Operate Packs

Six Packs cover the operating surface. Utilities is the developer-tool drawer. Investigation does OSINT. Security does network recon, web app testing, and prompt-injection testing. Scraping gets the data out of sites that don't want you to have it. USMetrics answers "how is the economy" with actual FRED numbers. ContentAnalysis turns a 90-minute interview into a structured report.

Utilities

What it is — one front door to the developer-utility drawer. Routes to CLI generation, skill scaffolding, agent delegation (teams and swarms), DOS upgrades, evals, document processing (PDF/DOCX/XLSX/PPTX), content parsing, audio editing, Fabric patterns, Cloudflare infrastructure, browser automation, meta-prompting, and aphorism search. If the task is a utility, this is the Pack.

When to use it — any request where the verb is produce, parse, deploy, automate, or evaluate at the tooling layer. "create a CLI that wraps the Stripe API," "scaffold a new skill," "deploy this worker to Cloudflare," "clean this podcast — remove filler words," "run the summarize fabric pattern on this transcript."

Example outcome — you ask for a TypeScript CLI wrapping the Stripe API. Utilities routes to CreateCLI, generates a typed wrapper at the right tier for the API surface, validates it end-to-end, and hands back a working command. Swap the request for "run the summarize fabric pattern on this transcript" and the same Pack routes to FabricRun instead.

Investigation

What it is — ethical OSINT across 279 public-records and social-media sources, run by 15 parallel investigation agents. Two sub-skills: OSINT for company intel, due diligence, and threat intel; PrivateInvestigator for people-finding, reconnect, public records, and reverse lookup.

Example outcome — you request due diligence on Acme Corp. Investigation returns corporate structure, officers, public filings, domain and subdomain footprint, social presence across platforms, and any red flags surfaced in the 279 sources. Every claim traces back to a specific source, not an aggregator.

Security

What it is — a security assessment and intelligence Pack with five sub-modes. Network reconnaissance (ports, subdomains, DNS, WHOIS, ASN, netblocks). Web application assessment (OWASP methodology, ffuf, Playwright). Prompt-injection and LLM guardrail testing. Security news monitoring (tldrsec, breach feeds). Annual-report threat-landscape analysis for vendor risk decisions.

When to use it — assessing your own systems, testing LLM guardrails on a system prompt, or monitoring the landscape for your stack. "passive recon on example.com," "OWASP assessment of this web app," "prompt injection test this system prompt," "what security news broke this week."

Example outcome — you ask for passive recon on example.com. Security returns subdomains, DNS records, ASN and netblock info, exposed endpoints, WHOIS history, and any discovered bug bounty programs — all without touching the target actively. Swap the request to "OWASP assessment" and the same Pack fires ffuf and Playwright against the live app.

Scraping

What it is — web scraping via progressive escalation. Two sub-skills: BrightData escalates through tiers (WebFetch → Firecrawl → Bright Data proxy with Chrome headers) until one tier succeeds against a bot-protected site. Apify runs platform-specific actors for Twitter, Instagram, LinkedIn, TikTok, YouTube, Facebook, Google Maps, and Amazon.

Example outcome — you ask for clean markdown from a Cloudflare-protected page. Scraping tries WebFetch, fails, tries Firecrawl, fails, escalates to Bright Data proxy with Chrome headers, succeeds, and returns the markdown. You never had to pick a tier. Swap the request for "pull posts from instagram.com/user" and it routes to the Apify Instagram actor instead.

USMetrics

What it is — 68 US economic indicators pulled from FRED, EIA, Treasury FiscalData, BLS, Census, CDC, and EPA APIs, organized into 10 categories with trend analysis, cross-metric correlation, and pattern detection. Backed by the Substrate US-Common-Metrics dataset, refreshed on demand.

When to use it — any decision or narrative that needs current US macro context. "how is the US economy," "what's happening with inflation and unemployment," "update metrics," "economic overview."

Example outcome — you ask "how is the economy." USMetrics runs GetCurrentState and returns a multi-timeframe trend summary: GDP growth, inflation, unemployment, Fed rates, gas prices, housing starts — each with cross-metric observations (e.g., inflation cooling while unemployment holds steady). The Substrate dataset updates before the run so the numbers are current.

ContentAnalysis

What it is — content extraction and wisdom analysis for videos, podcasts, articles, and YouTube. Routes to the ExtractWisdom workflow, producing structured insight reports with summary, ideas, insights, quotes, habits, facts, references, and one-sentence takeaways.

When to use it — you have long-form content and you want its essence in a structured form. "extract wisdom from this YouTube video," "analyze this podcast episode," "insight report for this article," "what did I miss in this interview."

Example outcome — you point ContentAnalysis at a 90-minute YouTube interview. It returns a structured report: one-paragraph summary, 20 ideas, 15 insights, 10 quotes with timestamps, 5 habits mentioned, 8 facts worth remembering, a references list, and three one-sentence takeaways. The full run fits on a single screen and the transcript stays archived for follow-up queries.