gl0bal01

Hourly Claude subscription usage guardrail. Reads PAI canonical usage cache (~/.claude/MEMORY/STATE/usage-cache.json) for 5h/7d window percentages. Voice-alert via pai-pulse if threshold exceeded. Use when user says usage, cost, am I burning too much, take a break, claude limit, rate limit.

Health probe suite for the PAI ecosystem. Use when user says doctor, is everything ok, health check, what's broken, pai status.

POST to PAI canonical Pulse daemon on 127.0.0.1:31337 for TTS notifications via ElevenLabs SDK encapsulated server-side. Use when user says notify, tell me when, mobile push, voice alert, send a notification, or wants asynchronous voice delivery from a long-running task.

Daily digest of PAI ecosystem state pushed to mobile at 18:00 — Claude 5h/7d usage, pending proposals, doctor failures, leak detector flags, mood/git/learning signals from PAI Algorithm. Mirrors PAI canonical statusline visible-section into single message. Use when user says daily summary, what happened today, banner, digest, brief me.

Hourly upstream watcher for 4 PAI ecosystem repos (oh-my-claudecode, Personal_AI_Infrastructure, pai-anywhere, pai-review-mode). Fetches origin, computes impact score, writes JSON proposal to disk, posts mobile alert via pai-pulse. Use when user says check upstream, watch repos, what changed, upstream bump, propose upgrade.

Persistent knowledge-base workspace for Hermes Agent. Ingests, indexes, and searches domain-specific documents (OSINT newsletters, security SOPs, research notes) in a curated filesystem hierarchy. Use when user says ingest document, add to knowledge base, search my notes, find in workspace, index folder, workspace search, osint archive, or sop lookup.

oh-my-claudecode (OMC) harness — Claude Code orchestration. Use when user says ralph, team, autopilot, ultrawork, ultrapilot, or wants Claude Code session with hooks/skills/agent catalog. Routes to local `omc` CLI binary.

Accept an upstream proposal from pai-watch — pin target SHA in /etc/pai/paths.env + write arc review markdown + mark proposal status=accepted. SSH-only by design (never callable via remote platform). Use when user says accept, approve upgrade, merge proposal, bump, pin sha.

Orchestrate the complete malware analysis lifecycle across triage, dynamic analysis, detection engineering, and report writing. Use as the single entry point for any malware analysis task — routes to specialized sub-skills by file type and phase, carries findings between phases, and supports multi-sample batch workflows.

Create detection rules and hunting queries from malware analysis findings. Use when you need to write Sigma rules for SIEM, Suricata rules for network IDS, defang IOCs for safe sharing, or convert analysis findings into actionable detection content for SOC teams and threat hunters.

Execute and monitor malware in controlled sandbox environments. Use when you need to observe runtime behavior, capture network traffic, monitor process activity, analyze file/registry changes, or understand actual malware functionality beyond static analysis. Guides safe execution with Procmon, Wireshark, Process Hacker (now System Informer), Sysmon, and automated sandboxes.

Create professional malware analysis reports for enterprise security teams and incident response. Use when you need to write, structure, or improve a malware analysis report, produce executive summaries, author YARA rules, or format IOCs and detection rules for professional delivery.

Rapid assessment, classification, and prioritization of malware samples. Use when you need to perform initial malware assessment, classify a sample's type and family, determine analysis priority, identify quick indicators, or decide on next analysis steps.

Analyze specialized file types beyond standard PE executables - .NET assemblies, Office macros, PDFs, PowerShell scripts, JavaScript, archives, HTA files, disk images (ISO/IMG/VHD/VHDX), and Linux ELF binaries. Use when you encounter documents, scripts, disk images, or non-Windows executables that require format-specific analysis tools and techniques.