Results for “unusual-activity”

Hunt for unusual network connections by analyzing outbound traffic patterns, rare destinations, non-standard ports, and anomalous connection frequencies from endpoints.

"Anomaly" covers three distinct problems, and a detector built for one is close to

Monitor a list of tickers for key changes in price, IV rank, unusual activity, earnings dates, and score changes. Supports custom watchlists and a default hot options list.

Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045, analyzing service binary paths, and identifying indicators of persistence mechanisms.

Create a delightful, unexpected "wow" experience for the user by dynamically discovering and creatively combining other enabled skills. Triggers when the user says "surprise me" or any request expressing a desire for an unexpected creative showcase. Also triggers when the user is bored, wants inspiration, or asks for "something interesting".

Action (adaz-action)

Action (araz-action)

Provides a structured debugging workflow for diagnosing errors, test failures, and unexpected behavior, including root cause analysis and verification steps.

Action (abaz-action)

Action (afaz-action)

Hunt for web shell deployments on internet-facing servers by analyzing file creation in web directories, suspicious process spawning from web servers, and anomalous HTTP patterns.

当需要建立可持续的创造节奏，将灵感转化为行动时

Diagnoses why someone knows what to do but doesn't do it, using Adlerian psychology to identify root causes like procrastination, perfectionism, or avoidance.

Create, inspect, and edit Behavior Tree and Blackboard assets — composites, tasks, decorators, services, node properties, blackboard key bindings, key CRUD and metadata, tree round-trips and validation (BehaviorTreeService + BlackboardService). Use when the user asks to build a Behavior Tree, add BT nodes or decorators, bind blackboard keys, author a blackboard, or validate/repair a BT asset.

Detect abuse of elevation control mechanisms including UAC bypass, sudo exploitation, and setuid/setgid manipulation by monitoring registry modifications, process elevation flags, and unusual parent-child process relationships.

Action (axaz-action)

Action (acaz-action)

Read Phenomena

Action (asaz-action)

Facilitate a brainstorming session using diverse creative techniques. Use when the user says 'help me brainstorm' or 'help me ideate'.

> 强化高能动性和高压闭环执行的行为技能。适用于连续失败、原地打转、空口完成、 把问题甩给用户、没搜就猜、修完就停等场景，也支持手动通过 /pua 进入核心模式。

Action (akaz-action)

Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry.

Configures autonomous heartbeat and cron-based proactive routines (e.g., morning briefing setup, unanswered-message scan cadence). Invoke when user is SETTING UP or MODIFYING a proactive routine, not when the routine itself fires. Cron crons execute their own logic — they do NOT load this skill. Triggers: "set up proactive check", "configure heartbeat", "add morning briefing", "tune cron cadence".

A brief description of what this skill does

Triggered by "tidy up", "clean up transactions", "categorize uncategorized", "organize my transactions"

当需要进入高度专注、高效且愉悦的工作或学习状态时

当面对新任务或目标，因过度思考“如何开始”或“需要多久”而陷入拖延、焦虑，迟迟无法行动时