Results for “deviations-log”

Investigate a problem, log it to the debug changelog, cross-check past issues, and suggest a non-duplicate fix.

debug-logging

Detects defense evasion techniques in endpoint logs, including log tampering, timestomping, process injection, and security tool disabling, using Sysmon, EDR telemetry, and SIEM queries.

Diagnoses a reported bug, error, test failure, or unexpected behavior through a 4-phase root-cause analysis before any code changes.

Detects DNS-based data exfiltration, tunneling, and DGA communication by analyzing query logs with entropy analysis, volume anomalies, and subdomain length detection in SIEM platforms.

Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs using pandas for behavioral analytics and statistical baselines.

Investigates slow responses, tool failures, and guardrail rejections by querying agent trace logs and performance metrics.

Reads and analyzes application logs for debugging and monitoring.

Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.

Use when a study needs a preregistration or a frozen analysis plan, when confirmatory and exploratory analyses must be separated, or when every deviation from the registered plan must be logged before the result is reported.

Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.

changelog-generator

Investigates Google Cloud networking issues by analyzing logs, metrics, and diagnostics, including VPC Flow Logs, NAT, firewall, threat logs, latency, throughput, and Connectivity Tests.

Operations, debugging, and optimization for DAG workflows. Performs root cause analysis on failures, profiles execution performance, aggregates results from parallel branches, bridges context between nodes, and learns patterns from execution history. Activate on "DAG failed", "why did it fail", "root cause", "performance profile", "aggregate results", "merge branches", "execution patterns", "optimize DAG". NOT for planning DAGs (use dag-planner), executing DAGs (use dag-runtime), or validating outputs (use dag-quality).

Analyze Linux system logs including auth.log, syslog, systemd journal, and auditd to reconstruct user activity, detect unauthorized access, and establish event timelines on compromised systems.

Analyze network traffic, logs, and data flows to detect potential data exfiltration via DNS tunneling, cloud storage uploads, encrypted channels, and other indicators of compromise.

Diagnose the current OMC session or repo state using logs, traces, state, and focused reproduction

Systematic root-cause analysis for bugs, errors, and unexpected behavior

Logs board meeting decisions with a two-layer memory architecture, separating raw transcripts from approved decisions, and provides commands to review past decisions and overdue action items.

Routes runtime-log requests into an evidence packet to isolate the first actionable blocker, repeated signature, blast radius, or safest next read-only check.

Unified Diary System: A context-preserving automated logger for multi-project development.

Audit Trail

Remove AI-generated code slop from a branch. Use when cleaning up AI-generated code, removing unnecessary comments, defensive checks, or type casts. Checks diff against main and fixes style inconsistencies.

Use when analyzing Claude Code conversation logs to find patterns in repeated user instructions that could become skills. Ask for date range first.

Automatically log daily development progress, archive project-specific diaries locally, and sync a fused global diary to Notion or Obsidian.

Logs the outcome of a skill execution to observations/<skill-name>/runs.md. Trigger on: "log this run", "skill worked", "skill failed", "this didn't work", "log the outcome", "record this", "note that", or after any skill completes with a clear success, partial, or failure outcome. Creates the observations file if it does not exist, then appends an entry with date, task description, skill used, outcome, what worked, what failed, and any error messages observed.

Save the current diagnosis state to disk for cross-session recall, including conclusions, rejected directions, and next steps.

Expert DevOps troubleshooter specializing in rapid incident response, advanced debugging, and modern observability. Masters log analysis, distributed tracing, Kubernetes debugging, performance optimization, and root cause analysis. Handles production outages, system reliability, and preventive monitoring. Use PROACTIVELY for debugging, incident response, or system troubleshooting.

Detects anomalous authentication patterns using UEBA analytics, statistical baselines, and machine learning to identify impossible travel, credential stuffing, brute force, password spraying, and compromised account behaviors across authentication logs.

Parse Office 365 Unified Audit Logs via Microsoft Graph API to detect email forwarding rule creation, inbox delegation, suspicious OAuth app grants, and other indicators of account compromise.

Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.

Unified Diary System: A context-preserving automated logger for multi-project development.

LEMON v2.0 — The Degen Fader. Identifies historically reckless traders (DEGEN activity + CHOPPY consistency) on Hyperliquid, monitors their live positions, and counter-trades them when they're bleeding at high leverage. If a cluster of degens goes max-leverage long on a coin and starts losing, LEMON shorts it — betting on their inevitable liquidation cascade. DSL exit managed by plugin runtime via runtime.yaml.

Reviews authorized diffs for auth, input, filesystem, network, secrets, parsers, injection, CI/CD, and supply-chain regressions.

Find bugs, security vulnerabilities, and code quality issues in local branch changes. Use when asked to review changes, find bugs, security review, or audit code on the current branch.