indigoai-us/hq-cowork-dm
core/packages/hq-pack-cowork/skills/hq-cowork-dm/SKILL.md
Send a direct message to a teammate from a sandboxed Claude Code plugin host (Cowork) via the host-side `mcp__hq__hq_dm` tool. Delivers an HQ Sync menubar notification to anyone you share an active company with; optionally attaches a one-click agent prompt, a detail body, or schedules delivery. Same capability as `/dm`, routed through hq-pack-cowork's MCP server.
$ install --global
skillsauthnpx skillsauth add indigoai-us/hq-core hq-cowork-dmInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 4, 2026, 3:12 AM102.1s1 file scanned
SKILL.md
- name:
- hq-cowork-dm
- description:
- Send a direct message to a teammate from a sandboxed Claude Code plugin host (Cowork) via the host-side `mcp__hq__hq_dm` tool. Delivers an HQ Sync menubar notification to anyone you share an active company with; optionally attaches a one-click agent prompt, a detail body, or schedules delivery. Same capability as `/dm`, routed through hq-pack-cowork's MCP server.
- allowed-tools:
- mcp__hq__hq_dm
/hq-cowork-dm — DM a teammate from a sandboxed agent
Sends person-to-person HQ DMs from inside Cowork, where the hq CLI is
unreachable. Routes through the host-side MCP server. The recipient gets it
as an HQ Sync menubar notification.
Args: $ARGUMENTS — recipient + message, plus optional flags.
| Arg | Meaning |
|---|---|
| <recipient> | Email address or personUid of the teammate. Required. |
| <message> | The message body. Required. |
| --prompt <text> | Agent-context prompt the recipient can one-click copy into their agent. |
| --details <text> | Longer detail shown in the recipient's DM detail window. |
| --at <ISO8601> | Schedule delivery at an absolute time (store-and-forward). |
| --in <delay> | Schedule after a relative delay: 30s, 10m, 2h, 1d. |
Call the tool
{
"recipient": "<email-or-personUid>",
"message": "<body>",
"prompt": "<optional agent prompt>",
"details": "<optional detail body>",
"in": "30m"
}
Call mcp__hq__hq_dm. Use at OR in, not both.
Notes
- Reach is scoped to shared companies. You can only DM people you share an active company with. A delivery failure usually means no shared company.
- DM yourself for a note-to-self / reminder (use your own email).
- Receive-only in the app — the menubar app shows incoming DMs; sending happens from a session or the CLI (this tool).
When to use this instead of /dm
Only inside Cowork or another sandboxed plugin host. On a host-side session,
prefer the unprefixed /dm (or hq dm).
Why this skill exists
hq dm authenticates with the user's Cognito session under ~/.hq, which
isn't visible from Cowork's Linux VM. The host-side MCP server runs the real
hq dm and returns its confirmation back to the sandboxed agent.
Related Skills
indigoai-us/hq-cowork
tools
VerifiedTrustedCommunity
Discovery + dispatch entry point for native HQ inside Cowork (or any sandboxed Claude Code plugin host). Enumerates every HQ capability available through hq-pack-cowork's host-side MCP server (identity, sync, qmd/search, secrets, vault files, team & membership, packages & modules, meeting intelligence, feedback, schema-backed runs, guarded long-tail CLI) and routes to the right `mcp__hq__*` tool while preserving default HQ behavior through a different transport. Use when the agent needs HQ but `hq`/`qmd` aren't reachable from its bash sandbox and isn't sure which tool to call.
39SKILL.mdUpdated Jun 4, 2026
indigoai-us/hq-cowork-sync
tools
VerifiedTrustedCommunity
Run a full HQ sync (all cloud-backed companies, bidirectional) from a sandboxed Claude Code plugin host (Cowork) by calling the host-side `hq_sync` MCP tool. Same engine as AppBar HQ Sync and the `/hq-sync` skill, but routed through the hq-pack-cowork MCP server so it works even when the `hq` binary and `~/.hq` auth are not reachable from the agent's bash sandbox.
39SKILL.mdUpdated Jun 4, 2026
indigoai-us/hq-cowork-share
tools
VerifiedTrustedCommunity
Share an HQ vault path from a sandboxed Claude Code plugin host (Cowork) by calling the host-side `hq_share` MCP tool. Without `--with`, mints an encrypted single-use share-session URL (default 15-min expiry). With `--with`, grants direct ACL access to a person, group, or `@all`. Same capability as `/hq-share`, routed through hq-pack-cowork's MCP server so it works from a sandboxed agent.
39SKILL.mdUpdated Jun 4, 2026
indigoai-us/core/packages/hq-pack-cowork/skills/hq-cowork-secrets
tools
VerifiedTrustedCommunity
--- name: hq-cowork-secrets description: Use HQ secrets from a sandboxed Claude Code plugin host (Cowork). The host-side MCP server never returns a secret value itself: `mcp__hq__hq_secrets_exec` runs a command on the host with named secrets injected as env vars (only the command's output returns), and refuses to launch a shell or value-printing binary; `mcp__hq__hq_secrets_list` lists secret NAMES/metadata only. These tools run host commands with the user's privileges, so treat them as host-tru
39SKILL.mdUpdated Jun 4, 2026