From hydra-audit-trail
Use when the developer asks about audit logs, security events, session history, or wants to generate a security report. Auto-triggers on: "audit log", "security events", "what happened", "security report", "show audit", "event history", "compliance".
How this skill is triggered — by the user, by Claude, or both
Slash command
/hydra-audit-trail:audit-awarenessThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
<purpose>
<decision_tree> IF user asks for audit summary: → Read last 50 lines of ${CLAUDE_PLUGIN_ROOT}/state/audit.jsonl → Group by event type: secrets, vulns, blocks, configs, tool_use → Show counts and most recent findings
IF user asks to filter by severity: → grep for matching severity in audit.jsonl → Show filtered results
IF user asks for full report: → Run: python3 ${CLAUDE_PLUGIN_ROOT}/../../shared/scripts/report-gen.py ${CLAUDE_PLUGIN_ROOT}/state/audit.jsonl /tmp/hydra-report.html → Tell user: "Report generated at /tmp/hydra-report.html"
IF user asks about threat posture: → Run: python3 ${CLAUDE_PLUGIN_ROOT}/../../shared/scripts/learnings.py ${CLAUDE_PLUGIN_ROOT}/state/ --report → Show posture score, chronic patterns, top threats
IF audit is empty: → "No security events logged yet. Events are recorded as you work." </decision_tree>
<output_format>
| Time | Type | Severity | Detail |
|---|---|---|---|
| 14:23 | SECRET | critical | AWS key in config.py:12 |
| 14:25 | VULN | high | CWE-89 SQL injection in api.py:45 |
| 14:28 | BLOCK | critical | rm -rf / blocked |
Score: [0.0-1.0] — [CLEAN/CAUTION/WARNING/CRITICAL] </output_format>
<escalate_to_sonnet> IF audit trail shows escalating threat pattern: "ESCALATE_TO_SONNET: increasing threat rate across session — trend analysis needed" </escalate_to_sonnet>
npx claudepluginhub enchanter-ai/hydra --plugin audit-trailProvides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.