菜单
Use when the developer asks about audit logs, security events, session history, or wants to generate a security report. Auto-triggers on: "audit log", "security events", "what happened", "security report", "show audit", "event history", "compliance".
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Seeds per-session canary tokens into WebFetch advisories and scans every subsequent tool input/output for the canary's appearance. Use when the developer wants prompt-injection detection telemetry, or asks "is my session compromised?". Auto-fires on PreToolUse(WebFetch) and PostToolUse(*). Do not use for in-prompt sanitization (see deep-research's <untrusted_source> wrapping).
Detects subagent capability escapes by comparing the tool being invoked against the skill's declared allowed-tools list. Use when the developer asks about subagent escape, sees a tool fired from an unexpected skill, or audits delegation.md compliance. Auto-fires on PreToolUse. Best-effort observability only — does not block.
OPT-IN BLOCKING capability allowlist. Pairs with hydra-capability-fence (advisory). When state/capability-policy.json sets enabled:true, this shield blocks any tool call whose name is not in the active SKILL.md frontmatter allowed-tools list. Use when the developer asks why a tool call was blocked, wants to enable or tune the capability allowlist, or reviews a stderr "capability-shield (BLOCKED)" message. Default disabled — out of the box this shield does nothing. Do not use for observability without enforcement (see capability-fence).
Logs every WebFetch / WebSearch / Bash-network destination to an append-only NDJSON and surfaces first-seen domains as advisory warnings. Use when the developer asks "what did this session reach out to?" or "show me egress", wants a per-session list of contacted hosts, asks about an egress-monitor advisory, or wants to inspect state/log.ndjson. Auto-fires on PostToolUse for network tools. Do not use for in-process state inspection (see audit-trail).
OPT-IN BLOCKING egress allowlist. Pairs with hydra-egress-monitor (advisory). When state/egress-policy.json sets enabled:true, this shield blocks any WebFetch / WebSearch / Bash-network call whose destination host is not in the operator-curated allowlist. Use when the developer asks why a network call was blocked, wants to inspect or edit the egress allowlist, or asks about audit.ndjson policy_blocked events. Default disabled — out of the box this shield does nothing. Do not use for observability without enforcement (see egress-monitor).
Scans the project's dep tree for license compatibility against an allow/deny policy. Use when the developer asks "what licenses are in here?" or before a release. Reports denied (GPL/AGPL/SSPL), warned (MPL/EPL/CDDL), and allowed (MIT/Apache/BSD/ISC) classifications. Do not use for license-text generation (see SBOM).
| name | audit-awareness |
| description | Use when the developer asks about audit logs, security events, session history, or wants to generate a security report. Auto-triggers on: "audit log", "security events", "what happened", "security report", "show audit", "event history", "compliance". |
| allowed-tools | ["Read","Grep","Bash"] |
<decision_tree> IF user asks for audit summary: → Read last 50 lines of ${CLAUDE_PLUGIN_ROOT}/state/audit.jsonl → Group by event type: secrets, vulns, blocks, configs, tool_use → Show counts and most recent findings
IF user asks to filter by severity: → grep for matching severity in audit.jsonl → Show filtered results
IF user asks for full report: → Run: python3 ${CLAUDE_PLUGIN_ROOT}/../../shared/scripts/report-gen.py ${CLAUDE_PLUGIN_ROOT}/state/audit.jsonl /tmp/hydra-report.html → Tell user: "Report generated at /tmp/hydra-report.html"
IF user asks about threat posture: → Run: python3 ${CLAUDE_PLUGIN_ROOT}/../../shared/scripts/learnings.py ${CLAUDE_PLUGIN_ROOT}/state/ --report → Show posture score, chronic patterns, top threats
IF audit is empty: → "No security events logged yet. Events are recorded as you work." </decision_tree>
<output_format>
| Time | Type | Severity | Detail |
|---|---|---|---|
| 14:23 | SECRET | critical | AWS key in config.py:12 |
| 14:25 | VULN | high | CWE-89 SQL injection in api.py:45 |
| 14:28 | BLOCK | critical | rm -rf / blocked |
Score: [0.0-1.0] — [CLEAN/CAUTION/WARNING/CRITICAL] </output_format>
<escalate_to_sonnet> IF audit trail shows escalating threat pattern: "ESCALATE_TO_SONNET: increasing threat rate across session — trend analysis needed" </escalate_to_sonnet>
