Use this skill to turn clawdstrike audit logs into an incident report and a minimal response plan.

Threat hunting and security event investigation

Use when the Huntronomer desktop app needs live dogfooding, reproduction, or smoke validation across the shell, launch overlay, Hunt Deck, Playwright browser flow, Tauri bridge, or OpenClaw and receipt states.

Use when a raw ClawdStrike product, platform, or security idea needs to be grounded in the current repository, framed as architecture, and turned into a docs index, current-state inventory, or first-pass design set.

Use when a Codex worker is running inside one ClawdStrike worktree and must implement exactly one assigned lane, stay within owned files, run verification, and leave a clean handoff.

Use when a ClawdStrike lane branch is ready for review and integration and needs verification, scope-drift checks, shared-file wiring, and merge-gate enforcement before landing.

Use when the ClawdStrike TUI needs live dogfooding, reproduction, or workflow validation across the main dashboard, security surfaces, hunt loop, release wrapper, or local runtime states.

Use when the ClawdStrike TUI needs release-candidate hardening around bootstrap, doctor/init, installed runtime packaging, local agent connectivity, cluster watch connectivity, or evidence export traceability.

Use when specs are mature enough to split work into parallel ClawdStrike lanes with explicit ownership, dependency graphs, verification gates, merge order, and agent briefs.

A simple greeting skill that demonstrates secure agent operation.

A simple skill demonstrating clawdstrike security