opencode-skills-collection 4.0.68 → 4.0.70

package/bundled-skills/mongodb/SKILL.md

@@ -0,0 +1,436 @@
+---
+name: mongodb
+description: Administer MongoDB databases. Configure replica sets, sharding, and backups.
+  Use when managing MongoDB deployments.
+category: devops
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant OS/platform tooling and privileged access where
+  noted. Docs-only; helper scripts and templates not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# MongoDB
+
+Administer, optimize, and secure MongoDB NoSQL databases in development and production environments.
+
+## When to Use
+
+- You need a document-oriented database with flexible schemas.
+- Your data is semi-structured or heavily nested (JSON-like documents).
+- You need horizontal scaling through sharding.
+- Your application benefits from rich querying and aggregation pipelines.
+
+## Prerequisites
+
+- Linux server (Debian/Ubuntu or RHEL-based) or Docker.
+- Root or sudo access for package installation.
+- MongoDB 7.x recommended for production (6.x still supported).
+
+## Installation and Setup
+
+```bash
+# Debian / Ubuntu — MongoDB 7
+curl -fsSL https://www.mongodb.org/static/pgp/server-7.0.asc | \
+  sudo gpg -o /usr/share/keyrings/mongodb-server-7.0.gpg --dearmor
+echo "deb [ signed-by=/usr/share/keyrings/mongodb-server-7.0.gpg ] \
+  https://repo.mongodb.org/apt/ubuntu jammy/mongodb-org/7.0 multiverse" | \
+  sudo tee /etc/apt/sources.list.d/mongodb-org-7.0.list
+sudo apt update
+sudo apt install -y mongodb-org
+
+# Start and enable
+sudo systemctl enable --now mongod
+
+# Verify
+mongosh --eval "db.version()"
+```
+
+## Initial User Setup
+
+```javascript
+// Connect without auth first
+// mongosh
+
+use admin
+
+// Create admin user
+db.createUser({
+  user: "admin",
+  pwd: "strong_admin_password",
+  roles: [
+    { role: "userAdminAnyDatabase", db: "admin" },
+    { role: "readWriteAnyDatabase", db: "admin" },
+    { role: "clusterAdmin", db: "admin" }
+  ]
+})
+
+// Create an application-scoped user
+use mydb
+db.createUser({
+  user: "myapp",
+  pwd: "strong_app_password",
+  roles: [{ role: "readWrite", db: "mydb" }]
+})
+```
+
+Enable authentication in `/etc/mongod.conf`:
+
+```yaml
+security:
+  authorization: enabled
+```
+
+```bash
+sudo systemctl restart mongod
+# Now connect with credentials
+mongosh -u myapp -p strong_app_password --authenticationDatabase mydb
+```
+
+## mongosh Commands Reference
+
+```javascript
+// Show databases and collections
+show dbs
+use mydb
+show collections
+
+// Insert documents
+db.users.insertOne({ name: "Alice", email: "alice@example.com", age: 30 })
+db.users.insertMany([
+  { name: "Bob", email: "bob@example.com", age: 25 },
+  { name: "Carol", email: "carol@example.com", age: 35 }
+])
+
+// Query documents
+db.users.find({ age: { $gte: 25 } }).sort({ name: 1 }).limit(10)
+db.users.findOne({ email: "alice@example.com" })
+db.users.countDocuments({ age: { $gte: 30 } })
+
+// Update
+db.users.updateOne(
+  { email: "alice@example.com" },
+  { $set: { age: 31 }, $currentDate: { updatedAt: true } }
+)
+db.users.updateMany(
+  { age: { $lt: 30 } },
+  { $set: { tier: "junior" } }
+)
+
+// Delete
+db.users.deleteOne({ email: "bob@example.com" })
+db.users.deleteMany({ tier: "junior" })
+```
+
+## Indexing
+
+```javascript
+// Single-field index
+db.users.createIndex({ email: 1 }, { unique: true })
+
+// Compound index
+db.orders.createIndex({ userId: 1, createdAt: -1 })
+
+// Text index for search
+db.articles.createIndex({ title: "text", body: "text" })
+db.articles.find({ $text: { $search: "mongodb scaling" } })
+
+// TTL index — auto-delete documents after 30 days
+db.sessions.createIndex({ createdAt: 1 }, { expireAfterSeconds: 2592000 })
+
+// List indexes
+db.users.getIndexes()
+
+// Drop an index
+db.users.dropIndex("email_1")
+
+// Explain a query to verify index usage
+db.orders.find({ userId: 42 }).explain("executionStats")
+```
+
+## Aggregation Pipeline Examples
+
+```javascript
+// Revenue per status
+db.orders.aggregate([
+  { $group: {
+      _id: "$status",
+      totalRevenue: { $sum: "$total" },
+      count: { $sum: 1 }
+  }},
+  { $sort: { totalRevenue: -1 } }
+])
+
+// Top 5 customers by order value (with a join)
+db.orders.aggregate([
+  { $group: {
+      _id: "$userId",
+      spent: { $sum: "$total" },
+      orderCount: { $sum: 1 }
+  }},
+  { $sort: { spent: -1 } },
+  { $limit: 5 },
+  { $lookup: {
+      from: "users",
+      localField: "_id",
+      foreignField: "_id",
+      as: "user"
+  }},
+  { $unwind: "$user" },
+  { $project: {
+      _id: 0,
+      name: "$user.name",
+      email: "$user.email",
+      spent: 1,
+      orderCount: 1
+  }}
+])
+
+// Daily signup trend
+db.users.aggregate([
+  { $group: {
+      _id: { $dateToString: { format: "%Y-%m-%d", date: "$createdAt" } },
+      signups: { $sum: 1 }
+  }},
+  { $sort: { _id: 1 } },
+  { $limit: 30 }
+])
+```
+
+## Replica Set Setup
+
+A replica set requires a minimum of three members (or two data-bearing nodes plus an arbiter).
+
+### Configuration File for Each Member
+
+```yaml
+# /etc/mongod.conf (adjust port and dbPath per member)
+storage:
+  dbPath: /var/lib/mongodb
+net:
+  port: 27017
+  bindIp: 0.0.0.0
+replication:
+  replSetName: rs0
+security:
+  authorization: enabled
+  keyFile: /etc/mongodb-keyfile
+```
+
+```bash
+# Generate a shared keyfile for internal auth
+openssl rand -base64 756 > /etc/mongodb-keyfile
+chmod 400 /etc/mongodb-keyfile
+chown mongodb:mongodb /etc/mongodb-keyfile
+# Copy this file to all replica set members
+```
+
+### Initialize the Replica Set
+
+```javascript
+// Connect to the first member
+// mongosh --port 27017
+
+rs.initiate({
+  _id: "rs0",
+  members: [
+    { _id: 0, host: "mongo1:27017", priority: 2 },
+    { _id: 1, host: "mongo2:27017", priority: 1 },
+    { _id: 2, host: "mongo3:27017", priority: 1 }
+  ]
+})
+
+// Check status
+rs.status()
+
+// View replication lag per member
+rs.printReplicationInfo()
+rs.printSecondaryReplicationInfo()
+```
+
+## Backup and Restore
+
+```bash
+# Full dump of all databases
+mongodump --uri="mongodb://admin:secret@localhost:27017" --out=/backups/full_$(date +%F)
+
+# Single database
+mongodump --uri="mongodb://myapp:secret@localhost:27017/mydb" --out=/backups/mydb_$(date +%F)
+
+# Compressed dump
+mongodump --uri="mongodb://admin:secret@localhost:27017" --gzip --out=/backups/gz_$(date +%F)
+
+# Restore all databases
+mongorestore --uri="mongodb://admin:secret@localhost:27017" /backups/full_2025-01-15/
+
+# Restore a single database, dropping existing data first
+mongorestore --uri="mongodb://admin:secret@localhost:27017" \
+  --drop --db mydb /backups/mydb_2025-01-15/mydb/
+
+# Restore compressed dump
+mongorestore --uri="mongodb://admin:secret@localhost:27017" --gzip /backups/gz_2025-01-15/
+```
+
+## Docker Compose Setup
+
+```yaml
+# docker-compose.yml
+version: "3.9"
+
+services:
+  mongo1:
+    image: mongo:7
+    restart: unless-stopped
+    ports:
+      - "27017:27017"
+    environment:
+      MONGO_INITDB_ROOT_USERNAME: admin
+      MONGO_INITDB_ROOT_PASSWORD: secret
+    volumes:
+      - mongo1_data:/data/db
+      - ./mongo-keyfile:/etc/mongodb-keyfile:ro
+    command: >
+      mongod
+        --replSet rs0
+        --keyFile /etc/mongodb-keyfile
+        --bind_ip_all
+    healthcheck:
+      test: ["CMD", "mongosh", "--eval", "db.adminCommand('ping')"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  mongo2:
+    image: mongo:7
+    restart: unless-stopped
+    volumes:
+      - mongo2_data:/data/db
+      - ./mongo-keyfile:/etc/mongodb-keyfile:ro
+    command: >
+      mongod
+        --replSet rs0
+        --keyFile /etc/mongodb-keyfile
+        --bind_ip_all
+
+  mongo3:
+    image: mongo:7
+    restart: unless-stopped
+    volumes:
+      - mongo3_data:/data/db
+      - ./mongo-keyfile:/etc/mongodb-keyfile:ro
+    command: >
+      mongod
+        --replSet rs0
+        --keyFile /etc/mongodb-keyfile
+        --bind_ip_all
+
+  mongo-init:
+    image: mongo:7
+    restart: "no"
+    depends_on:
+      mongo1:
+        condition: service_healthy
+    entrypoint: >
+      mongosh --host mongo1 -u admin -p secret --authenticationDatabase admin --eval '
+        rs.initiate({
+          _id: "rs0",
+          members: [
+            { _id: 0, host: "mongo1:27017", priority: 2 },
+            { _id: 1, host: "mongo2:27017", priority: 1 },
+            { _id: 2, host: "mongo3:27017", priority: 1 }
+          ]
+        })
+      '
+
+volumes:
+  mongo1_data:
+  mongo2_data:
+  mongo3_data:
+```
+
+```bash
+# Generate keyfile before starting
+openssl rand -base64 756 > mongo-keyfile
+chmod 400 mongo-keyfile
+
+docker compose up -d
+
+# Connect
+mongosh "mongodb://admin:secret@127.0.0.1:27017/?replicaSet=rs0&authSource=admin"
+```
+
+## Monitoring Queries
+
+```javascript
+// Server status summary
+db.serverStatus().connections
+db.serverStatus().opcounters
+
+// Current operations (look for long-running queries)
+db.currentOp({ secs_running: { $gte: 5 } })
+
+// Collection stats
+db.orders.stats()
+
+// Index sizes
+db.orders.stats().indexSizes
+
+// Profiler — log slow queries (> 100ms)
+db.setProfilingLevel(1, { slowms: 100 })
+db.system.profile.find().sort({ ts: -1 }).limit(5)
+
+// Replica set lag
+rs.printSecondaryReplicationInfo()
+```
+
+## Configuration Tuning
+
+```yaml
+# /etc/mongod.conf — production recommendations
+storage:
+  dbPath: /var/lib/mongodb
+  journal:
+    enabled: true
+  wiredTiger:
+    engineConfig:
+      cacheSizeGB: 4          # ~50% of RAM, leave rest for OS cache
+    collectionConfig:
+      blockCompressor: snappy
+net:
+  port: 27017
+  bindIp: 0.0.0.0
+  maxIncomingConnections: 500
+operationProfiling:
+  mode: slowOp
+  slowOpThresholdMs: 100
+```
+
+## Troubleshooting
+
+| Symptom | Likely Cause | Fix |
+|---|---|---|
+| `COLLSCAN` in explain output | Missing index on queried field | Create an appropriate index |
+| Replica member stuck in `RECOVERING` | Oplog window exceeded | Resync by removing data and restarting the member |
+| `too many open files` | OS file descriptor limit too low | Set `ulimit -n 65535` in service file |
+| High memory usage | WiredTiger cache too large | Reduce `cacheSizeGB` in config |
+| Slow aggregation pipelines | No index on `$match` stage fields | Add index; place `$match` as early as possible in pipeline |
+| Authentication failure | Wrong `authenticationDatabase` | Specify `--authenticationDatabase admin` for admin users |
+
+## Related Skills
+
+- redis (`redis`) - Caching layer in front of MongoDB
+- database-backups (`database-backups`) - Automated backup strategies
+- postgresql (`postgresql-devsec`) - Alternative relational database
+
+## Limitations
+
+- Infrastructure commands can disrupt services: confirm target host/scope and have backups/snapshots before mutating state.
+- Docs-only import: upstream scripts and templates not bundled.
+

package/bundled-skills/monte-carlo-analyze-root-cause/SKILL.md

@@ -1,6 +1,6 @@
 ---
+description: Curated upstream guidance for Monte Carlo Analyze Root Cause; use when the workflow matches the user goal.
 name: monte-carlo-analyze-root-cause
-description: "Investigate data incidents and find root causes using Monte Carlo's observability data. Guides the agent through systematic investigation: alert lookup, lineage tracing, ETL checks, query analysis, and data profiling."
 risk: critical
 source: https://github.com/monte-carlo-data/mc-agent-toolkit/tree/main/skills/analyze-root-cause
 source_repo: monte-carlo-data/mc-agent-toolkit
@@ -9,6 +9,9 @@ date_added: 2026-07-01
 license: Apache-2.0
 license_source: https://github.com/monte-carlo-data/mc-agent-toolkit/blob/main/LICENSE
 ---
+## When to Use
+
+- Use when the user goal matches this upstream workflow.
 
 # Monte Carlo Root Cause Analysis Skill
 
@@ -222,6 +225,14 @@ Read `references/common-root-causes.md` to match findings against known patterns
 - **Do not invoke TSA without an incident UUID.** `run_troubleshooting_agent` requires one. If intake is on the no-incident path, skip TSA entirely until/unless an alert is identified.
 - **Honor explicit user opt-outs.** If the user says "skip TSA", "manual only", or similar, do not call `run_troubleshooting_agent` or `alert_assessment` — proceed with the manual investigation only.
 
+
+## Examples
+
+```text
+User: Apply this skill to my current task.
+Assistant: Follow the workflow in this skill, cite limitations, and ask before risky steps.
+```
+
 ## Limitations
 
 - Use this skill only when the task clearly matches its upstream source and local project context.

package/bundled-skills/monte-carlo-asset-health/SKILL.md

@@ -1,6 +1,6 @@
 ---
+description: Curated upstream guidance for Monte Carlo Asset Health; use when the workflow matches the user goal.
 name: monte-carlo-asset-health
-description: Check the health of a data table/asset using Monte Carlo. Activates on "how is table X", "check health of X", "is X healthy", "status of X", "check on X table", or any health/status question about a data asset.
 risk: critical
 source: https://github.com/monte-carlo-data/mc-agent-toolkit/tree/main/skills/asset-health
 source_repo: monte-carlo-data/mc-agent-toolkit
@@ -9,6 +9,9 @@ date_added: 2026-07-01
 license: Apache-2.0
 license_source: https://github.com/monte-carlo-data/mc-agent-toolkit/blob/main/LICENSE
 ---
+## When to Use
+
+- Use when the user goal matches this upstream workflow.
 
 # Monte Carlo Asset Health Skill
 
@@ -193,6 +196,14 @@ Only include recommendations derivable from collected data:
 - Active alerts that need acknowledgment or investigation
 - Do NOT recommend specific monitor types — that is outside this skill's scope
 
+
+## Examples
+
+```text
+User: Apply this skill to my current task.
+Assistant: Follow the workflow in this skill, cite limitations, and ask before risky steps.
+```
+
 ## Limitations
 
 - Use this skill only when the task clearly matches its upstream source and local project context.

package/bundled-skills/monte-carlo-context-detection/SKILL.md

@@ -0,0 +1,170 @@
+---
+name: monte-carlo-context-detection
+description: Route data-related requests to the right Monte Carlo skill or workflow.
+  USE WHEN alerts, incidents, data broken, stale, coverage gaps, data quality, or
+  any ambiguous data observability request.
+when_to_use: 'Invoke for ambiguous or incomplete data-observability requests that
+  don''t clearly name a specific skill.
+
+  Example triggers: "something is wrong with my data", "I have alerts firing", "check
+  my pipelines", "what should I monitor?", "my data looks off".
+
+
+  CRITICAL on vague first turns: ALWAYS ask 1–3 targeted clarifying questions FIRST
+  (what symptom? which table/warehouse? when did it start?). Do NOT call Monte Carlo
+  MCP tools (get_alerts, search, get_table, etc.) on turn 1 until the user has named
+  a specific table, warehouse, or alert. Calling tools prematurely on a vague prompt
+  wastes turns and frustrates the user.
+
+
+  Do NOT invoke when the user''s intent clearly matches a single existing skill (e.g.
+  "check health of orders table" → asset-health; "create a volume monitor on X" →
+  monitoring-advisor).
+
+  '
+bucket: Agent-routing
+version: 1.0.0
+source_repo: monte-carlo-data/mc-agent-toolkit
+source_type: community
+source: community
+date_added: '2026-09-21'
+risk: unknown
+---
+## When to Use
+- Use when this upstream workflow matches the user's stated goal.
+- Use when the task requires the procedures documented in this skill.
+
+# Monte Carlo Context Detection
+
+This skill determines which Monte Carlo skill or workflow best fits the user's current context. It activates reactively for ambiguous or multi-step data-related messages, gathers signals, and routes to the right skill or workflow.
+
+> **Monte Carlo tool routing (required):** Always call Monte Carlo MCP tools through this plugin's
+> bundled server, whose fully-qualified tool names are
+> `mcp__plugin_mc-agent-toolkit_monte-carlo-mcp__<tool>` (e.g.
+> `mcp__plugin_mc-agent-toolkit_monte-carlo-mcp__get_alerts`). Bare tool names used in this skill
+> (`get_alerts`, `search`, `get_table`, …) refer to that bundled server. If the session also has a
+> separately-configured `monte-carlo-mcp` server, do **not** route to it — it may point at a
+> different endpoint or credentials.
+
+Reference file for signal definitions: `references/signal-definitions.md` (relative to this file). Read it before routing.
+
+## When to activate this skill
+
+This skill is activated by the CLAUDE.md routing table when:
+
+- The user's message relates to data quality, alerts, incidents, coverage, or Monte Carlo — but doesn't clearly match a single skill in the routing table
+- The user's intent is ambiguous or could span multiple skills
+- The user asks a broad question like "help me with my data" or "what's going on?"
+
+## When NOT to activate this skill
+
+- A skill or workflow is already active in the conversation — the active skill owns the conversation, do not intercept
+- The user's message clearly matches a single skill in the CLAUDE.md routing table — route directly, no need for context detection
+- The user is editing a dbt model — defer to the `prevent` skill which auto-activates via hooks
+- The user's message is not data-related at all
+
+---
+
+## Workflow: Reactive Routing
+
+This skill is purely reactive — it activates for ambiguous or multi-step data-related messages and routes them.
+
+Follow these steps in order.
+
+### Step 0: Fast-path clear intent (stop early if matched)
+
+Before doing anything else, check whether the user's message unambiguously matches a single existing skill. If so, **skip the rest of this workflow** and immediately load that skill — do NOT read `references/signal-definitions.md`, do NOT make API probes.
+
+| Clear user intent | Skill to load immediately |
+|---|---|
+| "Check health of [named table]" / "status of [named table]" | `../asset-health/SKILL.md` |
+| "Create a [monitor type] on [named table]" | `../monitoring-advisor/SKILL.md` |
+| "Investigate alert on [named table]" / "why is [named table] stale/broken?" | `../incident-response/SKILL.md` |
+| "What should I monitor?" / "where are my coverage gaps?" | `../proactive-monitoring/SKILL.md` |
+| "Instrument my agent" / "set up Monte Carlo tracing on [named framework] agent" / "setting up an agent" | `../instrument-agent/SKILL.md` |
+
+Context-detection is for **ambiguous** requests only. If the request is clear, routing through this skill wastes turns and tokens.
+
+If no clear match, proceed to Step 1.
+
+### Step 1: Categorize intent
+
+Read `references/signal-definitions.md` for the full signal catalog. Determine which category the user's message falls into:
+
+| Category | Signals | Example messages |
+|----------|---------|-----------------|
+| **Specific asset** | User mentions a table name, or has a `.sql` model file open in their IDE | "what's wrong with stg_payments?", "check this table" |
+| **Active incident** | Keywords: alert, broken, stale, failing, incident, triage, wrong data | "I have alerts firing", "data looks wrong", "something broke" |
+| **Coverage/monitoring** | Keywords: monitor, coverage, gaps, unmonitored, what should I watch | "what should I monitor?", "where are my gaps?" |
+| **Agent instrumentation** | Keywords: instrument, set up tracing, set up Monte Carlo tracing, setting up an agent. Often mentions an AI framework (LangChain, LangGraph, OpenAI, Anthropic, CrewAI, Bedrock, SageMaker, Vertex AI) | "instrument my agent", "set up MC tracing on my LangGraph agent", "setting up an agent" |
+| **General/exploratory** | No clear category, broad question | "help me with data quality", "what can Monte Carlo do?" |
+
+### Step 2: Gather scope (only if needed)
+
+- **Specific asset known** (from file context or user mention) → proceed to Step 3
+- **Active incident, no scope** → ask: "Want me to check recent alerts? Any specific time range or severity?"
+- **Coverage/monitoring, no scope** → ask: "Which warehouse should I look at, or should I check across all?"
+- **General/exploratory** → present the categories: "I can help with: (1) investigating active alerts or data issues, (2) analyzing monitoring coverage and creating monitors, or (3) checking the health of specific tables. What are you looking for?"
+
+### Step 3: Scoped API probe (when scope is available)
+
+Only make API calls when you have enough context to scope them:
+
+- **Specific asset** → call `get_alerts` with the table's MCON or name filter, and `get_monitors` for that table
+- **Active incident with scope** → call `get_alerts` with the user's time range / severity filters
+- **Coverage/monitoring** → skip API probe, route directly to proactive monitoring workflow (it handles its own API calls)
+- **If MCP tool calls fail** (auth not configured) → skip API, fall back to conversation intent alone
+
+**Always scope MCP calls tightly.** Unscoped `get_alerts`, `search`, or `get_monitors` on large accounts can return hundreds of results, overflow the tool-result token limit, spill to disk, and force expensive chunk reads — burning user tokens and risking workflow failure. Minimum scoping:
+
+- `get_alerts` → time filter (`created_after`, default last 7 days) + at least one of `warehouse`, `table_names`, `severity`
+- `search` → needed to resolve a table name to its MCON (`get_table` requires MCON). ALWAYS pass `limit` (e.g. 5), the table name as `query`, and filter by `warehouse_uuid` or `database`/`schema`. `warehouse_types` alone ("snowflake") matches thousands of tables. Disambiguation rules when multiple matches return:
+  1. If the user named a warehouse (e.g. "analytics-snowflake") → auto-pick the match whose `warehouse_display_name` matches and proceed. Do NOT stop to ask.
+  2. If the user named a database/schema → auto-pick the match in that database/schema.
+  3. If one match is flagged `is_key_asset: true` and others aren't → auto-pick the key asset.
+  4. Only ask the user to disambiguate when none of the above resolve it.
+- `get_monitors` → always filter by `mcons` (table MCON) or `warehouse_uuid`
+
+If you don't have enough scope, ask the user before calling.
+
+### Step 4: Route
+
+Based on the combined signals from Steps 1-3:
+
+| Combined signals | Confidence | Action |
+|-----------------|------------|--------|
+| Active alerts found + incident intent | High | **Auto-activate** incident response workflow: read and follow `../incident-response/SKILL.md` |
+| Coverage intent + data project detected | High | **Auto-activate** proactive monitoring workflow: read and follow `../proactive-monitoring/SKILL.md` |
+| User asks to create a specific monitor (type + table known) | High | **Auto-activate** monitoring-advisor: read and follow `../monitoring-advisor/SKILL.md` |
+| Table mentioned + "health" / "status" / "check" intent | High | **Auto-activate** asset-health: read and follow `../asset-health/SKILL.md` |
+| Agent instrumentation intent (instrument / set up tracing / setting up an agent) + Python codebase context | High | **Auto-activate** instrument-agent: read and follow `../instrument-agent/SKILL.md` |
+| Ambiguous or conflicting signals | Low | **Suggest** options and wait for user to choose |
+
+**High confidence = auto-activate.** Load the target skill's SKILL.md and begin executing it immediately. Do not ask for confirmation.
+
+**Low confidence = suggest.** Present 2-3 options with brief descriptions and let the user choose. Example:
+
+> "Based on what you've described, I can:
+> 1. **Investigate alerts** — triage and fix active data issues (incident response workflow)
+> 2. **Improve monitoring** — find coverage gaps and create monitors (proactive monitoring workflow)
+>
+> Which would be most helpful?"
+
+### Prevent guardrail
+
+If the user is **actively editing** a dbt model file (making code changes, not just viewing or asking about it) and the `prevent` skill's hooks are active, do NOT route to any other skill. Instead respond:
+
+> "The prevent skill will automatically handle impact assessment for dbt model changes via its pre-edit hooks. No additional routing needed."
+
+
+## Examples
+
+```text
+User: Apply this skill to my current task.
+Assistant: Follow the workflow in this skill, cite limitations, and ask before risky steps.
+```
+
+## Limitations
+
+- Imported upstream skill; verify credentials, permissions, and safety boundaries before execution.
+- Does not replace environment-specific validation, testing, or maintainer review.