Security & Auditing Skills

Every Abnormal Security threat, case, vendor, employee, and dashboard operation, plus a local threat store, ranked SOC triage, and one-shot client reporting. Trigger phrases: triage abnormal threats, remediate a phishing campaign in abnormal, abnormal email threat report, check account takeover risk for an employee, vendor email compromise check, use abnormal security, run abnormal-cli.

The first real CLI for the Acronis Cyber Protect Cloud platform - every tenant, agent, and usage metric mirrored locally Trigger phrases: acronis backup health across tenants, find offline acronis agents, acronis usage and billing report, which acronis customers aren't protected, acronis agent version compliance, use acronis cyber protect, run acronis-cli.

Use when the user asks to check Action1 patch status, triage vulnerabilities, find stale or offline agents, score endpoint risk, or report patch posture across one or many client organizations. Adds fleet-wide views the org-siloed Action1 API cannot return in a single call. Trigger phrases: action1 patch posture, which endpoints are missing patches, triage action1 vulnerabilities, find stale action1 agents, action1 fleet view across organizations, use action1, run action1-cli.

Use when the user asks to check Afi SaaS backup coverage across Microsoft 365 / Google Workspace tenants, find which mailboxes or sites aren't backed up, catch protected resources whose backups have gone stale, run a fleet-wide backup-and-quota health sweep, reconcile purchased licenses against protected seats, resolve an M365/GWS identity to its Afi resource, or safely offboard a departing user with a verified final backup - backed by a local SQLite mirror so fleet-wide questions answer offline without tripping Afi's rate limits. Trigger phrases: check afi backup coverage, which mailboxes aren't backed up in afi, afi fleet health, offboard a user from afi backup, afi backup stale check, use afi, run afi-cli.

Use when the user asks to reconcile AppDirect marketplace billing, see which payments failed or stalled across every reseller company, find active-but-unbilled or overdue subscriptions before month-close, review what changed in subscriptions, pull a single customer's full picture, or roll up the assisted-sales pipeline - backed by a local SQLite mirror so cross-company questions answer offline. Trigger phrases: reconcile appdirect billing, which appdirect payments failed this week, what changed in appdirect subscriptions, show my appdirect pipeline, appdirect company 360, use appdirect, run appdirect-cli.

Every Atera RMM + PSA endpoint, plus a local SQLite mirror that answers fleet-health, SLA, and book-of-business questions no single API call can. Trigger phrases: which atera agents are offline, atera tickets about to breach sla, atera book of business, what changed in atera since yesterday, sync atera to my machine, use atera, run atera-cli, which customers are under-contracted, patch compliance across the fleet, what contracts are expiring.

Use when the user asks to triage the Autotask service desk, find unbilled or uninvoiced time before a billing run, check contract burn or retainer run-out, pull a company 360, age the ticket queue, balance technician workload, resolve an Autotask picklist ID, or run any cross-entity question against Autotask PSA (Datto Autotask PSA). Wraps the full Autotask REST API plus zone discovery and a local SQLite mirror. Trigger phrases: list autotask tickets, triage the autotask service desk, find unbilled time in autotask, autotask company 360, contract burn in autotask, who is overloaded in autotask, autotask ticket aging, Autotask + ChatGPT, Autotask + Claude, use autotask, run autotask-cli.

Get a non-expert from zero to a plain-English, waste-flagged AWS bill breakdown - per-account, month-over-month, with dollar-ranked waste - and cache it locally so you don't pay per Cost Explorer call. Trigger phrases: what's my aws bill, break down my aws costs, why did my aws bill go up, find aws waste, which account is driving my aws spend, post my aws bill to slack, set up aws billing access, use aws-billing, run aws-billing-cli.

Use when the user asks to check Axcient x360Recover backups across an MSP fleet - whose backups failed or went stale last night, who is breaching RPO, per-client backup-compliance evidence (restore-point age + AutoVerify), or month-end usage reconciliation. Wraps the x360Recover public API plus an offline SQLite mirror that joins device, job, restore-point, and client data the raw API leaves unconnected. Trigger phrases: check axcient backups, which backups failed last night, x360recover fleet health, backup compliance report for client, axcient usage reconciliation, Axcient + ChatGPT, Axcient + Claude, use axcient, run axcient-cli.

Use when the user asks to check what's down in Better Stack, find monitors that would page nobody, report incident MTTA/MTTR, see who's on call or where on-call has gaps, rank noisy or flapping monitors, audit status-page drift, or run any Better Stack Uptime command (monitors, heartbeats, incidents, on-call, escalation policies, groups, status pages) - backed by a local SQLite mirror so cross-resource questions answer offline. Trigger phrases: which monitors are down, find unprotected monitors, incident MTTR report, who is on call, noisy monitors, use betterstack, run betterstack-cli.

Use when the user asks to triage Blumira findings across client accounts, see what changed in Blumira since the last sync, check detection-coverage drift versus the basis ruleset, find stale or unprotected domain controllers, report Blumira MTTR or SLA aging, reconcile findings against a PSA, or search finding evidence for an IOC. Wraps the Blumira public API plus an offline SQLite mirror with cross-account triage and over-time trends no single API call can answer. Trigger phrases: blumira findings, triage blumira across accounts, what changed in blumira since yesterday, blumira detection coverage, blumira domain controller exposure, blumira MTTR report, Blumira + ChatGPT, Blumira + Claude, use blumira, run blumira-cli.

Use when the user asks to roll up Microsoft 365 posture across all their CIPP tenants (MFA, Conditional Access, Standards, BPA), find unused M365 licenses, flag stale accounts, detect security-baseline drift, fan one read out across every client tenant, or drive bulk user changes from a CSV. The first single-binary CLI and MCP server for CIPP (CyberDrain Improved Partner Portal) we could find (June 2026): cross-tenant fan-out, an offline SQLite store, and fleet rollups the one-tenant-at-a-time portal never renders. Trigger phrases: check MFA across all my tenants, find unused M365 licenses, offboard users from a CSV in CIPP, which tenants drifted off baseline, list CIPP tenants, use cipp, run cipp-cli.

Set up and PROVE authentication for any CLI, MCP server, or Skill by driving your ALREADY-OPEN, logged-in Chrome via the OpenCLI browser bridge (opencli browser bind): your real session, supervised live, never a fresh or headless Chromium. Reconciles to a desired auth state, so it works even when a tool is already connected: first-time setup, token refresh, broadening scopes, key rotation, and repair. Runs on macOS and Windows, storing every secret in the macOS Keychain or Windows Credential Manager without the complete value entering the model context, wires the consumer, and does not stop until a real authenticated call returns live data. Idempotent and self-learning. Use when the user says connect a vendor, set up auth, get me an API key or token, add or broaden a scope, refresh a token, log me into a CLI, wire up credentials, or do the auth setup. Drives your real Chrome through OpenCLI bind only. It does NOT and MUST NOT use any other browser-driving tool or skill, because a spawned browser does not carry your login.

Use when the user asks to check ConnectWise Automate fleet health, find stale or offline agents, report patch compliance by client, triage open alerts across clients, inventory end-of-life OSes, or see what changed overnight across an RMM fleet. Syncs your whole Automate server into a local SQLite mirror so it answers cross-client questions the per-server console can't. Trigger phrases: connectwise automate fleet health, stale automate agents, automate patch compliance by client, triage automate alerts, use connectwise automate, run connectwise-automate-cli.

Use when the user asks to list, search, or inspect ConnectWise Control (ScreenConnect) remote-support and access sessions, run a command on a guest machine, rename or tag sessions, manage instance users, or read the audit log. Turns the ScreenConnect instance surface into typed commands with an offline SQLite mirror. Trigger phrases: list connectwise control sessions, screenconnect session detail, run command on a screenconnect guest, connectwise control audit log, use connectwise control, run connectwise-control-cli.

Use when the user asks to triage a ConnectWise board, find unbilled time before an invoice run, check agreement burn against block hours, pull a client account 360, log time on a ticket, find stale tickets, balance tech workload, or run any cross-entity question against ConnectWise PSA (Manage). Wraps the full Manage REST API plus a local SQLite mirror and a typed conditions query builder. Trigger phrases: list connectwise tickets, triage the help desk board, find unbilled time in connectwise, connectwise account 360 for a client, agreement burn for Acme, log time on a connectwise ticket, ConnectWise + ChatGPT, ConnectWise + Claude, use connectwise-manage, run connectwise-manage-cli.

Apply Chain-of-Verification (CoVe) prompting to improve response accuracy through self-verification.

Sync your whole Datto BCDR fleet into local SQLite and answer the questions the per-appliance Partner Portal can't. Trigger phrases: which datto backups failed screenshot verification, datto bcdr fleet health, which clients are at risk in datto, find stale datto backups, datto storage runway, use datto-bcdr, run datto-bcdr-cli, datto recoverability score, client backup report for qbr, triage datto alerts fleet-wide.

Every Datto RMM API operation, plus a local SQLite fleet store and fleet-wide analytics no other Datto tool has. Trigger phrases: datto rmm stale devices, which endpoints have antivirus disabled, datto rmm patch gaps, qbr scorecard for a site, warranty expiring devices, use datto-rmm, run datto-rmm-cli.

Every Domotz endpoint, plus a local SQLite fleet mirror that answers cross-site questions. Trigger phrases: which domotz sites are down, list offline devices across all sites, export domotz device inventory, check fleet health in domotz, find new devices on the network, use domotz, run domotz-cli.

Use when the user asks to push usage counts into Gradient MSP Synthesize for billing reconciliation, see which accounts' counts drifted since the last push, confirm a dispatched alert became a PSA ticket, find unmapped accounts or services missing a SKU, or check whether the integration is ready to flip to active - backed by a local push ledger and SQLite mirror so audits answer offline. Trigger phrases: push usage counts to gradient, sync usage to synthesize, check my gradient integration status, find unmapped gradient accounts, did my gradient alert create a ticket, use gradient, run gradient-cli.

Use when the user asks to triage their HaloPSA queue, audit SLA breaches, build a per-client situational-awareness card, reconcile contract hours, check agent workload, or run any cross-client analytic question against HaloPSA, HaloITSM, or HaloCRM. Wraps the full HaloPSA REST API plus a local SQLite mirror so cross-entity queries the live API can't return in one shot are fast and offline. Trigger phrases: triage my Halo queue, check SLA breaches in HaloPSA, who's overloaded in Halo, client card for Acme, Halo contract burn-down, what changed in Halo since this morning, HaloPSA + ChatGPT, HaloPSA + Claude, use halopsa, run halopsa.

Every Hudu cmdlet, plus an offline SQLite mirror, cross-entity audits, and agent-native output. Trigger phrases: hudu hygiene scorecard, audit hudu documentation, find stale hudu passwords, what hudu certs expire soon, score hudu documentation completeness, onboard a new client in hudu, use hudu, run hudu.

Use when the user asks to triage Huntress incidents across client organizations, find coverage gaps or dark agents, trace an indicator's blast radius across the fleet, reconcile invoiced seats against deployed agents, or pull a per-client QBR/shift-handoff rollup. Wraps the full Huntress API plus an offline SQLite mirror with cross-tenant analytics the per-org portal can't compose. Trigger phrases: show me all critical huntress incidents, huntress coverage gaps across my orgs, huntress blast radius for this IP, reconcile huntress billing, huntress agent health report, Huntress + ChatGPT, Huntress + Claude, use huntress, run huntress-cli.