Results for “file-system-events”

Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry.

Advanced Tauri event patterns for bidirectional communication, streaming data, window-to-window messaging, and custom event handling

飞书事件订阅：通过 WebSocket 长连接实时监听飞书事件（消息、通讯录变更、日历变更等），输出 NDJSON 到 stdout，支持 compact Agent 友好格式、正则路由、文件输出。当用户需要实时监听飞书事件、构建事件驱动管道时使用。

Uses the filesystem as a durable overflow layer for agent context, enabling scratch pads, plan persistence, sub-agent communication, dynamic skill loading, and log management.

This skill should be used when the user asks to "offload context to files", "implement dynamic context discovery", "use filesystem for agent memory", "reduce context window bloat", or mentions file-based context management, tool output persistence, agent scratch pads, or just-in-time context loading.

Migrates OSGi EventAdmin handlers and JCR EventListeners to AEM Cloud Service-compliant patterns, including EventHandler+JobConsumer split, routing rules, and leader-only execution.

Append-only event log — the probabilistic record of everything that happened in the project. Use whenever something notable happens that the project should remember — work items created/transitioned, decisions recorded, bindings changed, incidents occurred, releases shipped.

Read, write, edit, list, copy, move, and search files directly using builtin tools, with fallback to Python or bash for complex operations.

Lark/Feishu real-time event listening / subscribing / consuming: stream events as NDJSON via `lark-cli event consume <EventKey>` (covers IM messages/reactions/chat changes, Approval status changes, Task updates, VC meeting started/joined/ended, Minutes generated, Whiteboard updated, etc.). Use for Lark bots, real-time message processing, long-running subscribers, streaming webhook/push handlers. Supports `--max-events` / `--timeout` bounded runs and a stderr ready-marker contract — designed for AI agents running as subprocesses.

`analysis-agent`/`task-agent`/`review-agent`: use when uploads, object storage, streaming, MIME, scanning, access, retention, or cleanup changes; skip without file/storage impact.

Implements and manages Wave Terminal's WPS publish-subscribe event system, covering event type definition, publishing, subscribing, and TypeScript type generation.

Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045, analyzing service binary paths, and identifying indicators of persistence mechanisms.

Hunt for adversary persistence through Windows Management Instrumentation event subscriptions by monitoring WMI consumer, filter, and binding creation events that execute malicious code triggered by system events.

Renews or reactivates Google Workspace Events subscriptions, either individually by name or all subscriptions expiring within a specified time window.

Feishu permission management for documents and files. Activate when user mentions sharing, permissions, collaborators.

Write files from a WordPress plugin using the WP_Filesystem abstraction, covering bootstrap, transports, credentials flow, and when to use plain PHP instead.

Intelligently organize files across your computer by understanding context, detecting duplicates, suggesting folder structures, and automating cleanup. Maintain a clean digital workspace without manual effort.

Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.

Manage feature manifests for code traceability. Use when creating new features, updating existing features, checking feature health, or exploring the feature-to-code relationship. Activates for manifest validation, feature creation, changelog updates, and traceability queries.

Apache Kafka event streaming platform. Covers producers, consumers, topics, partitions, Kafka Streams, and Connect. Use for high-throughput event-driven architectures and real-time data pipelines. USE WHEN: user mentions "kafka", "event streaming", "kafka streams", "consumer groups", "topic partitions", asks about "high throughput messaging", "event sourcing", "log aggregation", "real-time pipelines" DO NOT USE FOR: simple queues - use `rabbitmq` or `activemq`; cloud-native lightweight - use `nats`; AWS-native - use `sqs`; Azure-native - use `azure-service-bus`; GCP-native - use `google-pubsub`

Fetch meetings, transcripts, summaries, and action items from Fathom API. Use when user asks to get Fathom recordings, sync meeting transcripts, or fetch recent calls.

Feishu cloud storage file management. Activate when user mentions cloud space, folders, drive.

Detect malicious scheduled task creation and modification using Sysmon Event IDs 1, 11, and Windows Security Event 4698/4702, correlating task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement.

Inngest expert for serverless-first background jobs, event-driven

Detect OS credential dumping techniques targeting LSASS memory, SAM database, NTDS.dit, and cached credentials using EDR telemetry, Sysmon process access monitoring, and Windows security event correlation.

Server-Sent Events for real-time server-to-client streaming. Express, Fastify, FastAPI, Spring WebFlux SSE implementations. Event streams, reconnection, and EventSource API. USE WHEN: user mentions "SSE", "Server-Sent Events", "EventSource", "event stream", "text/event-stream", "live feed", "streaming updates" DO NOT USE FOR: bidirectional communication - use `socket-io`; WebRTC - use `webrtc`; LLM streaming - use AI SDK skills

Analyze RAM dumps with Volatility 3 to detect malware, process injection, network connections, and credential theft during incident response.

Imported skill file_ops from langchain

Analyze Linux system logs including auth.log, syslog, systemd journal, and auditd to reconstruct user activity, detect unauthorized access, and establish event timelines on compromised systems.

Extract cached credentials, password hashes, Kerberos tickets, and authentication tokens from memory dumps using Volatility and Mimikatz for forensic investigation.

Collect volatile forensic evidence from a compromised system following order of volatility, preserving memory, network connections, processes, and system state before they are lost.

Reads the contents of text, configuration, and code files when the user needs to view or cat a file.

Publish and subscribe to real-time event channels for agent-to-agent communication via a simple CLI, with channel locking and schema validation.

Persistent cross-session memory management. Enables agents to remember user preferences, project conventions, and past decisions across different sessions using a structured MEMORY.md index and topic files.

SUPERSEDED by persistent-cache-gap-filling (v2.8.0). Cache data during symbol selection for instant repeat runs.