Use agent skills

This guide shows you how to install and manage Tenzir’s agent skills. You’ll learn which skills are available, how to add skills globally or per project, install individual skills, and keep them up to date.

Tenzir publishes agent skills in the tenzir/skills repository.

Agent Skills

Agent Skills is an open specification for packaging knowledge that AI agents can use. Skills provide structured documentation with progressive disclosure, letting agents load a condensed overview first and drill into details only when needed.

Available skills

Tenzir publishes the following skills:

🧬 Schemas

Skill	Description
tenzir-google-udm	Google SecOps UDM schema and normalization guidance for fields, event types, and entity types
tenzir-microsoft-asim	Microsoft Sentinel ASIM schema and mapping guidance for schemas, fields, aliases, and roles
tenzir-ocsf	OCSF schema reference for event classes, objects, attributes, profiles, and extensions

🛡️ Tenzir Users

Skill	Description
tenzir-docs	Tenzir documentation for TQL, operators, functions, integrations, and deployment
tenzir-manage-packages	Package lifecycle routing for manifests, operators, pipelines, tests, and schema mappings

🏗️ Tenzir Contributors

Skill	Description
tenzir-commit-changes	Stage, split, and commit changes with clean messages
tenzir-create-pull-requests	Open pull requests, add changelog entries, and link documentation PRs
tenzir-review-changes	Review code with severity ratings and structured findings
tenzir-design-system	Use frontend design tokens, components, and brand assets
tenzir-ship	Write changelog entries, release notes, and GitHub releases
tenzir-update-docs	Coordinate docs.tenzir.com updates alongside code changes
tenzir-technical-writing	Write documentation in Tenzir’s technical writing style

Install skills

Tenzir skills are managed with the skills CLI, which supports 40+ coding agents including Claude Code, Cursor, Codex, GitHub Copilot, and more.

Install all skills

Install all Tenzir skills into the current project:

npx skills add tenzir/skills

The CLI auto-detects which coding agents you have installed and prompts you to select targets.

Install individual skills

Append @<skill-name> to install a specific skill from the available skills:

npx skills add tenzir/skills@<skill-name>

Use the Google UDM skill

Install the Google SecOps UDM schema skill when you want an agent to help generate UDM API ingestion payloads or write detection logic:

npx skills add tenzir/skills@tenzir-google-udm

The tenzir-google-udm skill supports two primary workflows. Generated UDM field headings can show two forms, for example event_type / eventType:

• Use the right-side ingestion object form when the agent maps logs into UDM event or entity objects for Google SecOps UDM API ingestion, including TQL mapping output such as metadata.eventType.
• Use the left-side field path form when the agent writes YARA-L, Detect Engine, CBN, or other dotted paths, such as $event.metadata.event_type.

Tell the agent which context you want:

Use the tenzir-google-udm skill to map this firewall event to a UDM event
object. Use ingestion object field names in the TQL output.

Use the tenzir-google-udm skill to write YARA-L detection logic for a UDM
network connection event. Use field path names.

Use the Microsoft ASIM skill

Install the Microsoft Sentinel ASIM schema skill when you want an agent to help choose ASIM schemas, map events or entities, inspect normalized fields, or resolve aliases:

npx skills add tenzir/skills@tenzir-microsoft-asim

The tenzir-microsoft-asim skill is generated from Microsoft Defender Docs and is optimized for schema-first mapping. Ask the agent to choose the ASIM schema before it maps fields, then use canonical ASIM field names such as EventSchema, EventSchemaVersion, SrcIpAddr, and DstIpAddr.

Tell the agent which context you want:

Use the tenzir-microsoft-asim skill to map this firewall event to a Microsoft
Sentinel ASIM NetworkSession record.

Use the tenzir-microsoft-asim skill to explain the required and recommended
fields for ASIM DNS events.

Choose the installation scope

Skills support two installation scopes:

Scope	Flag	Location	Use case
Project	(default)	./<agent>/skills/	Committed with your project, shared with your team.
Global	-g	~/<agent>/skills/	Available across all projects on your machine.

Install globally so skills are available everywhere:

npx skills add -g tenzir/skills

Install a specific skill globally:

npx skills add -g tenzir/skills@tenzir-docs

Target specific agents

To install skills for specific agents only, use the -a flag:

npx skills add tenzir/skills -a pi
npx skills add tenzir/skills -a claude-code -a cursor -a codex

Manage skills

List installed skills

npx skills list

Filter by scope or agent:

npx skills list -g
npx skills list -a pi

Check for updates

npx skills check

Update skills

npx skills update

Remove skills

Remove interactively:

npx skills remove

Remove a specific skill:

npx skills remove tenzir-docs

Remove all installed Tenzir skills:

npx skills remove --all

Discover more skills

Browse the community skill directory at skills.sh or search from the command line:

npx skills find