Results for “file-system-events”

Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry.

Advanced Tauri event patterns for bidirectional communication, streaming data, window-to-window messaging, and custom event handling

Uses the filesystem as a durable overflow layer for agent context, enabling scratch pads, plan persistence, sub-agent communication, dynamic skill loading, and log management.

Migrates OSGi EventAdmin handlers and JCR EventListeners to AEM Cloud Service-compliant patterns, including EventHandler+JobConsumer split, routing rules, and leader-only execution.

Append-only event log — the probabilistic record of everything that happened in the project. Use whenever something notable happens that the project should remember — work items created/transitioned, decisions recorded, bindings changed, incidents occurred, releases shipped.

Read, write, edit, list, copy, move, and search files directly using builtin tools, with fallback to Python or bash for complex operations.

Implements and manages Wave Terminal's WPS publish-subscribe event system, covering event type definition, publishing, subscribing, and TypeScript type generation.

Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045, analyzing service binary paths, and identifying indicators of persistence mechanisms.

Hunt for adversary persistence through Windows Management Instrumentation event subscriptions by monitoring WMI consumer, filter, and binding creation events that execute malicious code triggered by system events.

Feishu permission management for documents and files. Activate when user mentions sharing, permissions, collaborators.

Write files from a WordPress plugin using the WP_Filesystem abstraction, covering bootstrap, transports, credentials flow, and when to use plain PHP instead.

Intelligently organize files across your computer by understanding context, detecting duplicates, suggesting folder structures, and automating cleanup. Maintain a clean digital workspace without manual effort.

Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.

Manage feature manifests for code traceability. Use when creating new features, updating existing features, checking feature health, or exploring the feature-to-code relationship. Activates for manifest validation, feature creation, changelog updates, and traceability queries.

Analyze RAM dumps with Volatility 3 to detect malware, process injection, network connections, and credential theft during incident response.

Imported skill file_ops from langchain

Analyze Linux system logs including auth.log, syslog, systemd journal, and auditd to reconstruct user activity, detect unauthorized access, and establish event timelines on compromised systems.

Extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from memory dumps using Volatility and Mimikatz for forensic investigation.

Collect volatile forensic evidence from a compromised system following order of volatility, preserving memory, network connections, processes, and system state before they are lost.

Persistent cross-session memory management. Enables agents to remember user preferences, project conventions, and past decisions across different sessions using a structured MEMORY.md index and topic files.

SUPERSEDED by persistent-cache-gap-filling (v2.8.0). Cache data during symbol selection for instant repeat runs.

Imported skill filesystem from langchain

Read a file from an allowed path on the local filesystem

Server-Sent Events implementation, streaming patterns, and real-time updates.

Intelligently organizes files and folders by understanding context, finding duplicates, and suggesting better organizational structures. Use when user wants to clean up directories, organize downloads, remove duplicates, or restructure projects.

Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys backdoors using auditd and file integrity monitoring.

Simulator.Company chat & messaging specialist — sending messages to a user, and creating or reusing p2p (1:1) and group chats. In Simulator a chat is an actor of the Events system form (data.chatType = "p2p" | "group"), its participants are the actor's access-rule members, and its messages are `comment` reactions. Use when the user wants to "message", "write to", "DM", "send a message to" someone, "open a chat with", "start a conversation", or "reply in the chat". Activate on "write a message to user N", "send N a message", "open a chat with", "message someone", "напиши повідомлення користувачу", "надішли повідомлення", "відкрий чат з", "почни розмову з", "напиши юзеру", "напиши сообщение пользователю", "отправь сообщение", "открой чат с", "напиши в чат". For comments/approvals on an arbitrary actor (not a chat) use `simulator-reactions`; for files use `simulator-attachments`; for sharing/access in general use `simulator-access`.