Claude Code Monitoring skills :)
Flowy lists 271 skills in the Monitoring category for Claude Code, across 19 plugins. A skill is a folder of instructions an agent loads while you work. Every one here shows what is inside before you install, who wrote it, and whether it is Auto-invoked, meaning a FLOW.md router fires it as you prompt.
Showing 96 of 271
abusing-dpapi-for-cred…
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using…
abusing-shadow-credent…
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or…
achieving-cmmc-level-2…
Prepare a defense-contractor environment for CMMC Level 2 certification: scope CUI and FCI, implement the 110 NIST SP 800-171 Rev 2 security requirements…
evolution-engine
Domain knowledge for the Evolution Engine — LLM-powered autonomous strategy discovery from raw OHLCV data. Covers the generate-backtest-select-evolve loop,…
risk-management
Risk management domain knowledge for trading agents — affective state monitoring, position sizing, drawdown management, tilt detection, and behavioral…
trade-memory
Compliance-grade decision audit trail for AI trading agents. Records every trading decision with full context (conditions, filters, indicators, risk state),…
criterium
Use this skill when users ask about benchmarking Clojure code, measuring performance, profiling execution time, or using the criterium library. Covers the…
codex-autoresearch
Run or resume a measured improvement loop in a local project. Use for benchmark-driven optimization, qualitative quality-gap research, packet logging,…
00-meta-eval
Use when the user wants to build an evaluation system for an LLM/agent application but doesn't know where to start — they have traces, prompts, RAG pipelines,…
01-eval-design
Use when the user needs to design evaluation datasets, create test cases, stratify samples, generate adversarial examples, extract eval dimensions from…
02-metric-design
Use when the user has evaluation principles or a dataset but needs help choosing the right graders, designing evaluation metrics, creating LLM-as-judge…
add-agent-support
Create and ship AgentSessions support for a new or changed local AI agent/provider. Use when adding, reviewing, testing, documenting, or marketing a provider…
agent-session-format-c…
Verify agent session format compatibility for Agent Sessions. Use when any agent CLI updates, when monitoring flags drift, or when bumping max verified…
agent-support-matrix
Maintain Agent Sessions agent support matrix and JSON/JSONL parsing compatibility. Use when checking upstream agent releases for session format changes,…
bug-audit
Weekly multi-agent audit for serious bugs (data integrity, silent caps, staleness, timestamp math, trust boundaries). Fans out Sonnet scanners + Opus deep…
issue-brief
Explain a GitHub issue, discussion, or feature request in plain language before deciding whether to build it. Covers what the reporter actually wants, a…
link-ticket-to-session
Link the current Claude Code session to a ticket (Linear, Jira, GitHub Issues, or GitHub Pull Requests) and cache its title/status in karma. Use when the user…
releasing
Full release lifecycle — version bump, CHANGELOG, rich release notes, tag, publish. Use when user says "release", "tag and release", "publish version", "cut a…
SkillCompass
Evaluate skill quality, find the weakest dimension, and apply directed improvements. Also tracks usage to spot idle or risky skills. Use when: first session…
session-monitoring
Provides awareness of claudectl session state, health checks, and cost tracking. Activated when the user asks about session health, spending, brain decisions,…
platform-skills
Use when troubleshooting, implementing, reviewing, or auditing platform infrastructure as a system — where Kubernetes, GitOps, CI/CD, and security concerns…
sentry-instrumentation
Rules and examples for adding Sentry instrumentation the right way — metrics and tracing. Covers how to name a counter, gauge, or duration metric; which tags…
tokenscope
Judgment-layer review of Claude Code token usage. Use when the user asks to audit token costs, review Claude Code spending, check context waste, or interpret a…
acquiring-disk-image-w…
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification…
analyzing-active-direc…
Detect dangerous ACL misconfigurations in Active Directory using ldap3
analyzing-android-malw…
Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection,…
tradememory-bridge
Bridge between Binance trading events and TradeMemory Protocol. Automatically journals trades, recalls similar past setups, detects behavioral biases, and…
trading-memory
Domain knowledge for AI trading memory — Outcome-Weighted Memory (OWM) architecture, 5 memory types, recall scoring, and behavioral analysis. Use when…
03-align-human
Use when the user has a judge/grader and human-labeled data, and wants to measure how well the judge agrees with humans, detect systematic biases, determine…
04-eval-report
Use when the user has run multiple evaluation skills and wants a comprehensive analysis — maturity assessment, cross-skill signals, trends, prioritized…
05-rag-eval
Use when the user has a RAG (Retrieval-Augmented Generation) system and wants to evaluate its quality — separating retrieval issues from generation issues.…
deploy
Use when shipping a release of Agent Sessions — bumping version, updating CHANGELOG, building, signing, notarizing, publishing appcast, and creating a GitHub…
release-notes
Use when writing or curating the user-facing release copy for an Agent Sessions release — README "What's New", GitHub release notes, Sparkle release notes, or…
sc-skill
Capture deterministic macOS screenshots for testing, docs, release notes, and marketing assets. Use when asked to automate app screenshots, batch-generate…
analyzing-api-gateway-…
Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect
analyzing-apt-group-wi…
Query ATT&CK data with attackcti, mitreattack-python, and stix2, then build MITRE ATT&CK Navigator layers and multi-layer heatmap overlays mapping one or more…
analyzing-azure-activi…
Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query
06-prompt-regression
Use when the user has changed a prompt (system prompt, RAG template, agent instruction, etc.) and wants to know whether the candidate is better or worse than…
07-redteam
Use when the user wants to test their LLM/agent application for safety and security vulnerabilities — jailbreaks, prompt injection, PII extraction, harmful…
08-bootstrap
Use when the user has nothing — no traces, no labels, no eval set — and needs to build a v0 evaluation from scratch. Also use when the user says "I need to…
analyzing-bootkit-and-…
Analyzes bootkit and advanced rootkit malware infecting the Master
analyzing-browser-fore…
Parse Chromium-based browser databases with Hindsight to extract and correlate browsing history, downloads, cookies, cached content, autofill data, saved…
analyzing-campaign-att…
Systematically evaluate cyber-campaign evidence to attribute an operation to a threat actor, using the Diamond Model and Analysis of Competing Hypotheses (ACH)…
auto-arena
Automatically evaluate and compare multiple AI models or agents without pre-existing test data. Generates test queries from a task description, collects…
bib-verify
Verify a BibTeX file for hallucinated or fabricated references by cross-checking every entry against CrossRef, arXiv, and DBLP. Reports each reference as…
claude-authenticity
Detect whether an API endpoint is backed by genuine Claude (not a wrapper, proxy, or impersonator) using 9 weighted rule-based checks that mirror the…
analyzing-certificate-…
Monitor Certificate Transparency logs using crt.sh and Certstream to
analyzing-cloud-storag…
Detect abnormal access in AWS S3, GCS, and Azure Blob Storage by analyzing CloudTrail Data Events, GCS audit logs, and Azure Storage Analytics for after-hours…
analyzing-cobalt-strik…
Extract and analyze Cobalt Strike beacon configuration from PE files
find-skills-combo
Discover and recommend **combinations** of agent skills to complete complex, multi-faceted tasks. Provides two recommendation strategies — **Maximum Quality**…
mmx-cli
Generate text, images, video, speech, and music via the MiniMax AI platform. Covers text generation (MiniMax-M3 model), image generation (image-01), video…
openjudge
Build custom LLM evaluation pipelines using the OpenJudge framework. Covers selecting and configuring graders (LLM-based, function-based, agentic), running…
analyzing-cobaltstrike…
Parse and analyze Cobalt Strike Malleable C2 profiles with dissect.cobaltstrike (profiles and beacon-payload configs) and pyMalleableC2 (AST parsing) to…
analyzing-command-and-…
Analyzes malware C2 communication over HTTP, HTTPS, DNS, and custom
analyzing-cyber-kill-c…
Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain
paper-review
Review academic papers for correctness, quality, and novelty using OpenJudge's multi-stage pipeline. Supports PDF files and LaTeX source packages…
ref-hallucination-aren…
Benchmark LLM reference recommendation capabilities by verifying every cited paper against Crossref, PubMed, arXiv, and DBLP. Measures hallucination rate,…
rl-reward
Build RL reward signals using the OpenJudge framework. Covers choosing between pointwise and pairwise reward strategies based on RL algorithm, task type, and…
analyzing-disk-image-w…
Perform comprehensive forensic analysis of raw (dd), E01, or AFF disk images with Autopsy and The Sleuth Kit, recovering deleted files, examining metadata and…
analyzing-dns-logs-for…
Analyzes DNS query logs to detect data exfiltration via DNS tunneling,
analyzing-docker-conta…
Investigate compromised Docker containers by analyzing images, layers,
analyzing-email-header…
Parse and analyze email headers (Received chain, Return-Path, Message-ID)
analyzing-ethereum-sma…
Perform static and symbolic analysis of Solidity smart contracts using
analyzing-golang-malwa…
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo
analyzing-heap-spray-e…
Detect and analyze heap spray attacks in memory dumps using Volatility3
175 more in Monitoring. See them all →
