Research

Audit and fix CLAUDE.md files using a tiered binary checklist based on official Anthropic best practices and community guidelines. Use when the user asks to "review CLAUDE.md", "audit CLAUDE.md", "score CLAUDE.md", "improve CLAUDE.md", or "fix CLAUDE.md".

Researches malware analysis, CVEs, attribution reports, and hacker community sources. Use when the album subject involves cybersecurity incidents or threat actors.

Audit research data management infrastructure -- score FAIR principles compliance (Findable, Accessible, Interoperable, Reusable) across all sub-principles, evaluate data governance frameworks and lifecycle management, assess metadata schema quality (Dublin Core, DataCite, DDI, ISO 19115), review electronic lab notebook integrity and IP protection, check controlled vocabulary and ontology usage, and verify repository integration and funder sharing compliance (NIH 2023 policy, NSF, ERC). Cover...

Checks biomedical manuscripts against reporting guidelines such as CONSORT, STROBE, PRISMA, and TRIPOD to identify missing or weak reporting elements before submission or revision.

Dual-lens repo analysis: Creator View (knowledge, insights, home-repo comparison) + Engineer View (health, security, process). Two user-invokable depths (Standard / Deep); Quick Scan is triage-only. Link mining for curated lists. Fit separation via dual scoring lenses. Outputs to .research/analysis/<repo-slug>/.

Authoring discipline for new AZIMUTH reference files and templates. Use when adding a new domain reference file, extending an existing one, or creating a new template. Covers: (1) EXTEND vs. CREATE decision heuristic, (2) the Module 7 vocabulary header pattern that prevents domain-gap recurrence, (3) the sourcing caveat pattern for narrow-evidence-base files, (4) pre-verdict gate structure for templates. Validated by research-mpbaese4 (2026-05-18).

Spawn a one-shot red-team subagent to challenge a milestone result. Calibrated to return "nothing substantive" when the work is sound — does not invent issues to seem thorough. Use at goal-locked, major-result, or pre-write-up milestones, or whenever you want a deliberate adversarial check on something specific.

Run, audit, and design authorized Recon Workbench workflows when scoped target interrogation needs evidence artifacts, redaction, validation, and safe reporting.

Active-reading scaffolding for nonfiction books (EPUB). Parses an EPUB, generates a structured book analysis in the user's Obsidian vault at Read/{Book Name} ({Author})/, with 0. General.md as the book-level overview and one numbered markdown file per chapter containing pre-read brief, the user's own notes section, and post-read synthesis — all through configurable role lenses (e.g. PM, CEO, Entrepreneur). Six sub-skills — `reading-lens:setup` loads an EPUB with lens selection, `reading-lens:...

Answer cross-source questions about an open-llm-wiki vault and optionally write reusable synthesis back into concept pages. Use when the user asks a wiki question that requires comparing, connecting, or tracing multiple source/concept pages. By default answer first and propose writeback; modify files only when the user explicitly asks for writeback, pre-authorizes wiki growth, or approves the proposed changes.

Tracks every manuscript, paper, and research output currently in the publication pipeline from email — where each is in the review and submission process, what reviewer feedback is outstanding, what revisions are due, and what co-author actions are needed. Use when a researcher wants a full view of their publication pipeline without checking each journal portal manually. Triggers on "publication pipeline", "manuscript status", "paper submission status", "reviewer feedback", "revisions due", "...

Assess a Kubernetes cluster from the attacker viewpoint when an agent needs exposure-focused findings instead of a general cluster scanner listing.

Full Prism: multi-pass structural analysis with mandatory adversarial self-correction. Designs custom analytical passes, executes them with chaining, then attacks its own findings before synthesizing. Use for maximum depth on important code or artifacts.

Discover all possible analysis domains for an artifact. Finds obvious and non-obvious angles — architecture, security, but also marketing positioning, user psychology, regulatory implications, teaching value. Use before prism-scan or prism-full to explore what's worth investigating.

Generate strategy documents from completed Primr research. Use when the user wants AI, CX, security, or data strategy deliverables from an existing report.

Tracks the latest preprints and emerging research topics related to your topic across bioRxiv, medRxiv, and arXiv. Use when a user wants to discover what is being published right now before it reaches journals, monitor competitor directions, spot new methodology trends, or get an early-warning scan of a research area. Triggers on phrases like "what's new in X", "latest preprints on Y", "emerging topics in Z", "monitor bioRxiv for", or "what are people working on in this field".

Search the PMC Open Access literature with polars-dovmed. Author structured JSON queries directly, then use the hosted API when an API key is available or fall back to local dovmed scan over PMC, bioRxiv, or both parquet corpora.

Audit game analytics and telemetry implementation -- event tracking completeness, FTUE and monetization funnel coverage, retention metric infrastructure, A/B testing framework, heatmap data collection, churn prediction signals, and LTV modeling support. Covers Firebase Analytics, Unity Analytics, GameAnalytics, Amplitude, Mixpanel, Adjust, and custom pipelines. Use when verifying event tracking coverage, debugging missing funnel steps, auditing A/B test variant assignment, checking for PII in...

Harshly critique strategic documents (validation reports, competitive analyses, business plans) to identify blind spots, challenge assumptions, expose weaknesses, and generate Conductor-aligned action plans. Use when you need brutal honesty, "red team" analysis, or want to stress-test your thinking before execution. Applies multiple analytical frameworks (pre-mortem, assumption hunting, competitive gaps, market dynamics) and synthesizes findings into executive summaries with specific, actiona...

Audit pharmaceutical QC laboratory operations -- OOS/OOT investigations, stability program trending, analytical method validation status, release testing optimization, and specification compliance. Covers ICH Q1A-Q1E stability guidelines, ICH Q2(R2) method validation, USP compendial verification, ALCOA+ data integrity, Croston shelf life estimation, and LIMS/CDS system evaluation. Use when reviewing OOS investigation quality, trending stability data, auditing method validation coverage, optim...

Detection engineering — Sigma, Splunk SPL, Elastic KQL, Microsoft Sentinel KQL, YARA, Suricata rule yazimi advisory. Triggers on detection engineering, Sigma rule, Splunk SPL, Elastic KQL, Sentinel KQL, YARA, Suricata, Snort, SIEM rule, EDR rule, hunting query.

CTF (Capture the Flag) challenge solving advisory — HackTheBox, TryHackMe, PicoCTF, web/pwn/rev/crypto/forensics. Triggers on CTF, HackTheBox, HTB, TryHackMe, THM, PicoCTF, OverTheWire, pwn, reverse engineering, crypto challenge, forensics challenge, stego.

Audit academic peer review operations -- reviewer matching algorithms, conflict of interest detection, turnaround time optimization, review quality scoring, and editorial workflow management. Covers COPE guidelines compliance, COI screening (co-authorship, affiliation, funding), blinding enforcement, reviewer pool health metrics, ORCID/CrossRef integration, and plagiarism detection workflows. Supports ScholarOne, Editorial Manager, OJS, and custom editorial platforms. Use when optimizing revi...

Audit patient-facing healthcare software for portal feature completeness, secure messaging, health literacy, telehealth readiness, consent management, and HIPAA compliance. Covers health records access, appointment scheduling, bill pay, patient forms, notification PHI safety, WCAG accessibility, multilingual support, video visit integration, remote patient monitoring, and consent workflows. Use when evaluating a patient portal, checking PHI exposure in notifications, auditing telehealth flows...