maintain-integration When to use vs create-integration Use this skill when the package already exists : - reviewing quality, ECS compliance, or correctness of an existing package - fixing specific issues: pipeline errors, field mappings, ECS categorization, CEL programs, manifests - running a full quality improvement pass (review → fix → re-validate loop) - making minor adjustments to existing data streams Use instead when: - creating a new integration package from scratch - adding a new data stream to an existing package ( → ) Modes Review only (read-only, no edits) → Read fully before start…