Research

Systematic debugging with root cause investigation. (gstack)

Code quality dashboard. (gstack)

Generate missing documentation from scratch for a feature, module, or entire project. (gstack)

Design consultation: understands your product, researches the landscape, proposes a complete design system (aesthetic, typography, color, layout, spacing, motion), and generates font+color preview... (gstack)

Save working context. (gstack)

Restore working context saved earlier by /context-save. (gstack)

Post-deploy canary monitoring. (gstack)

Performance regression detection using the browse daemon. (gstack)

Use on any bug, test failure, or unexpected behavior before proposing a fix. Enforces four-phase root-cause investigation — reproduce, pattern-match, hypothesize, fix — with a hard rule against symptom patches.

Manually test the latest change with one realistic positive case and one adversarial negative case, capturing evidence before any further fix. Use when the user asks for a quick confidence check or wants to test a recent implementation.

Build a complete dossier on a person using only a username.

Proactive threat hunting — MITRE ATT&CK-mapped hunt hypotheses, Sigma detection engineering, SIEM query authoring (Splunk SPL, KQL, Lucene), and SOC workflow integration.

Evidence-first execution workflow for running security commands, inspecting system state, debugging tool failures, and making verified changes. This skill enforces a disciplined approach: inspect before acting, keep changes narrow, and report exact execution state.

Build and maintain structured, persistent knowledge graphs across sessions. Knowledge-ops transforms ephemeral session findings into reusable intelligence — connecting entities, tracking confidence over time, and enabling recall across engagements.

Multi-source intelligence gathering through systematic web research — producing thorough, cited reports from diverse sources.

Dark web intelligence gathering — Tor/onion service reconnaissance, marketplace monitoring, breach data markets, threat actor profiling, with strict OPSEC for investigators.

Calculate the Maryland Aggregate Pathology Index (MAPI) on a deceased donor procurement kidney biopsy to predict graft survival and decide single vs dual vs discard allocation. Trigger when a clinician asks "what's the MAPI score", "interpret donor kidney biopsy", "should I use this marginal kidney", "MAPI cutoff for transplant", "procurement biopsy scoring", or has histology results from a deceased donor kidney and needs an objective grading.

This skill determines if growth hormone treatment should be avoided in childhood cancer survivors with short stature who are currently receiving tyrosine kinase inhibitor therapy (e.g., imatinib, dasatinib). Triggers include: “Should I use GH for short stature in a patient on imatinib?” or “Is GH safe with ongoing TKI therapy?”

Pretreatment screening checklist before starting Genryzon (somatrogon, weekly long-acting growth hormone) in a child with confirmed paediatric growth hormone deficiency. Ensures thyroid, adrenal, glucose, ocular, tumour, and Prader-Willi status are checked before the first dose to prevent adrenal crisis, wasted therapy, unmasked hypothyroidism, unrecognised hyperglycaemia, missed intracranial hypertension, or sudden death in PWS. Use when a clinician asks what to check before starting somatro...

Bedside protocol for recognising and managing adrenal crisis in an infant, child, or adolescent with classical congenital adrenal hyperplasia (CAH) — including triage clues, fluid resuscitation, IV hydrocortisone bolus and maintenance dosing (age-stratified), glucose and electrolyte correction, and stepped-down disposition. Also covers home sick-day rules (minor vs moderate–severe illness) and the disease-card instructions parents should follow before reaching hospital. Use when a clinician a...

Screens any dizzy patient for features that mandate urgent neuroimaging or neurology referral — distinguishing benign peripheral dizziness from a central or life-threatening cause. Use when a patient presents with dizziness and you want to quickly rule out stroke, cerebellar lesion, or other dangerous aetiology before attributing symptoms to a benign cause. Trigger phrases: "could this dizziness be serious", "rule out stroke in dizzy patient", "when to image a dizzy patient", "red flags in di...

Distinguishes BPPV from its key mimics at the bedside — postural hypotension, vestibular paroxysmia, vestibular migraine, central positional vertigo, and chronic unilateral vestibular hypofunction — using history, trigger patterns, nystagmus characteristics, and response to treatment. Use when a patient has positional vertigo and you're unsure if it's BPPV, when Dix-Hallpike is atypical, or when the patient has not responded to repositioning maneuvers. Trigger phrases: "is this BPPV or someth...

Decides whether a thyroid nodule needs FNA biopsy using the ATA 2015 sonographic pattern classification (high/intermediate/low/very low/benign) and nodule size thresholds. Use when a clinician asks "does this thyroid nodule need a biopsy", "should I FNA this nodule", "what size threshold for thyroid FNA", "is this nodule suspicious enough for biopsy", or describes a thyroid ultrasound finding and wants a biopsy recommendation. Distinct from EU-TIRADS — uses the ATA 5-pattern system.

Reclassifies differentiated thyroid cancer (DTC) patients at 6–24 months after initial therapy using ATA response-to-therapy categories (Excellent / Biochemical Incomplete / Structural Incomplete / Indeterminate) to guide ongoing surveillance intensity, TSH suppression targets, and further treatment. Use when a clinician asks "how is my thyroid cancer patient doing at follow-up", "what does a detectable Tg mean after thyroidectomy", "how do I interpret a low Tg with negative imaging", "is thi...