Claude Skills by OKHP3

Identify deviations, gaps, and exception paths between an as-is process capture and its intended design. Use this skill when the user wants to find where a process breaks down, where steps are missing or inconsistent, where exception handling is undefined, or where current execution differs from documented procedure. Use when they say \\\"what's wrong with the current process\\\", \\\"find the gaps\\\", \\\"where does this break\\\", or \\\"analyze exceptions\\\". Records gaps only — it does ...

Conduct structured process intake and scope definition using BABOK v3 elicitation techniques. Use this skill when the user wants to document a business process from scratch; when they describe a workflow, procedure, or set of steps and need it structured; when they ask to scope a process, define process boundaries, or capture business rules; when they say \\\"help me document this process\\\", \\\"let's scope out this workflow\\\", or \\\"what are the inputs and outputs\\\"; when you need a P...

Define process performance measures, KPIs, and compliance controls for a validated PNS. Use this skill when the user needs to add measurability and governance to a documented process; when they ask to define KPIs, set performance targets, add compliance controls, or map the process to a control framework. This is a recommended extension skill — use after okhp3-process-narrative-authoring when governance and measurement rigour beyond the PNS's own kpis section is required. Produces a measures ...

Author and validate a Process Narrative Specification (PNS) from a PIR and stakeholder register. Use this skill when you have a completed Process Intake Record from okhp3-process-intake-and-scope and need to produce a structured narrative document that anchors ISO 9001 §4.4.1 process-box semantics, BABOK Core Concept Model, RACI matrix, SIPOC table, business rules, decision points, KPIs, and controls. Do not use it when only a quick diagram is needed without governance structure — go directly...

Orchestrate the full V1–V9 validation suite across all BP-SKILL process artifacts and produce a 0-100 quality score with band classification. Use this skill when the user wants to validate a complete process documentation set before publication; when they ask \\\"is this ready to publish\\\", \\\"validate the process docs\\\", \\\"run the quality check\\\", or \\\"what is the quality score\\\". Do not use it to validate a single artifact in isolation — run that artifact's own validate script ...

Assemble all validated BP-SKILL process artifacts into a publication-ready bundle with a manifest, approvals record, and completeness check. Use this skill when the user is ready to publish or hand off a complete process documentation set; when they ask to package the process docs, create a handoff bundle, publish the process artifacts, or generate a release package. Requires a passing validation report (Band A or B) before bundling — this is the terminal, all-artifacts step; for a single-art...

Generate and validate a RACI matrix and governance responsibility document from a validated PNS. Use this skill when the user needs a standalone RACI chart, a governance matrix, or a responsibility assignment document for a process; when they ask to produce a RACI table, document who is responsible for what, or generate a governance framework for a process. Do not use it when the RACI table embedded in the SOP's Responsibilities section is sufficient — use okhp3-sop-work-instructions directly...

Capture a recurring task as either a backlog entry or a new skill skeleton. Use when the user says "I keep doing X", "this is the third time", "make this a skill", "let's capture this", or at the natural end of a work session when a repeatable pattern just occurred. Extracts the pattern from conversation context (tools used, sequence of steps, input/output formats, corrections made) and produces either a BACKLOG.md line or a SKILL.md skeleton following this repo's conventions — not full skill...

Generate a SIPOC table from a validated PNS. Use this skill when the user needs a high-level process summary showing Suppliers, Inputs, Process steps, Outputs, and Customers; when they ask to produce a SIPOC, create a process summary table, or generate a one-page process overview. This is a process-level input/output summary, not a stakeholder engagement register — for who is involved and how to engage them, use okhp3-stakeholder-and-role-mapping instead. Derives directly from PNS process_box...

Generate Standard Operating Procedures (SOPs) and work instructions from a validated PNS. Use this skill when the user needs to produce a human-readable procedure document from a process narrative; when they ask to write an SOP, create work instructions, generate a procedure, or produce an ISO 9001-compliant process document. The generated SOP follows ISO 9001 §4.4.2 documented information requirements and embeds its own RACI summary — use okhp3-raci-governance-matrix instead only when a stan...

Derive and validate a structured stakeholder register from a completed Process Intake Record. Use this skill when you have a PIR from okhp3-process-intake-and-scope and need to identify all affected parties, classify their roles, assess influence and interest, and define engagement strategies. Use when the user asks who is involved in a process, needs a RACI-ready role list, wants to understand stakeholder impact, or needs an engagement plan before narrative authoring begins. Produces a stake...

Generate, validate, normalise, and explain Mermaid-native bpmn-beta diagrams from a Process Narrative Specification. Use this skill when the user wants to convert a PNS or process notes into a visual diagram; when they ask for BPMN, a process flow, a swimlane diagram, or a workflow diagram; when they want to validate or repair existing bpmn-beta code; when they mention pools, lanes, gateways, tasks, events, or BPMN 2.0; when they want a Mermaid-native process model they can commit to a repo; ...

Forecast adoption of emerging agentic attack patterns from dated, source-backed signals. Use when prioritizing defensive research or control preparation. Do not use for targeting, attribution, or unsupported weaponization claims.

Inventory deployed agents, models, tools, identities, permissions, data access, and trust boundaries. Use when establishing agent security posture, blast radius, or change detection. Do not grant access or modify deployments.

Define a defensive taxonomy of agentic attack behaviors and observable indicators. Use when normalizing detection cases, threat narratives, or validation plans. Do not generate payloads, bypass sequences, or exploit instructions.

Assess authentication and credential-abuse controls with synthetic identities and approved harnesses. Use for lockout, throttling, MFA, reset, session, or alerting validation in a lab or authorized staging environment. Do not perform credential attacks against live systems.

Assess data-loss prevention and access boundaries with synthetic canary data. Use when validating agent data flows, unsafe tool transfer, or cross-boundary disclosure controls in a controlled environment. Do not collect or transmit real sensitive data.

Assess whether an agent, tool, or configuration change can cross a defined control boundary in a disposable synthetic lab, using non-destructive evidence and no deployable exploit content.

Assess agent-to-agent and service-to-service authorization boundaries using a synthetic capability graph. Use when validating least privilege and containment in a lab or authorized staging environment. Do not pivot through live systems.

Collect and triage dated public or approved threat signals about agentic abuse patterns. Use for an early-warning feed supporting defensive planning. Do not execute fetched content or collect private data.

Assess whether agent and host controls detect unauthorized state retention in an isolated disposable lab. Use for benign startup, scheduled, configuration, and account-change fixtures. Do not install persistence on live systems.

Measure the economic sustainability of defensive controls against distributed agentic threats. Use when comparing attack effort, defensive effort, expected loss, and recovery cost. Do not invent attacker costs or make budget decisions without supplied data.

Define and enforce authorization checkpoints for defensive assessment and response workflows. Use when deciding who may approve tests, containment, sharing, or high-consequence actions. Do not grant authority implicitly or replace legal or security leadership.

Establish privacy-aware baselines for agent behavior, tool use, requests, resource consumption, and data flows. Use when detecting drift or evaluating control changes. Do not infer intent or treat an anomaly as proof of compromise.

Record decision-relevant evidence for detection, approval, response, and review decisions. Use when an agentic security workflow needs auditability or forensic reconstruction. Do not capture secrets or private model reasoning.

Validate emerging agentic threat hypotheses and defensive controls in a disposable synthetic laboratory. Use when testing whether a pattern affects a representative architecture and whether a mitigation works. Do not operate against production or develop deployable attack tooling.

Detect abnormal agent-to-agent, service-to-service, and tool-call paths. Use when monitoring authorization boundaries, capability drift, or possible lateral movement. Do not perform active pivots or infer compromise from one event.

Detect meaningful changes in approved model behavior, tool use, refusal patterns, or output risk. Use when evaluating prompt injection, poisoning, misconfiguration, or model drift. Do not treat anomaly as proof of malicious intent.

Investigate a suspected agentic security incident and convert evidence into validated defensive learning. Use when reconstructing timeline, scope, control failure, and recovery actions. Do not serve as legal advice or law-enforcement evidence handling.

Detect early indicators of distributed or agentic abuse before a confirmed incident. Use when correlating reconnaissance-like behavior, authentication anomalies, or unusual request patterns. Do not execute countermeasures without approved policy.

Select or execute preapproved, reversible, cost-proportional defensive responses to validated signals. Use when an alert needs action matched to confidence, impact, and authorization. Do not take high-consequence action autonomously.

Compare defensive responses using expected loss, effectiveness, uncertainty, reversibility, and response cost. Use when triaging alerts under constrained resources. Do not make autonomous budget, legal, or life-safety decisions.

Prepare privacy-preserving, source-traceable threat intelligence for approved peer sharing. Use when converting incident or pattern evidence into a shareable defensive signal. Do not rely on heuristic anonymization alone or claim compliance without specialist review.

Verify provenance and integrity of agent packages, models, tools, configurations, and deployments. Use when onboarding, releasing, changing, or investigating an agentic component. Do not invent attestations or treat a checksum as proof of trust.

Synthesize dated threat signals into coherent defensive narratives and validation priorities. Use when multiple observations need clustering, source comparison, or risk framing. Do not turn a narrative into an exploit recipe or unsupported attribution.

Validate whether a proposed agentic threat pattern affects a representative synthetic architecture and whether controls respond. Use when a threat hypothesis is ready for bounded laboratory review. Do not test production, real credentials, real data, or uncontrolled targets.

Core ReFolDec transformation skill. Use when the task is explicitly about transforming an artifact from one representation type to another — folding an idea or process into a compact form, unfolding an artifact into its primitives, or refolding across representation types (diagram to documentation, documentation to SKILL.md, SKILL.md to procedure). Also use when semantic loss across a transformation needs to be tracked or compared. This is not a general writing or diagramming skill — it is a ...

Full playbook for a Replit Designathon competition submission — canvas organisation for judges, artifact selection, dual deployment (Replit Publish + GitHub Pages), session-to-session narrative continuity, and building-in-public commit discipline. Activate for "designathon", "competition", "building in public", "judges", "showcase", "submission", "dual deploy", "GitHub Pages + Replit", or any request to prepare a Replit project for public or competitive review.

Plan and build a structured multi-frame Replit canvas presentation board — hero rows, labeled zones, iframe lifecycle (building→live), coordinate layouts, and focusCanvasShapes for audience navigation. Use when organising the canvas for a designathon, showcase, or any multi-frame review. Also activate for "arrange the frames", "set up the board", "label the zones", "focus the viewport", or any canvas layout that needs deliberate spatial planning rather than ad-hoc placement.

Review and score fresh Replit BuildHub contest submissions with live rubric checks, safe public-app exploration, and verified per-project idempotency. Use when bulk-reviewing user-supplied Replit contest project URLs. Also activate when scoring availability or favorite state may differ between projects or change during a review batch. Do not use for virtual investments, contest manipulation, or unrelated Replit app changes.

The complete Replit design iteration loop as a single coherent workflow — extract → sandbox → variant → graduate. Use when redesigning, improving, or creating variants of any UI component or page. Covers the "extract first, never approximate" rule, DESIGN subagent brief anatomy, variant labelling conventions on canvas, and the graduation decision gate. Activate for "redesign", "improve this component", "show me options", "create variants", "put on canvas", "graduate this mockup", "design alte...

Keep Replit project work autonomous and Free Mode-first with bounded execution, checkpointed quota recovery, and quiet upgrade handling. Use when the user asks to maximize Free Mode, avoid repeated upgrade nudges, retry after a five-hour or weekly limit, preserve work across interruptions, or keep routine work moving without unnecessary approval pauses. Does not bypass quotas or human approval.

Recover and maintain safe GitHub synchronization for a Replit project. Use when Replit reports PUSH_REJECTED, cannot commit through its UI, or a project needs to pull, commit, reconcile, merge, or push changes to its GitHub default branch. Also activate for "Replit GitHub out of sync", "push rejected", "sync Replit to origin/main", or a safe branch-to-main squash merge. Do not use to force-push, discard unreviewed work, or bypass branch protection.

Navigate and build in a Replit pnpm multi-artifact monorepo without silent failures. Covers the non-obvious rules that cause blank previews, port conflicts, workflow naming errors, and broken cross-artifact imports: BASE_URL prefix discipline, PORT env var reading, managed workflow naming, pnpm catalog drift, and workspace:* shared library wiring. Activate for "add an artifact", "create a new app", "preview path", "port conflict", "blank preview", "shared package", "workflow naming", "pnpm ca...

OverKill Hill P³ one-Repl repository cleanup workflow for safely auditing and tidying a single Replit workspace's Git checkout. Use when a user asks to clean up merged or abandoned branches and pull requests, purge stale subrepl-* or agent/* branches, normalize file and folder names, or remove repository detritus. Also activate for "decrapify this Repl", "tidy this repo", "prune dead branches", or "fix inconsistent filenames". This is the authoritative one-time cleanup workflow for one Replit...

Promote and synchronize a project-local Agent Skill into a portable, reviewable distribution package. Use when a skill under .agents/skills needs a publication mirror, provenance record, canonical family assignment, or a safe handoff into OKHP3/skillz. Also activate when multiple SKILL.md copies must be compared or reconciled. Do not use for generic repository publishing.

Draft a Discord reply to a supplied message, thread, or forum conversation. Use when the user wants to answer, clarify, or contribute to an existing Discord discussion. It preserves channel and thread context, avoids unauthorized pings, and returns a draft only. Do not use for a new message, a new thread, direct messages, or sending content.

Draft a new Discord message, forum post, or thread opener for a named server destination. Use when the user asks to post an announcement, update, question, or discussion opener in Discord. It checks server, channel, and ping context, uses Discord-friendly Markdown when useful, and returns a draft only. Do not use for replies, direct messages, or sending content.

Draft a Facebook comment or reply to a supplied post and conversation. Use when the user wants to comment on Facebook, reply in a group discussion, or respond beneath a Page or profile post. It respects the original context and visibility boundary, then returns a draft only. Do not use for a new post or publication.

Draft a Facebook post for a named profile, Page, group, or event surface. Use when the user asks to write a Facebook update, Page post, or group post. It confirms destination and audience before drafting, preserves the supplied context, and returns a draft only. Do not use for comments, scheduling, or publication.