing vulnerability info (/endor-explain).

Get detailed information about a specific CVE or security finding. Use when the user says "what is CVE-2024-XXXXX", "explain this vulnerability", "tell me about GHSA-...", "endor explain", "finding details", or wants to understand severity, impact, attack vectors, and affected versions for a specific issue. Do NOT use for fixing a vuln (/endor-fix) or listing all findings (/endor-findings).

Fetch and display AI-powered SAST findings from the Endor Labs platform. Default path is summary-only (aggregated counts + clusters); full masked listing runs only when the user asks to drill down (speed and token use). Use when the user says "AI SAST results", "AI SAST findings", "AI static analysis", "endor ai sast", "show AI SAST", or wants pre-computed AI-driven code security findings. Do NOT use for running a new SAST scan (/endor-sast), viewing general findings (/endor-findings), or explaining a specific CVE (/endor-explain).

Replace the client-side agent loop with Databricks Supervisor API (hosted tools + client-side function tools). Use when: (1) User asks about Supervisor API, (2) User wants Databricks to run the agent loop server-side, (3) Connecting Genie spaces, UC functions, agent endpoints, or MCP servers as hosted tools, (4) Mixing client-side function tools (Python callables your app executes) with hosted tools.

Replace the client-side agent loop with Databricks Supervisor API (hosted tools + client-side function tools). Use when: (1) User asks about Supervisor API, (2) User wants Databricks to run the agent loop server-side, (3) Connecting Genie spaces, UC functions, agent endpoints, or MCP servers as hosted tools, (4) Mixing client-side function tools (Python callables your app executes) with hosted tools.

Add tools to your agent and grant required permissions in databricks.yml. Use when: (1) Adding MCP servers, Genie spaces, vector search, or UC functions to agent, (2) Permission errors at runtime, (3) User says 'add tool', 'connect to', 'grant permission', (4) Configuring databricks.yml resources.

Discover available tools and resources in Databricks workspace. Use when: (1) User asks 'what tools are available', (2) Before writing agent code, (3) Looking for MCP servers, Genie spaces, UC functions, or vector search indexes, (4) User says 'discover', 'find resources', or 'what can I connect to'.

Replace the client-side agent loop with Databricks Supervisor API (hosted tools + client-side function tools). Use when: (1) User asks about Supervisor API, (2) User wants Databricks to run the agent loop server-side, (3) Connecting Genie spaces, UC functions, agent endpoints, or MCP servers as hosted tools, (4) Mixing client-side function tools (Python callables your app executes) with hosted tools.

Automate All Images AI tasks via Rube MCP (Composio). Always search tools first for current schemas.

Automate AI ML API tasks via Rube MCP (Composio). Always search tools first for current schemas.

Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.

Preview the model-routing MAP for an intent without building anything. You give it a free-text INTENT — "build a CLI that…", "add a feature that…", "refactor X into Y" — and it invokes the `model-right-sizer` agent in BLUEPRINT-ONLY mode: decompose the work, score each piece, and emit a single schema-conformant JSON blueprint (task→model→effort→budget→ schema→confidence, per `schemas/blueprint.schema.json`), then STOP. No build, no file edits, no after-the-fact usage report — it is the what-would-this-cost / how-would-this-route preview lever, safe to run against any idea, and the JSON it returns is what an orchestrator parses to route dispatch. Read-only. Use when someone says "dry-run the right-sizer on …", "what's the map for …", "how would you route …", or "show me the blueprint for … before I build it".

Cut a release of this repository (the CloudZero plugin marketplace itself — not a customer-facing plugin). Promotes every touched plugin's own `Unreleased` changelog section to a dated entry, synthesizes those changes into a new SemVer section at the top of the root `CHANGELOG.md`, bumps `.claude-plugin/marketplace.json`'s version, runs the full CI validation suite locally, tags the release, publishes a GitHub Release, and opens the companion docs PR against `Cloudzero/cloudzero-documentation`'s `v2.0` branch so customer-facing docs land in step with the code. This is a maintainer-only, repo-local skill (lives in `.claude/skills/`, not inside a `plugins/*/skills/` directory) — it is never installed by marketplace consumers. Use when told "cut a release", "release the marketplace", "ship a new version", "promote the changelog", or after merging PR(s) that need a version bump and a docs update — mirroring how v1.2.0 (the Model Right Sizer launch) shipped.

Autonomously work one task from an issues/ queue end-to-end — explore, implement (TDD when applicable), run feedback loops, commit, update the issue file. Step 3 of the build pipeline (write-a-prd → prd-to-issues → work-issues). Heavyweight (commits code, modifies the issue queue). Use only when explicitly asked: /work-issues, "work the issue queue", "run an AFK iteration", "do one issue end-to-end", OR when another orchestrator skill (e.g. /feature) needs to dispatch an AFK iteration programmatically. Headless loop runner: bin/loop.sh.

Use this skill to set up and provision Algolia from scratch: create a new Algolia account, sign up, log in / authenticate the Algolia CLI, or provision a new application to obtain an App ID and API key. Trigger when a user is getting started with Algolia and has no account, no application, or no credentials yet — e.g. "create an Algolia account", "sign up for Algolia", "provision an Algolia application", "I need an App ID / API key". Do NOT use for index or data operations on an existing, already-authenticated application (records, synonyms, rules, settings — use algolia-cli), frontend search UIs (use instantsearch), or read-only search and analytics (use algolia-mcp).

Plan and produce video and visual assets for product launches — demo videos, GIFs, screenshots, and programmatic video with Remotion. Use this skill whenever someone asks to create a demo video, record a product walkthrough, make a launch GIF, plan visual assets for a launch, or decide what media to create for an announcement. Also trigger for "what should our demo video show," "how do we record the product," "I need visuals for the launch," "make a video for this launch," or any request about creating non-text media tied to a product release. Covers video scripting, recording, programmatic video (Remotion), GIF creation, screenshot best practices, and per-platform format guidance.

Plan and execute product launches using a tiered framework — from major new products down to small improvements. Use this skill whenever someone asks to plan a launch, create a launch checklist, define launch tiers, write launch messaging, or coordinate a product release. Also trigger when someone says "we're launching X" or "how should we announce this feature" or "what's our launch plan" — even if they don't use the word "strategy." Covers messaging, naming, launch assets, timelines, and post-launch retros. This is the master launch skill; it references the companion skills (launch-tweet, launch-landing-page, launch-distribution, launch-email, launch-video, launch-metrics) for specific execution.