SkillFoxx

Type a name, a task or a service

Elastic Agent Skills

Official Elastic skills for Elasticsearch, Kibana, Observability, Security and Elastic Cloud: ES|QL, indices, dashboards, alert triage

PluginEditors’ pickHigh risk

elastic/agent-skillsAuthor: Elastic

Install

claude plugin marketplace add https://github.com/elastic/agent-skills
claude plugin install elastic-elasticsearch@elastic-agent-skills

Other plugins: elastic-kibana, elastic-observability, elastic-security, elastic-cloud.

This is third-party code. Review the repository files before installing.

What it does

Skills from the Elastic team teach the agent to work with the platform correctly rather than from outdated examples. The Elasticsearch set covers ES|QL queries, mapping design, CSV and JSON ingest via the bulk API, reindexing, cluster health diagnosis, slow query optimization, relevance tuning and anomaly detection jobs. Kibana skills build dashboards, alerting rules, workflows and Agent Builder agents. Observability skills help investigate Kubernetes incidents, service reliability and LLM observability, and Security skills triage alerts and manage cases and detection rules. Cloud skills set up access and create Serverless projects.

Who it is for. For engineers, SREs and security analysts working with the Elastic Stack or Elastic Cloud.

Good fit when

  • You need an ES|QL query or a faster slow search
  • You need to find out why a cluster is yellow or red
  • You need to triage a queue of security alerts in Kibana

Not a fit when

  • You use OpenSearch: the APIs differ
  • You are not ready to give the agent access to production security data

Example request

The cluster is red; find unassigned shards and explain the most likely cause without changing the cluster

Limitations

The skills are a technical preview and will change. They need access to a cluster or Elastic Cloud and API keys, and some require the elastic CLI. The authors advise installing only what you need, starting in a test environment with minimal privileges, since alert data can carry prompt injection.

How to disable. Remove the plugins via /plugins in Claude Code or copilot plugin in GitHub Copilot CLI, or delete the skill folders from the agent directory.

Security check

  • Skills run queries and changes on clusters and Elastic Cloud with API keys
  • Security skills process alert data that may contain attacker-controlled content

README in short

The README flags the technical preview status and lists skills by group with versions. A large section covers security: threat modeling, data in model context, attacks via alert content, least privilege and test environments. Installation is described via Claude Code plugins, GitHub Copilot CLI plugins, npx skills and cloning with an install script. Apache 2.0 licensed.

FAQ

Where do I start?

The authors suggest installing the cloud and elasticsearch skills first, since others depend on them, then adding more as needed.

Plugins did not show up after install. What now?

This is a known Claude Code issue: restart the session.

Editors’ pick

166 skills for scientific work: bioinformatics, cheminformatics, clinical data, geospatial analysis and 100+ databases

SkillMedium risk44.9K
Editors’ pick

Google's open-source MCP server for databases: ready tools for Postgres, MySQL, BigQuery, Spanner and more, plus custom tools in tools.yaml

MCP serverHigh risk16.4K
Editors’ pick

Official Hugging Face skills: Hub operations via the hf CLI, datasets, model training, Spaces, evals and deployment

SkillHigh risk11K
Editors’ pick

A token-lean MCP server for PostgreSQL, MySQL, MariaDB, SQL Server and SQLite with a read-only mode

MCP serverHigh risk3.5K