diff --git a/PLUGINS/ClaudeCode/skills/asp-alert-en/SKILL.md b/PLUGINS/ClaudeCode/skills/asp-alert-en/SKILL.md index 9987706..19bce7f 100644 --- a/PLUGINS/ClaudeCode/skills/asp-alert-en/SKILL.md +++ b/PLUGINS/ClaudeCode/skills/asp-alert-en/SKILL.md @@ -31,6 +31,8 @@ An alert is secondary data in ASP. Each alert belongs to a case, and each alert - If the user is working on a specific alert, prefer `list_alerts(alert_id=, limit=1)` because the current MCP surface does not expose a separate `get_alert` tool. - If the user wants to save structured analysis back onto the alert, use the `asp-enrichment-en` skill. +Note: alerts only support `severity_ai`, `confidence_ai`, and `comment_ai` updates; verdict and summary fields belong to case updates. + ## Additional Information - `rowid` is the UUID for each alert record and is used for data association. diff --git a/PLUGINS/ClaudeCode/skills/asp-artifact-en/SKILL.md b/PLUGINS/ClaudeCode/skills/asp-artifact-en/SKILL.md index 0ccf645..3d50c8a 100644 --- a/PLUGINS/ClaudeCode/skills/asp-artifact-en/SKILL.md +++ b/PLUGINS/ClaudeCode/skills/asp-artifact-en/SKILL.md @@ -15,7 +15,7 @@ metadata: # ASP Artifact Use this skill when the user needs to investigate artifacts on ASP. -An artifact is the third-level data in ASP. Each artifact is attached under one alert and is the smallest data unit that still needs investigation. +Artifacts are created automatically by system processes. You can list and analyze existing artifacts, and save analysis back through enrichment. ## When to Use diff --git a/PLUGINS/ClaudeCode/skills/asp-artifact-zh/SKILL.md b/PLUGINS/ClaudeCode/skills/asp-artifact-zh/SKILL.md index 8009ebc..10cc7c7 100644 --- a/PLUGINS/ClaudeCode/skills/asp-artifact-zh/SKILL.md +++ b/PLUGINS/ClaudeCode/skills/asp-artifact-zh/SKILL.md @@ -15,7 +15,7 @@ metadata: # ASP Artifact 当用户要围绕 artifact 进行调查分析时，使用这个 skill。 -artifact 是 ASP 中的三级数据,每个 artifact 都挂载在一个 alert 下,是最小的需要调查的数据单元。 +artifact 由系统自动创建，用户只能查询和分析已有 artifact，并通过 enrichment 保存分析结果。 ## 适用场景 diff --git a/PLUGINS/ClaudeCode/skills/asp-enrichment-zh/SKILL.md b/PLUGINS/ClaudeCode/skills/asp-enrichment-zh/SKILL.md index 744d239..dd084bd 100644 --- a/PLUGINS/ClaudeCode/skills/asp-enrichment-zh/SKILL.md +++ b/PLUGINS/ClaudeCode/skills/asp-enrichment-zh/SKILL.md @@ -44,6 +44,8 @@ metadata: 3. 如果用户已经有现成的 enrichment rowid，跳过创建，直接附加。 4. 如果用户还处于对象探索阶段而不是保存结果，先使用对应对象 skill。 +当你已经有明确的分析结论，例如 verdict、TTP 集合、风险评级或缓解建议，并且这些内容需要保存在目标对象上时，就切换到这个 skill。 + ## SOP ### 创建并附加新的 Enrichment diff --git a/PLUGINS/ClaudeCode/skills/asp-knowledge-en/SKILL.md b/PLUGINS/ClaudeCode/skills/asp-knowledge-en/SKILL.md index cf920f5..1863d02 100644 --- a/PLUGINS/ClaudeCode/skills/asp-knowledge-en/SKILL.md +++ b/PLUGINS/ClaudeCode/skills/asp-knowledge-en/SKILL.md @@ -48,6 +48,8 @@ ASP internal Knowledge is stored as individual database records. The main fields - When the user says to "add to the knowledge base" or "make it retrievable", interpret that as setting `action` to `Store`, not editing `using` directly. - When the user says to "remove from the knowledge base" or "stop using it for retrieval", interpret that as setting `action` to `Remove`. +Note: `action=Store` and `action=Remove` are handled asynchronously by the backend, so the retrievability state may lag behind the update. + ## Decision Flow 1. If the user wants to search vectorized knowledge content for relevant conclusions, experience, or historical knowledge, use `search_knowledge`. diff --git a/PLUGINS/ClaudeCode/skills/asp-knowledge-zh/SKILL.md b/PLUGINS/ClaudeCode/skills/asp-knowledge-zh/SKILL.md index 9d8d1fa..f05bcea 100644 --- a/PLUGINS/ClaudeCode/skills/asp-knowledge-zh/SKILL.md +++ b/PLUGINS/ClaudeCode/skills/asp-knowledge-zh/SKILL.md @@ -48,6 +48,8 @@ ASP 的内部 Knowledge 本质上是一条一条数据库记录，核心字段 - 当用户说“加入知识库”或“让它可被检索”时，通常应理解为把 `action` 设为 `Store`，而不是直接改 `using`。 - 当用户说“移出知识库”或“不要再参与检索”时，通常应理解为把 `action` 设为 `Remove`。 +注意：`action=Store` 和 `action=Remove` 由后端异步处理，所以可检索状态可能会滞后于更新。 + ## 决策流程 1. 如果用户要在“已向量化的知识内容”里查找相关结论、经验或历史知识，使用 `search_knowledge`。 diff --git a/PLUGINS/ClaudeCode/skills/asp-ticket-en/SKILL.md b/PLUGINS/ClaudeCode/skills/asp-ticket-en/SKILL.md index c5aef07..99b7c26 100644 --- a/PLUGINS/ClaudeCode/skills/asp-ticket-en/SKILL.md +++ b/PLUGINS/ClaudeCode/skills/asp-ticket-en/SKILL.md @@ -95,6 +95,8 @@ Preferred response structure: - Prefer workflow wording over storage wording. - When many tickets match, show the best subset and explain the pattern briefly. +Tip: there is no direct `case_id` filter for `list_tickets`; use `list_cases(case_id=..., lazy_load=false)` to inspect attached tickets when needed. + ## Failure Handling - If no tickets match, say that directly and suggest the most useful refinement. diff --git a/PLUGINS/MCP/llmfunc.py b/PLUGINS/MCP/llmfunc.py index f73a777..e8a57d6 100644 --- a/PLUGINS/MCP/llmfunc.py +++ b/PLUGINS/MCP/llmfunc.py @@ -439,7 +439,6 @@ def update_knowledge( title=title, body=body, action=action, - source=source, tags=tags )