Claudefeed — Security skill for Claude Code

`claudefeed`

**`tail -f` for a coding agent.** What it ran, what it opened, what it dialed. From the kernel, not from its own log.

**`claudefeed` is an eBPF agent audit feed for Linux: it streams every command, file open and TCP connection a coding-agent session makes, scoped to that session's process subtree.**

Quick start

curl -fsSL https://yeet.cx | sh          # install yeet, once
yeet run github:yeet-src/claudefeed      # clone, build and run in one step

With an agent session running anywhere on the box, that is all of it. `claudefeed` finds the live `claude` processes, seeds its tracked set, and starts streaming.

The incumbents each solve a slice and miss the rest. `strace -f` needs a PID you name up front, and a session is a moving tree: the agent spawns a shell, the shell spawns `git`, `git` spawns `ssh`. Auditd catches the tree but hands you a system-wide log to filter afterwards. The agent's own transcript tells you what it believed it did,