pleasefixai/dash

Use this skill whenever you want to investigate a specific agent runtime session or security detection: pulling the full session timeline, reconstructing what the agent actually did, and surfacing intent drift, data exposure, unsafe actions, and blast radius to produce an incident write-up with a recommended response. Trigger on requests like "investigate this detection", "what happened in this session", "pull the runtime timeline for this alert", "did this agent leak data or run something unsafe", "write up this incident", or any depth-first dive on one session, alert, or agent behavior. Also use this when triaging an alert into a clear findings narrative. This skill is depth on a single session or detection, so use it whenever you need to understand and document exactly what one agent did.

Use this skill for a high-level overview of the agentic environment and how AI is used across the organization. This is the front-door discovery view: how many agent platforms are running and their breakdown by type (coding agents, AI assistants, agentic browsers, autonomous agents, LLM apps, local LLMs), how many devices and users are active, how many MCP servers exist, what is managed versus shadow, the risk breakdown, and what needs attention now. Trigger on broad, first-look requests like "give me an overview of my agentic environment", "what's going on across the org", "how many agents and users do we have", "what AI is running on our workstations", "how many platforms are managed versus shadow", "summarize my security posture", "what needs my attention", or "who is using AI here and how much." Default to this skill for wide, exploratory questions and as the starting point before drilling in; use a more specific skill only when the ask is clearly targeted.

Use this skill whenever you want AI cost and consumption metrics: spend, token usage, model consumption, and usage trends across your whole organization, or scoped to a single user, group, or department. Trigger on requests like "show me our AI spend", "how much is this team spending on AI", "break down token usage by department", "what is this user costing us", "who are our heaviest AI consumers", "trend our model spend this month", or any ask about AI cost, consumption, usage volume, or spend attribution. The skill handles two modes: a full organization-wide picture, or a scoped view when you name a user, group, or department, so watch for a named scope in the request and apply it. Use this skill whenever the question is about what AI is costing and where that cost comes from.

Use this skill whenever you want to find and govern shadow AI in your environment: unsanctioned, unmanaged, or out-of-policy AI usage such as personal assistant accounts, unapproved copilots, AI tools running outside security review, and agents operating without governance. Trigger on requests like "find shadow AI here", "who is using AI tools we haven't approved", "is Copilot usage governed", "surface ungoverned assistants and accounts", "what AI is running outside policy", or any ask about unapproved, unsanctioned, or blind-spot AI usage and the governance gap it creates. Also use this when you need to tell whether AI usage you already found is sanctioned and policy-covered versus rogue. This skill is about usage that escapes governance, so use it whenever the concern is AI running where it should not be.

Use this skill whenever you want to assess the agent supply chain as an attack surface: the trust, provenance, and integrity of the MCP servers, tools, connectors, third-party packages, and model endpoints your agents depend on. Trigger on requests like "is this MCP server safe to trust", "assess our agent supply chain risk", "where did this tool come from and who controls it", "check these connectors for tampering or over-broad scopes", "which third-party components could compromise our agents", or anything touching malicious or compromised MCP servers, dependency risk, tool poisoning, or untrusted integrations. Also use this when vetting a new integration before you approve it or reviewing which platforms you trust. This skill is about the trustworthiness of the components agents rely on, so use it whenever the question is whether something in the chain can be trusted.