monitor-process

Name: monitor-process
Availability: InStock
Author: stevessr

Monitor process behavior via eBPF-based collection of file, network, and subprocess activity.

Updated Apr 20, 2026

Search Tags:#ai agents #security audit #ebpf #anomaly detection #process monitoring #system calls #network tracing

Ready to run

npx skills add https://github.com/stevessr/agent-ebpf-filter --skill monitor-process

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: monitor-process
Source: https://github.com/stevessr/agent-ebpf-filter/tree/main/.claude/skills/monitor-process
Command: npx skills add https://github.com/stevessr/agent-ebpf-filter --skill monitor-process

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps identify what a running process actually does by monitoring system calls, file activity, network behavior, and process creation patterns for debugging, auditing, and security analysis.

Core Features & Use Cases

Process Behavior Monitoring: Track file access, network connections, subprocess execution, and system call activity through eBPF-based observability.
Security Analysis: Detect suspicious behaviors such as sensitive file access, unusual network activity, privilege escalation attempts, and possible data leakage patterns.
Use Case: Analyze an AI agent run to understand which files it touched, which services it contacted, and whether its actions matched expected behavior.

Quick Start

Use the monitor-process skill to track a target AI agent process and analyze its file access, network connections, and subprocess activity.

Frequently Asked Questions about monitor-process

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I monitor AI agent process behavior for security auditing?▼

You can trace AI agent process behavior by collecting and analyzing runtime system activity such as file access, network connections, and subprocess execution using eBPF-based observability for security auditing.

What does eBPF process monitoring track for anomaly detection?▼

eBPF process monitoring tracks system calls, file activity, network connections, and subprocess execution patterns to identify suspicious behaviors like privilege escalation attempts and data leakage for anomaly detection.

How do I trace which files and network services an AI agent touched during execution?▼

Trace AI agent execution by applying process tracking and filtering to record detailed file access and network connection events, allowing you to verify whether its actions matched expected behavior.

Can I use eBPF system call tracing to detect data leakage patterns in running processes?▼

Yes, eBPF system call tracing detects data leakage patterns by analyzing runtime network behavior and sensitive file access, flagging suspicious activity during the process monitoring and analysis workflow.

Do I need eBPF to perform tool execution trace analysis for subprocess execution?▼

Yes, eBPF is required for tool execution trace analysis because it provides the runtime event collection and process tracking capabilities needed to monitor subprocess execution and system call activity.