
Use when a ClawdStrike TUI issue spans live reproduction, code tracing, implementation, official Codex docs verification, and review, and should be split across focused Codex sub-agents instead of handled serially.
Guide to ClawdStrike security policies and guard configuration
# bb-edr: Triage Skill Use this skill to turn clawdstrike audit logs into an incident report and a minimal response plan. ## Inputs - `.hush/audit.jsonl` (JSONL) — clawdstrike audit events (allowed/denied, guard, reason). - `policy.yaml` — the active security policy. ## Task 1. Read and summarize the last ~50 audit events. 2. Focus on **denied** events first: - Group by `guard` (e.g., `forbidden_path`, `egress`, `patch_integrity`) - Identify likely intent (misconfiguration vs. suspici
Use when it is time to create worktrees, launch Codex worker lanes, monitor background jobs, resume finished or stalled sessions, run review, and advance a ClawdStrike swarm through its waves.
Build test scenarios for ClawdStrike policy simulation
Use when the Huntronomer desktop app needs live dogfooding, reproduction, or smoke validation across the shell, launch overlay, Hunt Deck, Playwright browser flow, Tauri bridge, or OpenClaw and receipt states.
Use when a raw ClawdStrike product, platform, or security idea needs to be grounded in the current repository, framed as architecture, and turned into a docs index, current-state inventory, or first-pass design set.
Use when a Codex worker is running inside one ClawdStrike worktree and must implement exactly one assigned lane, stay within owned files, run verification, and leave a clean handoff.
Use when the ClawdStrike TUI needs live dogfooding, reproduction, or workflow validation across the main dashboard, security surfaces, hunt loop, release wrapper, or local runtime states.
Use when the ClawdStrike TUI needs release-candidate hardening around bootstrap, doctor/init, installed runtime packaging, local agent connectivity, cluster watch connectivity, or evidence export traceability.
Use when the ClawdStrike TUI needs a visual polish pass for alignment, spacing, hierarchy, empty states, or terminal-specific layout quality without expanding the product scope.
Use when specs are mature enough to split work into parallel ClawdStrike lanes with explicit ownership, dependency graphs, verification gates, merge order, and agent briefs.
# Hello Skill A simple greeting skill that demonstrates secure agent operation. ## Description This skill allows the agent to greet users and perform basic file operations within the allowed workspace. ## Capabilities - Generate personalized greetings - Read files from the workspace - Write greeting logs to the output directory ## Usage Ask the agent: - "Say hello to Alice" - "Read the welcome message from data/welcome.txt" - "Log a greeting for Bob" ## Examples ### Basic Greeting **Us
A simple skill demonstrating clawdstrike security
Guide to ClawdStrike security policies and guard configuration
Run a comprehensive security audit on a ClawdStrike policy
Security review for risky code changes
Security review for risky code changes
Threat hunting and security event investigation
Use when a ClawdStrike lane branch is ready for review and integration and needs verification, scope-drift checks, shared-file wiring, and merge-gate enforcement before landing.
Import and analyze agent activity logs to synthesize security policies
Analyze and tighten ClawdStrike security policies
Threat hunting and security event investigation
Use when architecture docs exist and need to be hardened into API, storage, migration, protocol, roadmap, or ticket-level specifications for ClawdStrike work.