How do I install the Process Audit skill?

Run npx skillmds@latest add abzhaw/process-audit in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Process Audit safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: docs only. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Process Audit?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Process Audit free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Process Audit?

abzhaw (@abzhaw) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Process Audit by abzhaw — Agent Skill

Name: Process Audit
Rating: 4.2 (5 reviews)
Author: abzhaw

File contents

Skill: Process Audit

Purpose

Know exactly what is running on this machine. Any unexpected process — whether malware, a crashed service restarting in a loop, or a forgotten dev server — shows up here.

What It Checks

All processes owned by raphael
PM2-managed processes (expected: frontend, bridge, orchestrator, cowork-mcp, backend-docker)
Docker containers (expected: postgres, backend-api)
Processes consuming >10% CPU with no known reason
Processes listening on network ports that aren't registered services
Any cron or launchd jobs added since last baseline

Commands

# All user processes
ps aux | grep -v grep | grep "$(whoami)"

# PM2 process list as JSON
pm2 jlist 2>/dev/null

# Docker containers
docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}" 2>/dev/null

# LaunchAgents (persistent background jobs)
launchctl list | grep -v "^-.*com.apple"

# High CPU processes
ps aux --sort=-%cpu | head -10

Known-Good Processes

pm2 daemon              — process manager
node (frontend)         — Next.js frontend
node (bridge)           — Message bridge
node (orchestrator)     — Julia orchestrator
node (cowork-mcp)       — Claude MCP server
docker                  — container runtime
postgres                — database (inside Docker)
com.juliaz.*            — our LaunchAgents
com.juliaz.adhd-agent   — ADHD agent

Severity Rules

Finding	Severity
Unknown process with network access	🔴 Critical
Unknown persistent LaunchAgent	🟠 High
PM2 process crash-looping (restarts >5)	🟡 Medium
High CPU with no explanation	🟡 Medium
Docker container running unexpectedly	🟡 Medium

Output Format

PROCESS AUDIT
✅ PM2: 5/5 expected processes online
✅ Docker: postgres, api healthy
⚠️  bridge restarted 7 times today (crash-loop risk)
🔴 Unknown process: /tmp/updater (PID 8821) — listening on :4444

---name: process-auditdescription: Check all running processes on the system for anomalies, unknown services, and resource abuse---# Skill: Process Audit## PurposeKnow exactly what is running on this machine. Any unexpected process — whether malware, a crashed service restarting in a loop, or a forgotten dev server — shows up here.## What It Checks- All processes owned by `raphael`- PM2-managed processes (expected: frontend, bridge, orchestrator, cowork-mcp, backend-docker)- Docker containers (expected: postgres, backend-api)- Processes consuming >10% CPU with no known reason- Processes listening on network ports that aren't registered services- Any `cron` or `launchd` jobs added since last baseline## Commands```bash# All user processesps aux | grep -v grep | grep "$(whoami)"# PM2 process list as JSONpm2 jlist 2>/dev/null# Docker containersdocker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}" 2>/dev/null# LaunchAgents (persistent background jobs)launchctl list | grep -v "^-.*com.apple"# High CPU processesps aux --sort=-%cpu | head -10```## Known-Good Processes```pm2 daemon — process managernode (frontend) — Next.js frontendnode (bridge) — Message bridgenode (orchestrator) — Julia orchestratornode (cowork-mcp) — Claude MCP serverdocker — container runtimepostgres — database (inside Docker)com.juliaz.* — our LaunchAgentscom.juliaz.adhd-agent — ADHD agent```## Severity Rules| Finding | Severity ||---------|----------|| Unknown process with network access | 🔴 Critical || Unknown persistent LaunchAgent | 🟠 High || PM2 process crash-looping (restarts >5) | 🟡 Medium || High CPU with no explanation | 🟡 Medium || Docker container running unexpectedly | 🟡 Medium |## Output Format```PROCESS AUDIT✅ PM2: 5/5 expected processes online✅ Docker: postgres, api healthy⚠️ bridge restarted 7 times today (crash-loop risk)🔴 Unknown process: /tmp/updater (PID 8821) — listening on :4444```

Frequently asked questions

Process Audit