---
name: bitdefender
description: >-
  Manage the Arizona Computer Guru (ACG) Bitdefender GravityZone Cloud MSP
  tenant via the Public JSON-RPC API. Inventory and audit endpoints, run live
  security sweeps (infected / outdated-signature / outdated-product), list
  client companies, build and fetch installation packages, manage custom groups,
  start scans, move/delete endpoints (gated), inspect policies (read-only,
  shallow), and review quarantine. Invoke for: "bitdefender", "gravityzone",
  "gravity zone", "add machine to bitdefender", "install bitdefender on",
  "list endpoints", "infected machines", "av coverage", "security sweep",
  "endpoint protection", "policy assignment", "quarantine". This skill talks to
  the real production ACG GravityZone partner tenant — treat destructive actions
  conservatively.
---

**Grok skill.** This maps to the shared skill in `.claude/skills/bitdefender/SKILL.md`.

Read `.claude/skills/bitdefender/SKILL.md` (first use GrepAI via `search_tool` + `use_tool` (grepai__grepai_search etc.) for semantic context lookup per the GrepAI-first rule in CLAUDE.md, .grok/README.md, and .grok/skills/context/SKILL.md; only `read_file` if full content needed for editing or review) and follow it, adapting for Grok tools:

- Use `run_terminal_command` (Git Bash aware per .grok/skills/windows-bash, full exe paths for reliability) to invoke the py CLI in `.claude/skills/bitdefender/scripts/gz.py` (py launcher from identity, paths via CLAUDETOOLS_ROOT or identity).
- Use `spawn_subagent` for delegation.
- Prefer MCP `search_tool`/`use_tool` (grepai for searches) before direct file tools.
- Destructive ops gated with --confirm exactly as specified.
- Obey CLAUDE.md (loaded by Grok), .grok/README.md, GrepAI-first before reads.

The implementation — CLI usage, vault credentials (never hardcoded), cache model, policy limitations, safety gating, common commands (status, companies, sweep, policies, quarantine, packages, groups, scans, blocklist, isolate, raw, destructive), phase-2 hooks, and references — are in the source `.claude/skills/bitdefender/SKILL.md` and its scripts/references/.

Invoke as documented (e.g. py .../gz.py status, $GZ sweep --company <id> --json, gated deletes/isolates). This skill talks to the live production tenant — treat destructive conservatively.

See also: .grok/skills/rmm/SKILL.md for RMM integration ideas.
