[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6BYQNNRAPDFWHV1V6AXAJWF":3,"skill-same:01M6BYQNNRAPDFWHV1V6AXAJWF":139},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":79,"commitSha":80,"skillDirectory":81,"forksCount":82,"repositoryHtmlUrl":83,"repositoryHomepageUrl":6,"ownerHtmlUrl":84,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":85,"install":86,"resources":99},"01M6BYQNNRAPDFWHV1V6AXAJWF","code-review",null,"Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes: Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue\u002Fspec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to \"review since X\".","Vortex375\u002Fseraph","Vortex375","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F5016523?v=4","01M6BYMHA5FQE4EMD6BSZ13M46","Benjamin Schmitz","01M6BYMHEYGQ7DM3Q8A7KBNZ48",2,"AGPL-3.0","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fcode-review\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"review","code review","code","when","point","changes","for","reviews","progress","what the","reports","standards","use","repo","branch","work","parallel","coding","coding standards","pr","merge","commit","spec","2026-11-10 10:12:30",false,"---\nname: conducting-post-incident-lessons-learned\ndescription: Facilitate structured post-incident reviews to identify root causes,\n  document what worked and failed, and produce actionable recommendations to improve\n  future incident response.\ndomain: cybersecurity\nsubdomain: incident-response\ntags:\n- incident-response\n- lessons-learned\n- post-incident\n- after-action-review\n- process-improvement\nmitre_attack:\n- T1566\n- T1486\n- T1059\n- T1078\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.MA-01\n- RS.MA-02\n- RS.AN-03\n- RC.RP-01\n---\n\n# Conducting Post-Incident Lessons Learned\n\n## When to Use\n- After any security incident has been fully resolved and recovery completed\n- Following tabletop exercises or IR simulations\n- After significant near-miss events\n- Quarterly review of accumulated incident trends\n- When IR playbooks need updating based on real-world experience\n\n## Prerequisites\n- Incident fully resolved (containment, eradication, recovery complete)\n- Incident timeline and documentation gathered\n- All incident responders available for review session\n- Meeting space for collaborative discussion\n- Incident ticketing system data for metrics analysis\n\n## Workflow\n\n### Step 1: Gather Incident Data\n```bash\n# Export incident timeline from ticketing system\ncurl -s \"https:\u002F\u002Fthehive.local\u002Fapi\u002Fv1\u002Fcase\u002F$CASE_ID\u002Ftimeline\" \\\n  -H \"Authorization: Bearer $THEHIVE_API_KEY\" | jq '.' > incident_timeline.json\n\n# Extract detection and response metrics from SIEM\nindex=notable incident_id=\"IR-2024-042\"\n| stats min(_time) as first_alert, max(_time) as last_alert,\n  count as total_alerts, dc(src) as unique_sources\n\n# Compile all responder actions and timestamps\ngrep -E \"timestamp|action|analyst\" \u002Fvar\u002Flog\u002Fir\u002FIR-2024-042\u002F*.json | \\\n  python3 -m json.tool > compiled_actions.json\n```\n\n### Step 2: Conduct Blameless Post-Mortem Meeting\n```\nStructured Agenda (90 minutes):\n1. Incident summary (5 min) - Factual overview\n2. Timeline walkthrough (20 min) - Chronological events\n3. What worked well (15 min) - Positive outcomes\n4. What needs improvement (15 min) - Gaps and failures\n5. Root cause analysis (15 min) - 5 Whys or fishbone\n6. Action items (10 min) - Specific improvements with owners\n7. Playbook updates (10 min) - Changes to IR procedures\n\nBlameless Principles:\n- Focus on systems and processes, not individuals\n- Assume best intentions with available information\n- Seek to understand, not to blame\n```\n\n### Step 3: Perform Root Cause Analysis\n```bash\n# 5 Whys analysis example:\n# Why 1: Why did ransomware encrypt production servers?\n#   Answer: Attacker had domain admin credentials\n# Why 2: Why did attacker have domain admin credentials?\n#   Answer: Kerberoasted a service account and cracked it\n# Why 3: Why was the service account password crackable?\n#   Answer: Used a 12-character dictionary-based password\n# Why 4: Why was the service account password weak?\n#   Answer: No enforcement of service account password policy\n# Why 5: Why was there no service account password policy?\n#   Answer: PAM was not implemented for service accounts\n# ROOT CAUSE: Lack of privileged access management\n```\n\n### Step 4: Calculate Response Metrics\n```python\nfrom datetime import datetime\nevents = {\n    'compromise': '2024-01-10 14:00:00',\n    'detection': '2024-01-15 08:30:00',\n    'triage': '2024-01-15 08:45:00',\n    'containment': '2024-01-15 09:30:00',\n    'eradication': '2024-01-16 14:00:00',\n    'recovery': '2024-01-18 16:00:00',\n    'closure': '2024-01-25 10:00:00',\n}\nfmt = '%Y-%m-%d %H:%M:%S'\ntimes = {k: datetime.strptime(v, fmt) for k, v in events.items()}\nprint(f\"Dwell Time: {times['detection'] - times['compromise']}\")\nprint(f\"MTTD: {times['triage'] - times['detection']}\")\nprint(f\"MTTC: {times['containment'] - times['detection']}\")\nprint(f\"MTTR: {times['recovery'] - times['eradication']}\")\nprint(f\"Total Duration: {times['closure'] - times['detection']}\")\n```\n\n### Step 5: Document Findings and Create Action Items\n```bash\n# Create tracked action items in project management\ncurl -X POST \"https:\u002F\u002Fjira.local\u002Frest\u002Fapi\u002F2\u002Fissue\" \\\n  -H \"Authorization: Bearer $JIRA_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"fields\": {\n      \"project\": {\"key\": \"SEC\"},\n      \"summary\": \"Implement PAM for service accounts (IR-2024-042)\",\n      \"issuetype\": {\"name\": \"Task\"},\n      \"priority\": {\"name\": \"High\"},\n      \"assignee\": {\"name\": \"security_engineer\"},\n      \"duedate\": \"2024-03-15\"\n    }\n  }'\n```\n\n### Step 6: Update Playbooks and Detection Rules\n```yaml\n# New Sigma detection rule based on incident learnings\ntitle: Kerberoasting Activity Detected\nstatus: stable\ndescription: Detects Kerberoasting based on IR-2024-042 lessons\nlogsource:\n  product: windows\n  service: security\ndetection:\n  selection:\n    EventID: 4769\n    TicketEncryptionType: '0x17'\n  condition: selection\nlevel: high\ntags:\n  - attack.credential_access\n  - attack.t1558.003\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Blameless Post-Mortem | Reviewing incidents focusing on systems, not blaming individuals |\n| Root Cause Analysis | Identifying the fundamental reason the incident occurred |\n| 5 Whys | Iterative questioning technique to find root cause |\n| MTTD | Mean Time to Detect - time from compromise to detection |\n| MTTC | Mean Time to Contain - time from detection to containment |\n| MTTR | Mean Time to Recover - time from eradication to full recovery |\n| Continuous Improvement | Iterating on IR processes based on real incident data |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| TheHive\u002FServiceNow | Incident timeline and documentation |\n| Jira\u002FAzure DevOps | Action item tracking |\n| Confluence\u002FSharePoint | Lessons learned documentation |\n| Splunk\u002FElastic | Incident metrics and detection improvement |\n| Sigma | Detection rule development |\n\n## Common Scenarios\n\n1. **Ransomware Post-Mortem**: Review entire kill chain from initial access to encryption. Identify detection gaps and backup failures.\n2. **Phishing Campaign Review**: Analyze why users clicked, why email filters missed it, and how to improve training.\n3. **Cloud Misconfiguration Incident**: Review IaC pipeline, CSPM coverage, and change management process.\n4. **Insider Threat Review**: Examine DLP effectiveness, access control gaps, and user monitoring capabilities.\n5. **Third-Party Breach Impact**: Review vendor risk assessment process and data sharing agreements.\n\n## Output Format\n- Post-incident review meeting minutes\n- Root cause analysis document\n- Incident metrics report (MTTD, MTTC, MTTR)\n- Action items list with owners and deadlines\n- Updated IR playbooks and detection rules\n- Executive summary for leadership\n","# Conducting Post-Incident Lessons Learned\n\n## When to Use\n- After any security incident has been fully resolved and recovery completed\n- Following tabletop exercises or IR simulations\n- After significant near-miss events\n- Quarterly review of accumulated incident trends\n- When IR playbooks need updating based on real-world experience\n\n## Prerequisites\n- Incident fully resolved (containment, eradication, recovery complete)\n- Incident timeline and documentation gathered\n- All incident responders available for review session\n- Meeting space for collaborative discussion\n- Incident ticketing system data for metrics analysis\n\n## Workflow\n\n### Step 1: Gather Incident Data\n```bash\n# Export incident timeline from ticketing system\ncurl -s \"https:\u002F\u002Fthehive.local\u002Fapi\u002Fv1\u002Fcase\u002F$CASE_ID\u002Ftimeline\" \\\n  -H \"Authorization: Bearer $THEHIVE_API_KEY\" | jq '.' > incident_timeline.json\n\n# Extract detection and response metrics from SIEM\nindex=notable incident_id=\"IR-2024-042\"\n| stats min(_time) as first_alert, max(_time) as last_alert,\n  count as total_alerts, dc(src) as unique_sources\n\n# Compile all responder actions and timestamps\ngrep -E \"timestamp|action|analyst\" \u002Fvar\u002Flog\u002Fir\u002FIR-2024-042\u002F*.json | \\\n  python3 -m json.tool > compiled_actions.json\n```\n\n### Step 2: Conduct Blameless Post-Mortem Meeting\n```\nStructured Agenda (90 minutes):\n1. Incident summary (5 min) - Factual overview\n2. Timeline walkthrough (20 min) - Chronological events\n3. What worked well (15 min) - Positive outcomes\n4. What needs improvement (15 min) - Gaps and failures\n5. Root cause analysis (15 min) - 5 Whys or fishbone\n6. Action items (10 min) - Specific improvements with owners\n7. Playbook updates (10 min) - Changes to IR procedures\n\nBlameless Principles:\n- Focus on systems and processes, not individuals\n- Assume best intentions with available information\n- Seek to understand, not to blame\n```\n\n### Step 3: Perform Root Cause Analysis\n```bash\n# 5 Whys analysis example:\n# Why 1: Why did ransomware encrypt production servers?\n#   Answer: Attacker had domain admin credentials\n# Why 2: Why did attacker have domain admin credentials?\n#   Answer: Kerberoasted a service account and cracked it\n# Why 3: Why was the service account password crackable?\n#   Answer: Used a 12-character dictionary-based password\n# Why 4: Why was the service account password weak?\n#   Answer: No enforcement of service account password policy\n# Why 5: Why was there no service account password policy?\n#   Answer: PAM was not implemented for service accounts\n# ROOT CAUSE: Lack of privileged access management\n```\n\n### Step 4: Calculate Response Metrics\n```python\nfrom datetime import datetime\nevents = {\n    'compromise': '2024-01-10 14:00:00',\n    'detection': '2024-01-15 08:30:00',\n    'triage': '2024-01-15 08:45:00',\n    'containment': '2024-01-15 09:30:00',\n    'eradication': '2024-01-16 14:00:00',\n    'recovery': '2024-01-18 16:00:00',\n    'closure': '2024-01-25 10:00:00',\n}\nfmt = '%Y-%m-%d %H:%M:%S'\ntimes = {k: datetime.strptime(v, fmt) for k, v in events.items()}\nprint(f\"Dwell Time: {times['detection'] - times['compromise']}\")\nprint(f\"MTTD: {times['triage'] - times['detection']}\")\nprint(f\"MTTC: {times['containment'] - times['detection']}\")\nprint(f\"MTTR: {times['recovery'] - times['eradication']}\")\nprint(f\"Total Duration: {times['closure'] - times['detection']}\")\n```\n\n### Step 5: Document Findings and Create Action Items\n```bash\n# Create tracked action items in project management\ncurl -X POST \"https:\u002F\u002Fjira.local\u002Frest\u002Fapi\u002F2\u002Fissue\" \\\n  -H \"Authorization: Bearer $JIRA_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"fields\": {\n      \"project\": {\"key\": \"SEC\"},\n      \"summary\": \"Implement PAM for service accounts (IR-2024-042)\",\n      \"issuetype\": {\"name\": \"Task\"},\n      \"priority\": {\"name\": \"High\"},\n      \"assignee\": {\"name\": \"security_engineer\"},\n      \"duedate\": \"2024-03-15\"\n    }\n  }'\n```\n\n### Step 6: Update Playbooks and Detection Rules\n```yaml\n# New Sigma detection rule based on incident learnings\ntitle: Kerberoasting Activity Detected\nstatus: stable\ndescription: Detects Kerberoasting based on IR-2024-042 lessons\nlogsource:\n  product: windows\n  service: security\ndetection:\n  selection:\n    EventID: 4769\n    TicketEncryptionType: '0x17'\n  condition: selection\nlevel: high\ntags:\n  - attack.credential_access\n  - attack.t1558.003\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Blameless Post-Mortem | Reviewing incidents focusing on systems, not blaming individuals |\n| Root Cause Analysis | Identifying the fundamental reason the incident occurred |\n| 5 Whys | Iterative questioning technique to find root cause |\n| MTTD | Mean Time to Detect - time from compromise to detection |\n| MTTC | Mean Time to Contain - time from detection to containment |\n| MTTR | Mean Time to Recover - time from eradication to full recovery |\n| Continuous Improvement | Iterating on IR processes based on real incident data |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| TheHive\u002FServiceNow | Incident timeline and documentation |\n| Jira\u002FAzure DevOps | Action item tracking |\n| Confluence\u002FSharePoint | Lessons learned documentation |\n| Splunk\u002FElastic | Incident metrics and detection improvement |\n| Sigma | Detection rule development |\n\n## Common Scenarios\n\n1. **Ransomware Post-Mortem**: Review entire kill chain from initial access to encryption. Identify detection gaps and backup failures.\n2. **Phishing Campaign Review**: Analyze why users clicked, why email filters missed it, and how to improve training.\n3. **Cloud Misconfiguration Incident**: Review IaC pipeline, CSPM coverage, and change management process.\n4. **Insider Threat Review**: Examine DLP effectiveness, access control gaps, and user monitoring capabilities.\n5. **Third-Party Breach Impact**: Review vendor risk assessment process and data sharing agreements.\n\n## Output Format\n- Post-incident review meeting minutes\n- Root cause analysis document\n- Incident metrics report (MTTD, MTTC, MTTR)\n- Action items list with owners and deadlines\n- Updated IR playbooks and detection rules\n- Executive summary for leadership\n",{"name":57,"tags":58,"author":64,"domain":65,"license":66,"version":67,"nist_csf":68,"subdomain":59,"description":73,"mitre_attack":74},"conducting-post-incident-lessons-learned",[59,60,61,62,63],"incident-response","lessons-learned","post-incident","after-action-review","process-improvement","mahipal","cybersecurity","Apache-2.0","1.0",[69,70,71,72],"RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01","Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response.",[75,76,77,78],"T1566","T1486","T1059","T1078","main","54a798831d2266a3ca61ce68a7acb80b81160d57","app\u002Fseraph_app\u002F.agents\u002Fskills\u002Fcode-review",0,"https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph","https:\u002F\u002Fgithub.com\u002FVortex375","2026-11-08 18:46:14",{"source":8,"skillName":57,"commands":87,"prompt":97,"zipAvailable":98},[88,91,94],{"tool":89,"command":90},"npx","npx skills add Vortex375\u002Fseraph --skill conducting-post-incident-lessons-learned",{"tool":92,"command":93},"bunx","bunx skills add Vortex375\u002Fseraph --skill conducting-post-incident-lessons-learned",{"tool":95,"command":96},"pnpm","pnpm dlx skills add Vortex375\u002Fseraph --skill conducting-post-incident-lessons-learned","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fcode-review\u002FSKILL.md",true,[100,106,112,117,121,125,129,135],{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"agents\u002Fopenai.yaml","REFERENCE","参考文档",100,"https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fcode-review\u002Fagents\u002Fopenai.yaml",{"path":107,"resourceType":108,"resourceTypeDesc":109,"sizeBytes":110,"sourceHtmlUrl":111},"assets\u002Ftemplate.md","ASSET","资产文件",2199,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-post-incident-lessons-learned\u002Fassets\u002Ftemplate.md",{"path":113,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":115,"sourceHtmlUrl":116},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-post-incident-lessons-learned\u002FLICENSE",{"path":118,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":119,"sourceHtmlUrl":120},"references\u002Fapi-reference.md",1535,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-post-incident-lessons-learned\u002Freferences\u002Fapi-reference.md",{"path":122,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":123,"sourceHtmlUrl":124},"references\u002Fstandards.md",1208,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-post-incident-lessons-learned\u002Freferences\u002Fstandards.md",{"path":126,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":127,"sourceHtmlUrl":128},"references\u002Fworkflows.md",1993,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-post-incident-lessons-learned\u002Freferences\u002Fworkflows.md",{"path":130,"resourceType":131,"resourceTypeDesc":132,"sizeBytes":133,"sourceHtmlUrl":134},"scripts\u002Fagent.py","SCRIPT","脚本",5815,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-post-incident-lessons-learned\u002Fscripts\u002Fagent.py",{"path":136,"resourceType":131,"resourceTypeDesc":132,"sizeBytes":137,"sourceHtmlUrl":138},"scripts\u002Fprocess.py",9431,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-post-incident-lessons-learned\u002Fscripts\u002Fprocess.py",[140,157,182,206,222,241],{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":152,"publishedAt":52},"01M6BYS1QVW7F887EXS5RR34TA","writing-for-agents","Writing documents for agents. Use when creating or editing skills, or modifying AGENTS.md or CLAUDE.md.","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fwriting-for-agents\u002FSKILL.md",[146,149],{"categoryNo":147,"categoryName":148,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":150,"categoryName":151,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000036","内容创作者",[153,35,154,32,41,155,156],"writing","writing for agents","editing","documents",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":52},"01M6BYRZNREK0C7V6Y43AKDJWW","wizard","Generate an interactive bash wizard that walks a human through steps only they can perform. Use when provisioning infrastructure, setting up credentials or CI secrets, walking an unfamiliar third-party dashboard, or running a one-off migration or cutover. Don't invoke this for steps the agent can perform itself.","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fwizard\u002FSKILL.md",[],[159,164,165,166,167,168,169,170,32,171,172,35,173,174,175,176,177,178,41,179,180,181],"provisioning","ci","generate","infrastructure","dashboard","can","running","invoke","party","credentials","human","provisioning infrastructure","migration","up","only","interactive","Bash","secrets",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":52},"01M6BYRY92S448X31PTG25TCJC","wayfinder","Plan a huge chunk of work (more than one agent session can hold) as a shared map of decision tickets on your issue tracker, and resolve them one at a time until the way to the destination is clear.","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fwayfinder\u002FSKILL.md",[],[184,189,190,191,169,192,193,194,195,196,197,198,199,200,201,44,202,203,204,205],"at","map","agent session","time","true","shared","more","tickets","as","clear","issue","session","one at a time","decision","plan","chunk","tracker",{"skillNo":207,"name":208,"nameZh":6,"description":209,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":210,"categories":211,"keywords":212,"publishedAt":52},"01M6BYRWXMYWB6PD7E9PAD44M4","wait-what","Stop. That last message did not land: re-pitch it.","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fwait-what\u002FSKILL.md",[],[213,214,215,193,216,217,218,219,220,221],"wait what","wait","re","last","it","pitch","message","stop","land",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":226,"categories":227,"keywords":228,"publishedAt":52},"01M6BYRTS6JNDYB7BZVAWK7JJ9","triage","Move issues and external PRs through a state machine of triage roles, categorise, verify, grill if needed, and write agent-ready briefs.","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Ftriage\u002FSKILL.md",[],[224,229,230,231,232,233,234,235,236,237,238,239,193,240],"machine","roles","grill","ready","write","verify","issues","state","move","prs","state machine","briefs",{"skillNo":242,"name":243,"nameZh":6,"description":244,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":245,"categories":246,"keywords":247,"publishedAt":52},"01M6BYRRRCDHNXH2YBDTYJPG36","to-tickets","Break a plan, spec, or the current conversation into a set of tracer-bullet tickets, each declaring its blocking edges, published to the configured tracker (edges as text in one file per ticket locally, or native blocking links on a real tracker).","https:\u002F\u002Fgithub.com\u002FVortex375\u002Fseraph\u002Fblob\u002Fmain\u002Fapp\u002Fseraph_app\u002F.agents\u002Fskills\u002Fto-tickets\u002FSKILL.md",[],[248,196,51,249,250,193,251,252,197,253,205,254,203,255,256],"to tickets","links","break","native","ticket","conversation","text","SET","file"]