Launch N parallel subagents in isolated git worktrees to compete on the session task.

/cs:boardroom <brief> — 6-phase multi-role deliberation across the C-suite with Phase 2 isolation, critic pre-screen, and synthesis. Outputs a board memo.

/cs:decide <memo> — Log a decision to two-layer memory via decision-logger. Approved memo becomes durable; raw transcripts kept for reference.

Analyze the NTFS Master File Table ($MFT) to recover metadata and content of deleted files by examining MFT record entries, $LogFile, $UsnJrnl, and MFT slack space using MFTECmd, analyzeMFT, and X-Ways Forensics.

Implement a phishing report button in email clients with automated triage workflow that analyzes user-reported suspicious emails and provides feedback to reporters.

Business Email Compromise (BEC) is a sophisticated fraud scheme where attackers impersonate executives, vendors, or trusted partners to trick employees into transferring funds, sharing sensitive data,

Detect malicious email forwarding rules created by adversaries to maintain persistent access to email communications for intelligence collection and BEC attacks.

Hunt for adversary persistence and execution via Windows scheduled tasks by analyzing task creation events, suspicious task properties, and unusual execution patterns that indicate T1053.005 abuse.

Email sandboxing detonates suspicious attachments and URLs in isolated environments to detect zero-day malware and evasive phishing payloads. Proofpoint Targeted Attack Protection (TAP) is an industry

Execute a phased DMARC rollout from p=none monitoring through p=quarantine to p=reject enforcement, ensuring all legitimate email sources are authenticated before blocking unauthorized senders.

Hunt for adversary persistence via Windows Scheduled Tasks by analyzing task creation events, suspicious task actions, and unusual scheduling patterns.

Deploys and monitors ransomware canary files across critical directories using Python's watchdog library for real-time filesystem event detection. Places strategically named decoy files that mimic high-value targets (financial records, credentials, database exports) in locations ransomware typically enumerates first. Monitors for any read, modify, rename, or delete operations on canary files and triggers immediate alerts via email, Slack webhook, or syslog when interaction is detected, providing early warning before full encryption begins.

Analyze Microsoft Outlook PST and OST files for email forensic evidence including message content, headers, attachments, deleted items, and metadata using libpff, pst-utils, and forensic email analysis tools for legal investigations and incident response.

Responds to phishing incidents by analyzing reported emails, extracting indicators, assessing credential compromise, quarantining malicious messages across the organization, and remediating affected accounts. Covers email header analysis, URL/attachment sandboxing, and mailbox-wide purge operations. Activates for requests involving phishing response, email incident, credential phishing, spear phishing investigation, or phishing remediation.

Builds an automated malware submission and analysis pipeline that collects suspicious files from endpoints and email gateways, submits them to sandbox environments and multi-engine scanners, and generates verdicts with IOCs for SIEM integration. Use when SOC teams need to scale malware analysis beyond manual sandbox submissions for high-volume alert triage.

Investigates phishing email incidents from initial user report through header analysis, URL/attachment detonation, impacted user identification, and containment actions using SOC tools like Splunk, Microsoft Defender, and sandbox analysis platforms. Use when a reported phishing email requires full incident investigation to determine scope and impact.

Parse and analyze email headers to trace the origin of phishing emails, verify sender authenticity, and identify spoofing through SPF, DKIM, and DMARC validation.

Examine file system slack space, MFT entries, USN journal, and alternate data streams to recover hidden data and reconstruct file activity on NTFS volumes.

Test web application email functionality for SMTP header injection vulnerabilities that allow attackers to inject additional email headers, modify recipients, and abuse contact forms for spam relay.

Send and read messages across all channels. Routes based on arguments — whatsapp, email, slack, telegram, discord, notion, or natural language like "send [msg] to [contact]".

Execute a quick task with GSD guarantees (atomic commits, state tracking) but skip optional agents

Capture idea or task as todo from current conversation context

List pending todos and select one to work on

Execute a trivial task inline — no subagents, no planning overhead

Zero-friction idea capture. Append, list, or promote notes to todos.

Shows WORK progress and TASK status. Use when the user asks about WORK list, WORK progress, TASK status, or pipeline status (e.g., "WORK list", "WORK-01 progress", "show status").

Execute analyzes existing plugins to extract their capabilities, then adapts and applies those skills to the current task. Acts as a universal skill chameleon that learns from other plugins. Activates when you request "skill adapter" functionality. Use when appropriate context detected. Trigger with relevant phrases based on skill purpose.

Implement intelligent model routing to optimize cost, quality, and latency on OpenRouter. Use when building multi-model systems or optimizing spend across task types. Triggers: 'openrouter routing', 'model routing', 'route to model', 'model selection openrouter'.

Deduplicate HubSpot contacts at production scale — surviving import storms, wrong-winner merges, fuzzy-match blind spots, association orphans, rate-limit exhaustion, and silent merge failures on conflicting lifecycle or opt-out status. Use when cleaning a CRM after a bulk import, running a nightly dedup pipeline on millions of records, recovering from a merge that destroyed the wrong timeline, or building fuzzy matching beyond HubSpot's native email-uniqueness. Trigger with "hubspot dedup", "hubspot merge contacts", "hubspot duplicate contacts", "hubspot contact cleanup", "hubspot import duplicates", "hubspot fuzzy match contacts".

Define custom routing rules for OpenRouter requests based on user tier, task type, cost budget, and availability. Triggers: 'openrouter rules', 'routing rules', 'custom routing openrouter', 'conditional model selection'.

Use when the user has a clear-enough task and wants it decomposed into batched worker sub-tasks before any code is written. Writes a task file under .hyperflow/tasks/ and auto-chains into /hyperflow:dispatch. Trigger with /hyperflow:scope, "plan this", "decompose this task", "break this down", "write the task file".

Use when the user wants a one-screen view of current hyperflow project state — version, profile freshness, memory count, and live progress on every in-flight task. Read-only; never modifies state, never dispatches workers. Trigger with /hyperflow:status, "what is hyperflow doing", "show task progress", "where are we".

Build change detection and event handling for Notion workspaces using polling, native webhooks, and third-party connectors. Use when implementing real-time sync, change feeds, incremental backup, or event-driven workflows with Notion data. Trigger with phrases like "notion webhook", "notion events", "notion change detection", "notion polling", "notion sync changes", "notion real-time", "notion watch for changes".

Migrate data to/from Notion or between Notion workspaces with data mapping and validation. Use when migrating data into Notion databases, exporting from Notion, syncing between workspaces, or building ETL pipelines with Notion as source or destination. Trigger with phrases like "migrate notion", "notion migration", "import to notion", "export from notion", "notion data migration", "notion ETL".

Configure Databricks job notifications, webhooks, and event handling. Use when setting up Slack/Teams notifications, configuring alerts, or integrating Databricks events with external systems. Trigger with phrases like "databricks webhook", "databricks notifications", "databricks alerts", "job failure notification", "databricks slack".

Implement Customer.io webhook and reporting event handling. Use when processing email delivery events, click/open tracking, bounce handling, or streaming to a data warehouse. Trigger: "customer.io webhook", "customer.io events", "customer.io delivery status", "customer.io bounces", "customer.io open tracking".

Execute MaintainX primary workflow: Work Order lifecycle management. Use when creating, updating, and managing work orders through their full lifecycle, from creation to completion with all status transitions. Trigger with phrases like "maintainx work order", "create work order", "work order lifecycle", "maintenance task", "manage work orders".

Production architecture for meeting AI systems using TwinMind: transcription pipeline, memory vault, action item workflow, and calendar integration. Use when implementing reference architecture, or managing TwinMind meeting AI operations. Trigger with phrases like "twinmind reference architecture", "twinmind reference architecture".

Handle TwinMind meeting events including transcription completion, action item extraction, and calendar sync notifications. Use when implementing webhooks events, or managing TwinMind meeting AI operations. Trigger with phrases like "twinmind webhooks events", "twinmind webhooks events".

Create and manage Windsurf Flows for repetitive tasks. Activate when users mention "windsurf flows", "task automation", "workflow automation", "repetitive tasks", or "process automation". Handles Flow creation and management. Use when working with windsurf flows automation functionality. Trigger with phrases like "windsurf flows automation", "windsurf automation", "windsurf".

Different Notion integration architectures: CMS (headless blog), task tracker (project management), knowledge base (wiki), form submission handler, and data pipeline source. Trigger with phrases like "notion cms", "notion headless blog", "notion task tracker", "notion wiki", "notion form handler", "notion data pipeline".

Create, update, archive, and compose Notion pages and block content. Use when building pages programmatically, appending rich content blocks, updating page properties, or managing page lifecycle (archive/restore). Trigger with phrases like "notion create page", "notion add blocks", "notion update page", "notion archive page", "notion content", "notion block types", "notion rich text".

Implement data handling, PII protection, and GDPR/CCPA compliance for Notion integrations. Use when handling sensitive data from Notion pages, implementing data redaction, or ensuring compliance with privacy regulations. Trigger with phrases like "notion data", "notion PII", "notion GDPR", "notion data retention", "notion privacy", "notion CCPA".

Graceful degradation when Notion is down: offline cache, retry with exponential backoff, circuit breaker, health checks, and fallback content. Use when building fault-tolerant Notion integrations for production. Trigger with phrases like "notion reliability", "notion circuit breaker", "notion offline fallback", "notion health check", "notion graceful degradation".

High-volume Notion operations: parallel requests within 3 req/sec, worker queues, database pagination at scale, incremental sync for large workspaces, and memory management for bulk operations. Trigger with phrases like "notion scale", "notion bulk operations", "notion high volume", "notion worker queue", "notion incremental sync".

Draft email replies for Gonto's Gmail accounts ([email protected], [email protected]). Handles intro acceptances, scheduling intent, thanks/ack, and positive short replies. Use when user asks to draft or reply to an email, or when Gmail webhook triggers arrive for auto-draft classification. Draft-only mode — never sends automatically.

Generate the daily executive digest — a single WhatsApp summary of everything needing attention: stalled scheduling, pending intros, unanswered emails, promised follow-ups, open Todoist tasks, and upcoming calendar events. Use when running the daily digest cron, or when user asks for a status digest, daily summary, "what's pending", or "catch me up".

Execute complex Instantly.ai migration strategies for platform changes. Use when migrating between cold email platforms, consolidating workspaces, or re-architecting outreach infrastructure around Instantly. Trigger with phrases like "migrate to instantly", "instantly migration", "switch to instantly", "instantly platform migration", "outreach migration".

Configure Notion integrations across development, staging, and production environments. Use when setting up multi-environment deployments, managing per-environment tokens, or implementing environment-specific Notion configurations. Trigger with phrases like "notion environments", "notion staging", "notion dev prod", "notion environment setup", "notion config by env".

Use when the user wants to set auto-routing mode: on (every task-shaped message routes), auto (intent-verb messages route — default), or off (no auto-routing). Intent-detection runs by default; use this skill to expand to full sticky or disable entirely. Trigger with /hyperflow:sticky, "make hyperflow sticky", "stop using hyperflow", "is hyperflow sticky", "auto-route to hyperflow", "disable hyperflow auto-routing".

Implement Instantly.ai lead data management, GDPR/CAN-SPAM compliance, and list operations. Use when handling lead imports, managing block lists, implementing unsubscribe flows, or ensuring compliance with email regulations. Trigger with phrases like "instantly leads", "instantly data", "instantly GDPR", "instantly block list", "instantly lead management", "instantly unsubscribe".

Push-based web analytics intelligence for your entire site portfolio. Fetches data from Umami (primary) and GA4 (fallback), runs specialist analysis agents in parallel, and delivers actionable insights. Three tiers: mini (30s pulse), medium (2min brief), full (5min deep dive). Supports console, email, and Slack delivery. Trigger with "/analytics", "check my analytics", "how's my traffic", "site stats", "traffic report", "analytics brief", "daily brief".

Manage Instantly.ai email account warmup, analytics, and deliverability. Use when enabling warmup, monitoring sender reputation, pulling analytics, or troubleshooting deliverability issues. Trigger with phrases like "instantly warmup", "instantly analytics", "email warmup instantly", "instantly deliverability", "instantly account health".

Work with Notion blocks, rich text, comments, and page content. Use when reading/writing page content blocks, building rich text, managing comments, or working with nested block trees. Trigger with phrases like "notion blocks", "notion page content", "notion rich text", "notion comments", "notion append blocks".

Optimize Clay table enrichment throughput, reduce processing time, and improve hit rates. Use when experiencing slow enrichment, poor email find rates, or needing to process large tables efficiently. Trigger with phrases like "clay performance", "optimize clay", "clay slow", "clay throughput", "clay fast enrichment", "clay batch optimization".

Query, filter, and manage Notion databases and pages. Use when building database queries with filters and sorts, creating/updating pages with typed properties, or reading page content. Trigger with phrases like "notion database query", "notion filter", "notion create page", "notion update properties", "notion CRUD".

Check Todoist for tasks due today (and overdue) that involve pinging, emailing, or following up with someone. Auto-draft the emails using meeting context and notify via WhatsApp. Use when running the daily due-drafts cron, or when user asks to process email tasks from Todoist.

Create and manage ClickUp webhooks for real-time event notifications. Use when setting up webhook listeners for task/list/space events, implementing two-way sync, or handling ClickUp event payloads. Trigger: "clickup webhook", "clickup events", "clickup notifications", "clickup real-time", "clickup event listener", "clickup webhook create".

Execute Klaviyo primary workflow: profiles, lists, and subscriptions. Use when creating/updating profiles, managing lists, subscribing contacts, or syncing customer data to Klaviyo for email/SMS marketing. Trigger with phrases like "klaviyo profiles", "klaviyo lists", "klaviyo subscribe", "add contacts to klaviyo", "klaviyo customer data".

Takes web search results and formats them as polished Slack messages, digests, or thread summaries ready to post to channels. Use when the user wants to research a topic and share findings on Slack. Trigger with phrases like "research and post to Slack", "create a Slack digest", "summarize and share in #channel", or "format search results for Slack".

Execute Snowflake data transformation with streams, tasks, and dynamic tables. Use when building ELT pipelines, scheduling transformations, or implementing change data capture with Snowflake streams. Trigger with phrases like "snowflake transform", "snowflake ELT", "snowflake stream", "snowflake task", "snowflake pipeline", "snowflake dynamic table", "snowflake CDC".

Strategic narrative — write a standalone strategy memo that frames product direction, bets, and rationale for a planning horizon. Use when asked to "write a strategy doc", "product vision", "strategic narrative", "company strategy memo", "planning memo", or "explain our product direction".

Post-meeting note processing, sharing, and follow-up workflows in Granola. Use when enhancing notes after meetings, sharing to Slack/Notion/CRM, drafting follow-up emails, or processing action items. Trigger: "granola post-meeting", "share granola notes", "granola follow-up", "granola enhance", "granola share".

Execute Hootsuite primary workflow: Core Workflow A. Use when implementing primary use case, building main features, or core integration tasks. Trigger with phrases like "hootsuite main workflow", "primary task with hootsuite".

Write churn prevention and win-back playbooks — risk intervention sequences, save conversation guides, and win-back email campaigns. Use when asked to "prevent churn", "save at-risk customers", "win back churned customers", or "build a save play".

Implement Attio v2 webhooks -- subscribe to record/list/note/task events, verify signatures, filter by object or attribute, and handle idempotently. Trigger: "attio webhook", "attio events", "attio webhook signature", "handle attio events", "attio notifications", "attio real-time".

Execute Bright Data secondary workflow: Core Workflow B. Use when implementing secondary use case, or complementing primary workflow. Trigger with phrases like "brightdata secondary workflow", "secondary task with brightdata".

Execute Framer primary workflow: Core Workflow A. Use when implementing primary use case, building main features, or core integration tasks. Trigger with phrases like "framer main workflow", "primary task with framer".

Execute Framer secondary workflow: Core Workflow B. Use when implementing secondary use case, or complementing primary workflow. Trigger with phrases like "framer secondary workflow", "secondary task with framer".

Build a content calendar — editorial plan, publishing cadence, topic assignment, and distribution workflow. Use when asked to "build a content calendar", "plan our content for the quarter", "how often should we publish", or "create an editorial schedule".

Migrate notes between Apple Notes, Obsidian, Notion, and other platforms. Trigger: "apple notes migration".

Create calendar event creator operations. Auto-activating skill for Business Automation. Triggers on: calendar event creator, calendar event creator Part of the Business Automation skill category. Use when working with calendar event creator functionality. Trigger with phrases like "calendar event creator", "calendar creator", "calendar".

Configure dashboard layout planner operations. Auto-activating skill for Data Analytics. Triggers on: dashboard layout planner, dashboard layout planner Part of the Data Analytics skill category. Use when working with dashboard layout planner functionality. Trigger with phrases like "dashboard layout planner", "dashboard planner", "dashboard".

Generate email template generator operations. Auto-activating skill for Business Automation. Triggers on: email template generator, email template generator Part of the Business Automation skill category. Use when working with email template generator functionality. Trigger with phrases like "email template generator", "email generator", "email".

Sync Fathom meeting data to CRM and build automated follow-up workflows. Use when integrating Fathom with Salesforce, HubSpot, or custom CRMs, or creating automated post-meeting email summaries. Trigger with phrases like "fathom crm sync", "fathom salesforce", "fathom follow-up", "fathom post-meeting workflow".

Diagnose and fix common Finta CRM issues with email sync, deal rooms, and pipeline. Trigger with phrases like "finta error", "finta not working", "fix finta".

Implement event-driven Glean indexing triggered by source system webhooks from GitHub, Confluence, Notion, and other content platforms. Trigger: "glean webhooks", "glean event indexing", "incremental glean index".

Execute Grammarly primary workflow: Core Workflow A. Use when implementing primary use case, building main features, or core integration tasks. Trigger with phrases like "grammarly main workflow", "primary task with grammarly".

Execute Grammarly secondary workflow: Core Workflow B. Use when implementing secondary use case, or complementing primary workflow. Trigger with phrases like "grammarly secondary workflow", "secondary task with grammarly".

Execute Hex primary workflow: Core Workflow A. Use when implementing primary use case, building main features, or core integration tasks. Trigger with phrases like "hex main workflow", "primary task with hex".

Execute Hootsuite secondary workflow: Core Workflow B. Use when implementing secondary use case, or complementing primary workflow. Trigger with phrases like "hootsuite secondary workflow", "secondary task with hootsuite".

Create asana task creator operations. Auto-activating skill for Enterprise Workflows. Triggers on: asana task creator, asana task creator Part of the Enterprise Workflows skill category. Use when working with asana task creator functionality. Trigger with phrases like "asana task creator", "asana creator", "asana".

Configure and manage - Parse email parser operations. Auto-activating skill for Business Automation. Triggers on: email parser, email parser Part of the Business Automation skill category. Use when working with email parser functionality. Trigger with phrases like "email parser", "email parser", "email".

Set up Finta fundraising CRM account and configure integrations. Use when onboarding to Finta, connecting email/calendar, or configuring investor pipeline automation. Trigger with phrases like "install finta", "setup finta", "finta onboarding", "configure finta crm".

Automate Finta pipeline events with Zapier and email triggers. Use when setting up notifications for investor responses, automating follow-up reminders, or syncing events to other tools. Trigger with phrases like "finta automation", "finta notifications", "finta pipeline events", "finta zapier".

Execute Hex secondary workflow: Core Workflow B. Use when implementing secondary use case, or complementing primary workflow. Trigger with phrases like "hex secondary workflow", "secondary task with hex".

Plan load test scenario planner operations. Auto-activating skill for Performance Testing. Triggers on: load test scenario planner, load test scenario planner Part of the Performance Testing skill category. Use when writing or running tests. Trigger with phrases like "load test scenario planner", "load planner", "load".

Generate luigi task generator operations. Auto-activating skill for Data Pipelines. Triggers on: luigi task generator, luigi task generator Part of the Data Pipelines skill category. Use when working with luigi task generator functionality. Trigger with phrases like "luigi task generator", "luigi generator", "luigi".

Create slack bot creator operations. Auto-activating skill for Business Automation. Triggers on: slack bot creator, slack bot creator Part of the Business Automation skill category. Use when working with slack bot creator functionality. Trigger with phrases like "slack bot creator", "slack creator", "slack".

Plan soak test planner operations. Auto-activating skill for Performance Testing. Triggers on: soak test planner, soak test planner Part of the Performance Testing skill category. Use when writing or running tests. Trigger with phrases like "soak test planner", "soak planner", "soak".

Manage Slack channel access control — pairing, allowlist, channel opt-in

Engineering lead — hand Apex any task and it routes internally. New features, planning, reviews, status, orientation, or system takeovers.

Configure Slack channel tokens (bot token + app-level token)

Hyperflow planning phase. Use when a task is clear enough to decompose into batched steps before writing code — verbs like scope, decompose, "plan out", "break down", "plan this". Read-only with respect to source; writes a task file to .hyperflow/tasks/<slug>.md, then hands off to hyperflow-dispatch.

Hyperflow auto-routing mode. Use to control how aggressively hyperflow auto-routes — "make hyperflow sticky", "stop using hyperflow", "auto-route to hyperflow", "disable hyperflow auto-routing". Sets on (every task-shaped message routes) / auto (intent-verb messages route — default) / off (no auto-routing).

Hyperflow project status. Use to see current hyperflow state — "what is hyperflow doing", "show task progress", "where are we". Read-only — reports in-flight tasks, memory count, and progress. Never modifies state or runs work.