[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M73G5SW5PQFA5HX6WFPXA9DA":3,"skill-same:01M73G5SW5PQFA5HX6WFPXA9DA":47},{"skillNo":4,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":18,"linkOnly":19,"markdownContent":20,"markdownBody":21,"frontMatter":22,"refName":23,"commitSha":24,"skillDirectory":25,"forksCount":26,"repositoryHtmlUrl":27,"repositoryHomepageUrl":28,"ownerHtmlUrl":29,"ownerBlogUrl":30,"ownerDescription":31,"updatedAt":32,"install":33,"resources":46},"01M73G5SW5PQFA5HX6WFPXA9DA","syslog-integration",null,"Horonomos-laps\u002FYana-AI","Horonomos-laps","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F355299122?v=4","01M76B3QPXE88ET2SQPDPVATZT"," Horonomos-laps","01M72ZQRJPCYPSSWT4D00VJR2A",13,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fsyslog-integration\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: syslog-integration\ndescription: Linux syslog integration for agent audit logging. Write structured events to \u002Fdev\u002Flog via UDP syslog, severity levels (EMERG→DEBUG), facility codes, RFC5424 format, and forwarding to centralized log aggregators. Sources: bnoordhuis\u002Fnode-syslog.\norigin: yana-ai — synthesized from bnoordhuis\u002Fnode-syslog (MIT), RFC 3164\u002F5424\nlicense: Apache-2.0\nversion: 1.0.0\ncompatibility: yana-ai >= 1.3.48\n---\n\n# \u002Fsyslog-integration\n\n## When to Use\n\n- Forward agent audit events to system syslog (journald, rsyslog, syslog-ng)\n- Integrate yamtam audit trail with centralized SIEM (Splunk, Datadog)\n- Append-only audit log that agent cannot tamper with (syslog is external)\n- Pairs with [[append-only-event-log]] for dual-write audit strategy\n\n## Do NOT use for\n\n- High-frequency debug logs (syslog has overhead — use structured file logging)\n- Environments without syslog daemon (container scratch images)\n\n---\n\n## Node.js syslog client\n\n```javascript\nimport syslog from 'node-syslog'\n\n\u002F\u002F Initialize once at startup\nsyslog.init('yamtam-agent', syslog.LOG_PID | syslog.LOG_ODELAY, syslog.LOG_DAEMON)\n\n\u002F\u002F Severity levels\n\u002F\u002F LOG_EMERG=0, LOG_ALERT=1, LOG_CRIT=2, LOG_ERR=3\n\u002F\u002F LOG_WARNING=4, LOG_NOTICE=5, LOG_INFO=6, LOG_DEBUG=7\n\nexport function auditLog(level: 'info' | 'warn' | 'error' | 'crit', msg: string, meta?: object) {\n  const entry = JSON.stringify({ ts: new Date().toISOString(), msg, ...meta })\n  const sev = {\n    info:  syslog.LOG_INFO,\n    warn:  syslog.LOG_WARNING,\n    error: syslog.LOG_ERR,\n    crit:  syslog.LOG_CRIT,\n  }[level]\n\n  syslog.log(sev, entry)\n}\n\n\u002F\u002F Cleanup on exit\nprocess.on('exit', () => syslog.close())\n```\n\n---\n\n## RFC5424 format over UDP (no native binding)\n\n```javascript\nimport dgram from 'dgram'\n\nconst SYSLOG_HOST = process.env.SYSLOG_HOST ?? '127.0.0.1'\nconst SYSLOG_PORT = parseInt(process.env.SYSLOG_PORT ?? '514')\nconst FACILITY    = 1   \u002F\u002F USER\nconst SEVERITY    = 6   \u002F\u002F INFO\n\nfunction sendSyslog(msg: string): void {\n  const pri     = (FACILITY * 8) + SEVERITY\n  const ts      = new Date().toISOString()\n  const host    = 'yamtam'\n  const app     = 'agent'\n  const msgid   = '-'\n  const structured = '-'\n  const packet  = `\u003C${pri}>1 ${ts} ${host} ${app} ${process.pid} ${msgid} ${structured} ${msg}`\n\n  const client  = dgram.createSocket('udp4')\n  const buf     = Buffer.from(packet)\n  client.send(buf, 0, buf.length, SYSLOG_PORT, SYSLOG_HOST, () => client.close())\n}\n```\n\n---\n\n## Bash syslog via logger(1)\n\n```bash\n# logger is available on all Linux systems\nagent_log() {\n  local level=\"$1\"; local msg=\"$2\"\n  logger -t \"yamtam-agent\" -p \"daemon.${level}\" -- \"$msg\"\n}\n\nagent_log info  \"session started: $YAMTAM_SESSION_ID\"\nagent_log warn  \"rate limit triggered\"\nagent_log err   \"sandbox exec failed: exit $?\"\n```\n\n---\n\n## Anti-Fake-Pass Checklist\n\n```\n❌ syslog.init() not called → all log() calls silently dropped\n❌ syslog.close() missing on exit → socket fd leak\n❌ Unstructured string → syslog message not parseable by SIEM\n❌ LOG_DEBUG in production → syslog flooded with noise, rate-limited\n❌ UDP syslog → fire-and-forget, no delivery guarantee (use TCP\u002FTLS for critical)\n❌ PII in syslog message → syslog stored on shared system, visible to admins\n```\n","# \u002Fsyslog-integration\n\n## When to Use\n\n- Forward agent audit events to system syslog (journald, rsyslog, syslog-ng)\n- Integrate yamtam audit trail with centralized SIEM (Splunk, Datadog)\n- Append-only audit log that agent cannot tamper with (syslog is external)\n- Pairs with [[append-only-event-log]] for dual-write audit strategy\n\n## Do NOT use for\n\n- High-frequency debug logs (syslog has overhead — use structured file logging)\n- Environments without syslog daemon (container scratch images)\n\n---\n\n## Node.js syslog client\n\n```javascript\nimport syslog from 'node-syslog'\n\n\u002F\u002F Initialize once at startup\nsyslog.init('yamtam-agent', syslog.LOG_PID | syslog.LOG_ODELAY, syslog.LOG_DAEMON)\n\n\u002F\u002F Severity levels\n\u002F\u002F LOG_EMERG=0, LOG_ALERT=1, LOG_CRIT=2, LOG_ERR=3\n\u002F\u002F LOG_WARNING=4, LOG_NOTICE=5, LOG_INFO=6, LOG_DEBUG=7\n\nexport function auditLog(level: 'info' | 'warn' | 'error' | 'crit', msg: string, meta?: object) {\n  const entry = JSON.stringify({ ts: new Date().toISOString(), msg, ...meta })\n  const sev = {\n    info:  syslog.LOG_INFO,\n    warn:  syslog.LOG_WARNING,\n    error: syslog.LOG_ERR,\n    crit:  syslog.LOG_CRIT,\n  }[level]\n\n  syslog.log(sev, entry)\n}\n\n\u002F\u002F Cleanup on exit\nprocess.on('exit', () => syslog.close())\n```\n\n---\n\n## RFC5424 format over UDP (no native binding)\n\n```javascript\nimport dgram from 'dgram'\n\nconst SYSLOG_HOST = process.env.SYSLOG_HOST ?? '127.0.0.1'\nconst SYSLOG_PORT = parseInt(process.env.SYSLOG_PORT ?? '514')\nconst FACILITY    = 1   \u002F\u002F USER\nconst SEVERITY    = 6   \u002F\u002F INFO\n\nfunction sendSyslog(msg: string): void {\n  const pri     = (FACILITY * 8) + SEVERITY\n  const ts      = new Date().toISOString()\n  const host    = 'yamtam'\n  const app     = 'agent'\n  const msgid   = '-'\n  const structured = '-'\n  const packet  = `\u003C${pri}>1 ${ts} ${host} ${app} ${process.pid} ${msgid} ${structured} ${msg}`\n\n  const client  = dgram.createSocket('udp4')\n  const buf     = Buffer.from(packet)\n  client.send(buf, 0, buf.length, SYSLOG_PORT, SYSLOG_HOST, () => client.close())\n}\n```\n\n---\n\n## Bash syslog via logger(1)\n\n```bash\n# logger is available on all Linux systems\nagent_log() {\n  local level=\"$1\"; local msg=\"$2\"\n  logger -t \"yamtam-agent\" -p \"daemon.${level}\" -- \"$msg\"\n}\n\nagent_log info  \"session started: $YAMTAM_SESSION_ID\"\nagent_log warn  \"rate limit triggered\"\nagent_log err   \"sandbox exec failed: exit $?\"\n```\n\n---\n\n## Anti-Fake-Pass Checklist\n\n```\n❌ syslog.init() not called → all log() calls silently dropped\n❌ syslog.close() missing on exit → socket fd leak\n❌ Unstructured string → syslog message not parseable by SIEM\n❌ LOG_DEBUG in production → syslog flooded with noise, rate-limited\n❌ UDP syslog → fire-and-forget, no delivery guarantee (use TCP\u002FTLS for critical)\n❌ PII in syslog message → syslog stored on shared system, visible to admins\n```\n",{},"main","481dcd7dd2e288b9d627a2bd017db70e64e6c6fa","core\u002Fskills\u002Fsyslog-integration",1,"https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI","https:\u002F\u002Fyana.vutam.link\u002F","https:\u002F\u002Fgithub.com\u002FHoronomos-laps","https:\u002F\u002Fyana.vutam.link","An open-source governed runtime & execution environment for multi-agent AI systems.","2026-11-11 23:56:26",{"source":7,"skillName":5,"commands":34,"prompt":44,"zipAvailable":45},[35,38,41],{"tool":36,"command":37},"npx","npx skills add Horonomos-laps\u002FYana-AI --skill syslog-integration",{"tool":39,"command":40},"bunx","bunx skills add Horonomos-laps\u002FYana-AI --skill syslog-integration",{"tool":42,"command":43},"pnpm","pnpm dlx skills add Horonomos-laps\u002FYana-AI --skill syslog-integration","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fsyslog-integration\u002FSKILL.md",true,[],[48,56,63,71,79,87],{"skillNo":49,"name":50,"nameZh":6,"description":51,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":52,"licenseFileUrl":6,"sourceHtmlUrl":53,"categories":54,"keywords":55,"publishedAt":18},"01M735GKET5YVYKAY62W2P5YXB","openai--sentry--sentry","Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`.","MIT","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fopenai--sentry--sentry\u002FSKILL.md",[],[],{"skillNo":57,"name":58,"nameZh":6,"description":59,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":60,"categories":61,"keywords":62,"publishedAt":18},"01M73DCAP83T17HY7SMGK7MGFE","ito-basket-compare","Compare Itô prediction-market baskets against a user's knowledge base, portfolio notes, financial context, watchlist, or research thesis. Use for read-only basket comparison and gap analysis without investment advice or live trading.","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fito-basket-compare\u002FSKILL.md",[],[],{"skillNo":64,"name":65,"nameZh":6,"description":66,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":67,"sourceHtmlUrl":68,"categories":69,"keywords":70,"publishedAt":18},"01M734CYEMZFDR3KH6SW0JP8TD","implementing-network-traffic-baselining","Build network traffic baselines from NetFlow\u002FIPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly\u002Fdaily traffic pattern profiling","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FSKILL.md",[],[],{"skillNo":72,"name":73,"nameZh":6,"description":74,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":75,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":18},"01M73ASZ6NJRJM44Z2P84NGQ3Q","detecting-evasion-techniques-in-endpoint-logs","Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":83,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":18},"01M734AFNXD06Z78QRK0VKGT7Q","implementing-microsegmentation-with-guardicore","Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[],[],{"skillNo":88,"name":89,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":7,"ownerLogin":8,"ownerAvatarUrl":9,"ownerAccountNo":10,"ownerDisplayName":11,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":18},"01M736TK27QMCXK0DVCH25SJN5","ramdisk-tmpfs-patterns","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Framdisk-tmpfs-patterns\u002FSKILL.md",[],[]]