Menu
Use when inspecting SAP BTP CF app audit events, SSH/debug activity, crashes, health, or live polling with cf-events.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use when indexing, linking, tracing, graphing, inspecting, diagnosing, cleaning, testing, or changing SAP CAP service-to-service flows with the service-flow CLI or @saptools/service-flow package, especially for multi-repository workspaces, SQLite state, handler implementation selection, runtime placeholders, dynamic targets, parser/linker evidence, and deterministic validation.
Use when a task involves running SQL, inspecting saved query refs, or discovering schemas, tables, and columns in SAP HANA Cloud databases bound to SAP BTP Cloud Foundry apps through the cf-hana CLI. Covers selector/app targeting, binding choice, read-only SELECT workflows, explicit writes, compact or structured output, saved result refs, and local result inspection.
Use when working with Jira Cloud through the jira CLI, including assigned issue lists, issue details with local inline image files, remote links, transitions, safe issue assignment, worklogs, descriptions, summaries, and comments.
Guide on how to remotely debug SAP BTP Cloud Foundry Node.js applications by combining deployed compiled JS discovery, Cloud Foundry log evidence, live HTTP request/response traces, runtime inspector snapshots, and read-only HANA evidence when debugging errors or exploring runtime behavior.
Use when analyzing SAP CAP CDS/HANA model structure with hana-lens, including building a compact CSN cache, fuzzy or regex entity search, field search, incoming reference lookup, dense entity descriptions, and safe association expansion.
Core agent-browser usage guide. Read this before running any agent-browser commands. Covers the snapshot-and-ref workflow, navigating pages, interacting with elements (click, fill, type, select), extracting text and data, taking screenshots, managing tabs, handling forms and auth, waiting for content, running multiple browser sessions in parallel, and troubleshooting common failures. Use when the user asks to interact with a website, fill a form, click something, extract data, take a screenshot, log into a site, test a web app, or automate any browser task.
| name | cf-events |
| description | Use when inspecting SAP BTP CF app audit events, SSH/debug activity, crashes, health, or live polling with cf-events. |
Use cf-events to inspect Cloud Foundry app or space audit events, SSH/debug activity, crash history, app health, and event polling for SAP BTP Cloud Foundry apps. Prefer it when the task needs "what happened to this app", "who recently opened SSH/debug", "why did it crash", or "what is the current app health".
If cf-events is missing, install it from @saptools/cf-events: npm install -g @saptools/cf-events.
region/org/space/app or a bare app name for app-specific commands; use region/org/space for space-wide events, watch, and crashes.SAP_EMAIL and SAP_PASSWORD or secure explicit input.--json for structured parsing; use text output when a human-facing summary is more useful.Use events for recent audit history. Narrow noisy output with --since, --limit, and --type:
cf-events events ap10/example-org/dev/app-demo --since 6h --limit 100 --json
cf-events events app-demo --type ssh --json
cf-events events ap10/example-org/dev --type ssh --json
Use ssh-status to check SSH enablement and recent SSH/debug activity:
cf-events ssh-status ap10/example-org/dev/app-demo --since 24h --json
Use crashes for crash counts, latest crash time, reason, instance index, and exit status:
cf-events crashes app-demo --since 24h --json
cf-events crashes ap10/example-org/dev --since 24h --json
Use status for requested state, web instance stats, SSH flag, and latest audit event:
cf-events status app-demo --json
Use watch only when the task needs live audit-event polling. Bound it operationally and stop it when enough evidence is collected:
cf-events watch app-demo --lookback 2m --interval 15000 --type crash --json
cf-events watch ap10/example-org/dev --lookback 2m --interval 15000 --type crash --json
events, crashes, and watch support app and space selectors; ssh-status and status remain app-only.--since and --lookback are safe for recent audit-event filters; the CLI sends CF-compatible audit timestamps without fractional seconds.errors responses are surfaced as command errors instead of being reported as empty audit-event results.s, m, h, or d values such as 30m, 6h, or 7d.--type ssh expands to SSH authorized and denied events.--type crash expands to app and process crash events.audit.app.start are accepted.events and crashes default to --limit 50.ssh-status defaults to --since 24h.watch defaults to --lookback 2m and --interval 15000; the minimum interval is 2000 ms.The selector can be an app selector (region/org/space/app or bare app name) or a space selector (region/org/space) for events, watch, and crashes:
cf-events status ap10/example-org/dev/app-demo --json
cf-events status app-demo --json
cf-events events ap10/example-org/dev --json
Bare app names automatically use the current CF target if one is active. If no target is set, provide the full app path instead. status and ssh-status remain app-specific and should reject region/org/space selectors unless a future implementation explicitly adds aggregate variants.
Treat ssh-status as audit evidence, not a live session API. Cloud Foundry does not expose active SSH sessions and does not emit close events. cf-events marks a session likelyActive only when a recent audit.app.ssh-authorized event falls inside its heuristic window. Denied attempts are reported separately from audit.app.ssh-unauthorized.
Audit events can expose user identities, app names, org/space names, route metadata, crash details, and operational timing. Do not print credentials, tokens, authorization headers, or raw sensitive event payloads. Do not dump raw sensitive event payloads into final answers unless the user explicitly asks; summarize and cite relevant timestamps, event types, actors, and selectors.
If credentials are missing, use SAP_EMAIL and SAP_PASSWORD or ask for secure explicit input. If CF access fails, verify the region, org, space, app, and current CF permissions. If watch appears quiet, first check for surfaced CF API errors, then increase --lookback, lower the type filter, or run events --since <duration> --json to confirm recent audit events exist.