Expert Australian Information Security Manual (ISM) advisor for government entities and their supply chains. Use for ISM control selection, gap analysis, system authorisation, IRAP assessment preparation, security documentation, and ASD compliance. Triggers on: ISM controls, ASD compliance, IRAP assessment, PROTECTED system scoping, Essential Eight vs ISM, system authorisation, NC/OS/ PROTECTED/SECRET/TOP SECRET classification markings, security objectives, ISM guidelines or chapters, control applicability markings, cybersecurity documentation for Australian government, the June 2026 ISM update, ISM AI application controls (ISM-2112/2113/2114), and any question about the ASD Information Security Manual framework or Australian government cybersecurity obligations.

Expert ITAR compliance advisor for US defense contractors, exporters, and manufacturers. Use this skill for any question about 22 CFR Parts 120-130, the United States Munitions List (USML), DDTC registration, export license applications (DSP-5/73/94), Technical Assistance Agreements (TAA), Manufacturing License Agreements (MLA), brokering regulations (Part 129), deemed export rules for foreign nationals, technology control plans, voluntary disclosures, violation mitigation, jurisdiction determination (ITAR vs EAR), or US Munitions List category scoping. Trigger even if the user doesn't say "skill" — any ITAR or US defense export control question should use this skill.

Expert CMMC 2.0 (Cybersecurity Maturity Model Certification) advisor for US defense contractors and subcontractors in the Defense Industrial Base (DIB). Use this skill whenever a user asks about CMMC 2.0, CMMC Level 1, Level 2, or Level 3, DoD cybersecurity compliance, NIST SP 800-171, CUI (Controlled Unclassified Information) protection, System Security Plan (SSP), Plan of Action & Milestones (POA&M), C3PAO assessments, DIBCAC audits, self-assessment, SPRS score, or any requirement under DFARS 252.204-7012 or 7021. Also trigger for: "CMMC gap analysis", "CMMC readiness", "FCI protection", "CUI scoping", "CMMC practices", "DoD contract cybersecurity", "defense supply chain security", "prime contractor flow-down requirements", the July 2026 CMMC Phase 2 suspension, or the CMMC Reform Task Force.

EU AI Act (Regulation (EU) 2024/1689) compliance advisor — risk classification across all four tiers, all 9 prohibited practices (Art. 5, including the nudification/CSAM prohibition from Dec 2, 2026), all 8 Annex III high-risk use case areas, provider and deployer obligations (Arts. 9–17, 26), GPAI model obligations including the July 2025 Code of Practice (Arts. 51–55), conformity assessment and CE marking (Arts. 43–48), EU AI database registration, Art. 50 transparency (chatbots, synthetic media, AI-generated content), governance (AI Office, AI Board), penalties (Art. 99), confirmed phase-in timeline (Digital Omnibus, Reg. (EU) 2026/1744, in force July 27, 2026: Annex III deferred to Dec 2, 2027; Annex I to Aug 2, 2028), and cross-framework mapping to ISO 42001, NIST AI RMF, and GDPR. Use for any EU AI regulation, AI system classification, or AI compliance question. Current as of August 2026. GPAI enforcement powers active since August 2, 2026.

Check which Rust lines are not covered by Rust tests. Use this when you developed new Rust code and want to ensure it is tested.

Picks the right Netlify site-protection layer and disambiguates the three unrelated "auth" concepts users conflate — app-user login (Netlify Identity), site-load gating (Password Protection / project visibility), and dashboard SAML SSO. Use it when asked to password-protect a site or Deploy Preview, make a project private/public, restrict a site to your team, require SSO to view a site, set up company-wide or internal-app SSO, invite users to a private project, or know which team member made a request to a private site. Also use it for SSO-session symptoms on protected sites: "logged out mid-session", 401s after about an hour, or token expiry/refresh questions. Not for wiring auth code — route app-login setup to netlify-identity.

When the user wants help with public relations, earned media, press coverage, journalist outreach, or media strategy (not pull requests). Also use when the user mentions 'PR,' 'public relations,' 'press,' 'press release,' 'press coverage,' 'media outreach,' 'pitch a journalist,' 'get featured,' 'media list,' 'media kit,' 'press kit,' 'newsjacking,' 'news hijack,' 'HARO,' 'Qwoted,' 'Featured,' 'Help A Reporter,' 'reporter request,' 'tech press,' 'TechCrunch,' 'earned media,' 'thought leadership placement,' 'op-ed,' 'guest article,' 'press contacts,' or 'how do I get press.' Use this for earned media work — finding journalists, pitching stories, newsjacking, and responding to press requests. For startup/SaaS/AI directory submissions, see directory-submissions. For product launches, see launch. For social-media engagement, see social. For cold-email outreach to prospects, see cold-email.

Generate Harness v0 Template YAML for reusable pipeline components (Step, Stage, Pipeline, StepGroup) and create them via MCP. Use when asked to create a template, build a step template, stage template, pipeline template, or reusable step. Do NOT use for checking template usage or references (use template-usage instead). Trigger phrases: create template, step template, stage template, pipeline template, reusable step, template YAML.

Use when asked to set up PR attestation, install harness-scs attestation hook, configure agent attestor, troubleshoot why agent attestation isn't uploading, or reconfigure an existing attestation hook (different SCM, new cosign key, updated Harness identity). Trigger phrases: set up PR attestation, install harness-scs attestation hook, configure agent attestor, why isn't my agent attestation uploading, set up agent attestation, configure PR signing, install attestation hook, configure claude attestation.

Use when the user asks to create, edit, update, design, or configure a Harness Chaos Experiment — including faults, probes, actions, experiment YAML, fault injection, pod-delete, or resilience tests. Do not use for Chaos steps inside a pipeline or a DRTest stage; use chaos-dr-test for those. Do not use to run an experiment, list past runs, or inspect run results — call the Chaos MCP tools directly for those (see Performance Notes). Trigger phrases: chaos experiment, chaos engineering, resilience test, fault injection, pod-delete, chaos hub template.

Approve pending Harness STO security exemptions (waivers) at their current scope or elevate them to Project, Org, or Account scope. Users say "approve" for both in-scope approval and higher-scope elevation — do not require the word "promote". Supports approving one exemption or a mixed list where each row has a different approval scope. Default workflow lists pending exemptions in chat (paginated preview) so the user picks by row number — no copying from the Harness UI. Use when a user wants to approve, sign off on, or clear pending exemptions, waive approvals, org-wide approval, or account-wide approval. Trigger phrases: approve exempt, approve exemption, approve waiver, sign off exemption, clear pending exemption, approve for org, approve for account, org-wide approval, account-wide approval, pending exemptions.

Generate or review Django database migrations for Sentry. Use when creating or reviewing migrations and data migrations, adding/removing columns or tables, adding indexes, or resolving migration conflicts.

Build Progressive Web Apps (PWAs) with offline support, installability, and caching strategies. Trigger whenever the user mentions PWA, service workers, web app manifests, Workbox, 'add to home screen', or wants their web app to work offline, feel native, or be installable.

Build Progressive Web Apps (PWAs) with offline support, installability, and caching strategies. Trigger whenever the user mentions PWA, service workers, web app manifests, Workbox, 'add to home screen', or wants their web app to work offline, feel native, or be installable.

Build Progressive Web Apps (PWAs) with offline support, installability, and caching strategies. Trigger whenever the user mentions PWA, service workers, web app manifests, Workbox, 'add to home screen', or wants their web app to work offline, feel native, or be installable.

Audit how far an organisation's operating model has actually moved from project to product, across strategic alignment, people and leadership, structure and governance, and the value cycle. Runs a ten-probe short read by default and a forty-probe deep audit on request, places the organisation as Project Silo, Transitional Lab or Product-Led Engine, and ends in one experiment against the binding dimension. Use before or during a project-to-product transformation, when "we do product now" needs a reality check, or when teams are visibly busy and the business strategy is not moving. If the question is broad — AI pilots with no clear return, or "where do we start" — run ai-activity-to-impact first; it triages and routes here.

Use when raising the go directive in go.mod, or CI fails with 'go.mod requires go >= X (running go Y; GOTOOLCHAIN=local)'. Make CI install the go.mod version.

Automate Aeroleads tasks via Rube MCP (Composio). Always search tools first for current schemas.

Use when migrating orchestration cluster webapp pages or components from Carbon to the Camunda design system (shadcn), including parallel routes, side-by-side components, and migration tests.

Next.js App Router conventions, server and client components, data fetching, caching and route protection, by Next version. Use when building or debugging a Next.js app, its caching, middleware/proxy or hydration errors.