Elasticsearch
DatabaseCommonly used with
Skills using Elasticsearch (38)
hunt-cloud-misconfig
Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed CloudFront origin, public Lambda function URL, public RDS snapshot, IAM credentials in JS bundles, AWS metadata accessible via SSRF. GCP: public GCS buckets, exposed Cloud Run services, leaked service account JSON. Azure: public blob containers, exposed Function App. (Kubernetes/Docker exposure is owned by hunt-k8s; CI/CD pipeline attacks by hunt-cicd; post-credential IAM escalation by cloud-iam-deep.) Detection: targeted dorking, certificate transparency, JS bundle secret extraction, port scan for known service ports. Validate: actual data read / write / RCE. Use when hunting cloud-native storage and compute misconfig (S3/GCS/Blob, IMDS-via-SSRF, serverless, public managed services).
hunt-nosqli
Hunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump. Use when target uses MongoDB/Mongoose, CouchDB, Redis, or shows NoSQL error messages.
hunt-rag-vector
Hunt vector-store / embedding-layer weaknesses in RAG pipelines (OWASP LLM08 Vector and Embedding Weaknesses) — persistent corpus poisoning that survives across sessions and users (distinct from one-shot indirect prompt injection, which is owned by hunt-llm-ai), cross-tenant vector-database IDOR (unauthenticated or unscoped queries against Pinecone/Weaviate/Chroma/Milvus/Qdrant/pgvector), source-text/metadata leakage in similarity-search results, and retrieval-hijack via adversarial embedding proximity ('SEO poisoning' for RAG). Targets: any app with a shared knowledge base, document upload feeding a chatbot, or a directly reachable vector-DB port. Validate: a second, clean session/account must inherit a poisoned result, or a cross-tenant artifact must be independently verifiable — confabulation is not a finding, same bar as hunt-llm-ai. Use when target is RAG-backed, exposes a vector-DB port, or lets users upload documents that other users' queries later retrieve.
log-analysis--siem-integration
Security log parsing, anomaly detection, SIEM query building, Sigma rule creation, and correlation rule development across Splunk, Elastic, QRadar, and Microsoft Sentinel
health
Service/infra health via liveness/readiness checks, resource usage, quick diagnostics. Triggers: health check, services up, system status, infra health, degraded service.
building-detection-rules-with-sigma
Builds vendor-agnostic detection rules using the Sigma rule format for threat detection across SIEM platforms including Splunk, Elastic, and Microsoft Sentinel. Use when creating portable detection logic from threat intelligence, mapping rules to MITRE ATT&CK techniques, or converting community Sigma rules into platform-specific queries using sigmac or pySigma backends.
building-super-timelines-with-plaso
Generate log2timeline and Plaso super-timelines and triage them in Timesketch.
log-analyzer
日志分析助手 — 智能解析日志文件，识别异常模式，定位问题根因
loom-search
Full-text search and search engine implementation.
hybrid-search-architect
Designs a hybrid retrieval pipeline combining dense vector search and BM25 sparse search with reciprocal rank fusion, and explains when to use each configuration.
convex-suggest
Suggest the matching Convex component when the user hand-rolls a pattern it already solves (crons, sharded-counter, rate-limiter, storage, search, presence, workflow, RAG, prosemirror-sync). Passive — suggest after the task, never interrupt. Never install without consent.
algo-ecom-bm25
"Implement BM25 ranking function for e-commerce product search relevance scoring. Use this skill when the user needs to build a text-based product search engine, improve search result relevance, or replace basic TF-IDF with a more robust ranking function — even if they say 'product search ranking', 'search relevance', or 'BM25 implementation'.".
elasticsearch
Elasticsearch 集群管理
search-infra
Design and operate full-text and vector search infrastructure — inverted-index engines (Elasticsearch/OpenSearch, Meilisearch, Typesense), analyzers and tokenization, relevance tuning (BM25, boosting, synonyms), faceting, and semantic/vector search (embeddings, ANN indexes, hybrid retrieval). Use when adding a search box, choosing a search engine, designing an index mapping and analyzer chain, tuning relevance, building autocomplete, deciding keyword vs vector vs hybrid retrieval, or keeping a search index in sync with the source database. Boundary vs db-design — db-design owns the durable transactional source of truth (normalized PostgreSQL schema, known-key indexes, migrations, ACID); this skill owns the derived denormalized search index built FROM that source for ranked free-text/semantic retrieval, where the engine is eventually-consistent, rebuildable, and never the system of record. Defers cache concerns to redis and RAG prompt assembly to llm-patterns.
database
Database design, SQL, NoSQL, and data management
dashboard-builder
Build monitoring dashboards that answer real operator questions for Grafana, SigNoz, and similar platforms. Use when turning metrics into a working dashboard instead of a vanity board.
shopware6
Shopware 6 development across plugins, apps and themes: DAL entities, migrations, custom fields and entity extensions, Storefront (Twig, SCSS, JS plugin system), Admin (Vue 3, Meteor Admin SDK), Admin API and Store API, cart processors, collectors and validators, payment and shipping handlers, rule builder conditions, CMS elements, App System manifests and webhooks, SEO URLs, mail templates, state machines, message queue, Elasticsearch, HTTP cache, PHPUnit and Jest testing, security and deployment. Use when the user asks to create a Shopware plugin, subscriber, custom entity or admin module, override a Storefront template, decorate a service, write a DAL migration, or handle any other Shopware 6 development task.
scaffold-archipy-observability
Configure ArchiPy 5.x OpenTelemetry traces, metrics, logs, AppUtils instrumentation, and decorators. Use when adding OTLP observability or migrating removed Sentry, Elastic APM, or Prometheus integrations.
logging-patterns
Python logging patterns covering stdlib logging configuration, structured logging with structlog, log levels, handlers, formatters, and context binding. Use whenever a project uses Python logging, structlog, or the user asks about log levels, log formatting, structured logs, or JSON logging, even if "logging" is not mentioned by name.
mcp-data-fidelity
Datentreue-Regeln für MCP-Server-Tools, die eine externe Datenquelle abfragen — damit ein Server nicht still unvollständig liefert. Verwende diesen Skill ergänzend zu mcp-builder immer wenn (1) ein Such-, Query- oder Filter-Tool für einen MCP-Server entworfen oder implementiert wird, (2) eine Tool-Description für ein datenabfragendes Tool geschrieben oder überarbeitet wird, (3) jemand meldet, ein Server finde nichts, zu wenig oder weniger als die offizielle Oberfläche («findet nichts», «leeres Ergebnis», «Web-UI zeigt mehr», «zu wenig Treffer», «Recall», «Scope»), (4) ein Modell auf ein leeres Tool-Result hin eine Antwort erfunden hat, (5) optionale API-Parameter (Filter, Facetten, Feld-Flags, Limits) in Requests übersetzt werden, oder (6) Tests für ein datenabfragendes Tool geschrieben werden. Nicht nötig für Server ohne externe Datenquelle.
workout-partner
Be the lifter's training partner — brief them before a session from their own log, take the workout during or after it, take start and duration off the clock, ask the three facts only they can supply, encourage them honestly, and write the shorthand log that generates the markdown + JSON. Use when the user asks what's on today, starts telling you about a workout, says they're training, wants to log or re-log a session, or asks to record sets/reps/how a lift felt.
workout-recall
Answer questions about the lifter's training history by querying their Ironstack Elasticsearch indices — lifts, volume, RPE trends, how they felt, where and when they trained. Use when the user asks what they lifted, how a block is going, when something last happened, or how they felt during past training.
database-design
Designs database schemas from domain requirements (ERD, indexes, migrations, security) or reviews existing schemas for normalization issues, missing indexes, unsafe migrations, and scalability risks.
elasticsearch
Manage Elasticsearch clusters via the REST API. Use when querying, indexing, or managing Elasticsearch indices.
upgrade-navigator
Plan and prove an OpenSearch version upgrade. Use this skill when the user wants to upgrade or move an OpenSearch cluster to a newer or the latest version, asks what breaks if they upgrade, asks for an upgrade path or how many hops an upgrade needs, asks which indices must be reindexed before an upgrade, or wants to confirm their cluster will behave the same after upgrading. Activate on phrases like upgrade OpenSearch, move to the latest version, OpenSearch 1.x to 2.x or 2.x to 3.x, upgrade path, how many hops, reindex before upgrade, breaking changes on upgrade, will my config survive the upgrade, or upgrade readiness. This is OpenSearch-to-OpenSearch only.
btp-cloud-logging
SAP BTP Cloud Logging — OpenSearch-based centralized logging with structured logs, correlation IDs, Kibana dashboards, and retention management.
btp-developer-guide
SAP BTP Developer Guide — runtime selection, CAP/ABAP Cloud/SAP Build, integration patterns, CI/CD, monitoring
story-development
Implement an approved ForgeFlow Story when a request names a Story ID or asks to build work from specs/stories, including tests, verification, repair, and delivery reporting.
postgres-first
Evaluates whether PostgreSQL can satisfy database, cache, queue, search, vector, background-job, pub/sub, rate-limit, audit, or multi-tenant requirements before adding another data service. Use when designing or simplifying backend architecture, reviewing Redis/MongoDB/Elasticsearch/vector-store usage, or planning a migration toward PostgreSQL-native patterns.
filter-translator
Convert a plain-text filter description into a syntactically correct expression in a target query/filter format — OData $filter, JQL, MongoDB, SQL WHERE, or RQL. Use when the user asks to turn a description into a filter/query (e.g. "convert this to a MongoDB filter", "give me the JQL for...", "as an OData $filter", "as an RQL query", "make a SQL WHERE clause for these conditions"). For OData/RQL, can also produce the RFC 3986 percent-encoded URL form on request. Always resolves field names, then confirms the resulting logical expression in plain text before producing the final syntax.
observability
Backend observability patterns — structured logging, Micrometer metrics, OpenTelemetry tracing, Spring Boot Actuator, Kubernetes health probes, alerting, and dashboards. Use when user mentions logging, metrics, tracing, monitoring, health checks, or Prometheus.
looper
Autonomous plan-execute-validate loop. Opus plans a task (with test strategy and edge-case review), Sonnet executes it, then a validation loop runs until every check passes, with Sonnet fixing any issue found. Use when the user invokes /looper <task> or asks to "run the looper" on a task. Hard guardrail - pauses for explicit user permission before any modification to ClickHouse, MySQL, Postgres, SQLite, or Elasticsearch table/database content, or to infrastructure. Backs up every existing file before altering it. Also drives loops whose validation gate is a slow external system such as CI, cloud eval, or remote review, self-pacing re-checks via ScheduleWakeup and distinguishing genuine failures from transient infrastructure ones (see Phase 5b).
opensearch-review-workflow
Run the complete OpenSearch review suite for queries, mappings, vector/search tuning, and operational safety, then synthesize one evidence-based verdict. Use for OpenSearch or Elasticsearch-compatible index, query, migration, relevance, capacity, or performance changes.
zeal-docs
Consult offline documentation from locally installed Zeal (Linux) / Dash docsets. Use this WHENEVER a coding, debugging, or config task involves a technology that has a docset installed — to confirm exact signatures, flags, return values, defaults, or behavior instead of relying on memory, AND for conceptual "how do I / how does X work" questions, since docsets also contain tutorials and how-to guides. Installed docsets include Ansible, Bash, Bootstrap 5, C, Django, Docker, ElasticSearch, Emmet, Flask, Go, HTML, Jinja, Nginx, NodeJS, PostgreSQL, Python 3, Python Telegram Bot, Redis, Rust, SQLAlchemy, SQLite, Scrapy, and Wagtail. Trigger on questions like "what are the args to X", "does this function return Y", "which flag does Z", "how do I do X in Python/Go/...", or before writing non-trivial API calls in these languages/frameworks. Works fully offline; no network needed.
opensearch
Read-only OpenSearch/Elasticsearch querying, index introspection, and search-query (DSL) execution. Use when the user asks to query OpenSearch or Elasticsearch, run a search query/DSL, check a cluster's health, list indices, inspect an index mapping, count documents, fetch a document by id, or debug why a search does/doesn't match. Triggers on requests like "query opensearch", "run this search DSL", "list the indices", "show the users mapping", "how many docs in X", "why doesn't this wildcard match", "check the cluster health".
elk
Hub Q&A for ELK Stack — route log-check, es-query, logstash, kibana-dashboard, elk-health. Evidence-only.
es-query
Build Elasticsearch Query DSL / Kibana KQL / Lucene — filters, aggs, sort. Read-only samples; no prod API calls.
kibana-dashboard
Spec a Kibana dashboard — panels, KQL filters, on-call layout. No auto NDJSON export to prod.
Integration detected automatically from skill content. Some results may be false positives.