[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M73F73BQBFDF2Y8EJCV14F1J":3,"skill-same:01M73F73BQBFDF2Y8EJCV14F1J":47},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":18,"linkOnly":19,"markdownContent":20,"markdownBody":21,"frontMatter":22,"refName":23,"commitSha":24,"skillDirectory":25,"forksCount":26,"repositoryHtmlUrl":27,"repositoryHomepageUrl":28,"ownerHtmlUrl":29,"ownerBlogUrl":30,"ownerDescription":31,"updatedAt":32,"install":33,"resources":46},"01M73F73BQBFDF2Y8EJCV14F1J","process-list-monitoring",null,"Horonomos-laps\u002FYana-AI","Horonomos-laps","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F355299122?v=4","01M76B3QPXE88ET2SQPDPVATZT"," Horonomos-laps","01M72ZQRJPCYPSSWT4D00VJR2A",13,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fprocess-list-monitoring\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: process-list-monitoring\ndescription: System process list monitoring and PID management for agent sandboxes. Cross-platform process enumeration, CPU\u002Fmemory per-process metrics, filtering by name\u002FPID, and detecting unexpected child spawns. Sources: sindresorhus\u002Fps-list.\norigin: yana-ai — synthesized from sindresorhus\u002Fps-list (MIT)\nlicense: Apache-2.0\nversion: 1.0.0\ncompatibility: yana-ai >= 1.3.48\n---\n\n# \u002Fprocess-list-monitoring\n\n## When to Use\n\n- Audit which processes an agent spawned during a session\n- Detect unexpected child processes (cryptominers, reverse shells)\n- Monitor CPU\u002FRAM per process before triggering circuit breakers\n- Build zombie-process detectors (see [[zombie-process-cleanup]])\n\n## Do NOT use for\n\n- Real-time kernel-level tracing (use [[ebpf-runtime-tracing]] instead)\n- Windows process management (API differs significantly)\n\n---\n\n## Process snapshot\n\n```javascript\nimport psList from 'ps-list'\n\n\u002F\u002F Full snapshot\nconst procs = await psList()\n\u002F\u002F [{ pid, name, cmd, ppid, uid, cpu, memory }, ...]\n\n\u002F\u002F Filter by parent PID (find all children of current agent)\nconst agentPid = process.pid\nconst children = procs.filter(p => p.ppid === agentPid)\n\n\u002F\u002F High-CPU processes (> 80%)\nconst hotProcs = procs.filter(p => (p.cpu ?? 0) > 80)\nif (hotProcs.length) {\n  console.error('[monitor] high-CPU:', hotProcs.map(p => `${p.name}(${p.pid})`))\n}\n```\n\n---\n\n## Baseline + diff (detect unexpected spawns)\n\n```javascript\nasync function detectNewProcesses(\n  baselineMs = 0,\n  intervalMs = 2000\n): Promise\u003Cvoid> {\n  const baseline = new Set((await psList()).map(p => p.pid))\n\n  setTimeout(async () => {\n    const current = await psList()\n    const newProcs = current.filter(p => !baseline.has(p.pid))\n\n    for (const p of newProcs) {\n      console.warn(`[monitor] NEW PROCESS: ${p.name} pid=${p.pid} cmd=${p.cmd}`)\n    }\n  }, intervalMs)\n}\n```\n\n---\n\n## Bash equivalent (no Node dependency)\n\n```bash\nsnapshot_pids() {\n  ps -eo pid,ppid,comm,pcpu,pmem --no-headers | sort -k4 -rn\n}\n\n# Find all descendants of a PID\ndescendants_of() {\n  local parent=\"$1\"\n  ps -eo pid,ppid --no-headers | awk -v p=\"$parent\" '$2==p{print $1}' \\\n    | xargs -I{} bash -c \"echo {}; descendants_of {}\" 2>\u002Fdev\u002Fnull\n}\n\n# Detect zombie processes (state=Z)\nps -eo pid,stat,comm | awk '$2~\u002F^Z\u002F{print \"ZOMBIE:\", $0}'\n```\n\n---\n\n## Anti-Fake-Pass Checklist\n\n```\n❌ ps-list called once at startup → misses processes spawned mid-session\n❌ No ppid filtering → noisy list includes unrelated system processes\n❌ cpu field not available on all platforms (macOS only with all:true option)\n❌ No threshold check → monitoring loop itself consumes CPU\n❌ Snapshot not taken before agent starts → no baseline for diff\n```\n","# \u002Fprocess-list-monitoring\n\n## When to Use\n\n- Audit which processes an agent spawned during a session\n- Detect unexpected child processes (cryptominers, reverse shells)\n- Monitor CPU\u002FRAM per process before triggering circuit breakers\n- Build zombie-process detectors (see [[zombie-process-cleanup]])\n\n## Do NOT use for\n\n- Real-time kernel-level tracing (use [[ebpf-runtime-tracing]] instead)\n- Windows process management (API differs significantly)\n\n---\n\n## Process snapshot\n\n```javascript\nimport psList from 'ps-list'\n\n\u002F\u002F Full snapshot\nconst procs = await psList()\n\u002F\u002F [{ pid, name, cmd, ppid, uid, cpu, memory }, ...]\n\n\u002F\u002F Filter by parent PID (find all children of current agent)\nconst agentPid = process.pid\nconst children = procs.filter(p => p.ppid === agentPid)\n\n\u002F\u002F High-CPU processes (> 80%)\nconst hotProcs = procs.filter(p => (p.cpu ?? 0) > 80)\nif (hotProcs.length) {\n  console.error('[monitor] high-CPU:', hotProcs.map(p => `${p.name}(${p.pid})`))\n}\n```\n\n---\n\n## Baseline + diff (detect unexpected spawns)\n\n```javascript\nasync function detectNewProcesses(\n  baselineMs = 0,\n  intervalMs = 2000\n): Promise\u003Cvoid> {\n  const baseline = new Set((await psList()).map(p => p.pid))\n\n  setTimeout(async () => {\n    const current = await psList()\n    const newProcs = current.filter(p => !baseline.has(p.pid))\n\n    for (const p of newProcs) {\n      console.warn(`[monitor] NEW PROCESS: ${p.name} pid=${p.pid} cmd=${p.cmd}`)\n    }\n  }, intervalMs)\n}\n```\n\n---\n\n## Bash equivalent (no Node dependency)\n\n```bash\nsnapshot_pids() {\n  ps -eo pid,ppid,comm,pcpu,pmem --no-headers | sort -k4 -rn\n}\n\n# Find all descendants of a PID\ndescendants_of() {\n  local parent=\"$1\"\n  ps -eo pid,ppid --no-headers | awk -v p=\"$parent\" '$2==p{print $1}' \\\n    | xargs -I{} bash -c \"echo {}; descendants_of {}\" 2>\u002Fdev\u002Fnull\n}\n\n# Detect zombie processes (state=Z)\nps -eo pid,stat,comm | awk '$2~\u002F^Z\u002F{print \"ZOMBIE:\", $0}'\n```\n\n---\n\n## Anti-Fake-Pass Checklist\n\n```\n❌ ps-list called once at startup → misses processes spawned mid-session\n❌ No ppid filtering → noisy list includes unrelated system processes\n❌ cpu field not available on all platforms (macOS only with all:true option)\n❌ No threshold check → monitoring loop itself consumes CPU\n❌ Snapshot not taken before agent starts → no baseline for diff\n```\n",{},"main","481dcd7dd2e288b9d627a2bd017db70e64e6c6fa","core\u002Fskills\u002Fprocess-list-monitoring",2,"https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI","https:\u002F\u002Fyana.vutam.link\u002F","https:\u002F\u002Fgithub.com\u002FHoronomos-laps","https:\u002F\u002Fyana.vutam.link","An open-source governed runtime & execution environment for multi-agent AI systems.","2026-11-12 23:12:27",{"source":7,"skillName":5,"commands":34,"prompt":44,"zipAvailable":45},[35,38,41],{"tool":36,"command":37},"npx","npx skills add Horonomos-laps\u002FYana-AI --skill process-list-monitoring",{"tool":39,"command":40},"bunx","bunx skills add Horonomos-laps\u002FYana-AI --skill process-list-monitoring",{"tool":42,"command":43},"pnpm","pnpm dlx skills add Horonomos-laps\u002FYana-AI --skill process-list-monitoring","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fprocess-list-monitoring\u002FSKILL.md",true,[],[48,56,63,71,79,87],{"skillNo":49,"name":50,"nameZh":6,"description":51,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":52,"licenseFileUrl":6,"sourceHtmlUrl":53,"categories":54,"keywords":55,"publishedAt":18},"01M735GKET5YVYKAY62W2P5YXB","openai--sentry--sentry","Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`.","MIT","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fopenai--sentry--sentry\u002FSKILL.md",[],[],{"skillNo":57,"name":58,"nameZh":6,"description":59,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":60,"categories":61,"keywords":62,"publishedAt":18},"01M73DCAP83T17HY7SMGK7MGFE","ito-basket-compare","Compare Itô prediction-market baskets against a user's knowledge base, portfolio notes, financial context, watchlist, or research thesis. Use for read-only basket comparison and gap analysis without investment advice or live trading.","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fito-basket-compare\u002FSKILL.md",[],[],{"skillNo":64,"name":65,"nameZh":6,"description":66,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":67,"sourceHtmlUrl":68,"categories":69,"keywords":70,"publishedAt":18},"01M734CYEMZFDR3KH6SW0JP8TD","implementing-network-traffic-baselining","Build network traffic baselines from NetFlow\u002FIPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly\u002Fdaily traffic pattern profiling","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FSKILL.md",[],[],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":75,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":18},"01M73ASZ6NJRJM44Z2P84NGQ3Q","detecting-evasion-techniques-in-endpoint-logs","Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":83,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":18},"01M734AFNXD06Z78QRK0VKGT7Q","implementing-microsegmentation-with-guardicore","Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[],[],{"skillNo":88,"name":89,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":18},"01M736TK27QMCXK0DVCH25SJN5","ramdisk-tmpfs-patterns","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Framdisk-tmpfs-patterns\u002FSKILL.md",[],[]]