Browse reusable Agent Skills, each with a clear purpose and practical guidance.
Use when a Security Solution bug has been reproduced in the browser and the user has reviewed the reproduction report. Only applies when .bug-fixer-session/reproduction-report.md exists with status: reproduced and user_acknowledged: yes.
Use when the user mentions a bug number or asks to reproduce, investigate, or debug anything in Kibana Security Solution — even just "look into #NNN", "can you reproduce this", or "something's wrong with X".
Validates whether open Security Solution GitHub bugs are still valid through static code analysis, git history, and PR cross-referencing — without running the application. Use when the user shares a GitHub issue URL, an issue list URL, an issue number (#NNN), or asks to triage, validate, or check if a Security Solution bug is still reproducible.
Investigate Scout and FTR flaky test failures in Kibana. Use when triaging a failed-test issue, a Buildkite-reported failure, a test path that has been failing intermittently, or any time the user asks to look at a flaky test, deflake a test, or stabilize a test.
Fleet-specific. Analyzes failing, flaky, or skipped Fleet tests to determine root cause and recommend the right action. Three modes: (1) triage a single GitHub issue, (2) audit the full Team:Fleet failed-test backlog, (3) fix a cluster of related issues together. Use when: (1) a user shares a failing or skipped Fleet test, (2) asked to triage or fix a flaky test, (3) asked to audit or clear the Fleet failed-test backlog, (4) asked to find the shared cause across a group of related test failures.
Deep reference for the Kibana Functional Test Runner (FTR). Use when reading, analyzing, debugging, or reviewing FTR tests, including config anatomy, services, page objects, loadTestFile patterns, data loading, tags, CI wiring, and common FTR idioms.
Use when an agent needs high-fidelity Elastic Security development data while working in Kibana: endpoint events, endpoint alerts, Security detection alerts, Attack Discoveries, or generated cases. This is for local engineering development, testing, and debugging only, not cloud deployments or customer-facing demos.
Review connector spec changes (spec, docs). Use when reviewing a PR involving connector specs, doing post-creation review after create-connector or build-connector, or preparing a connector PR checklist.
Use when creating, updating, debugging, or reviewing Scout API tests in Kibana (apiTest/apiClient/requestAuth/samlAuth/apiServices), including auth choices, response assertions, and API service patterns.
Review Scout UI/API tests (including Scout test migrations) for best practices, reuse, and parity.