Overview

/matylda is a production command in the Intelligence category of the Prismatic Platform. Named after an operational pattern of patient, silent observation followed by decisive analytical action, this command provides passive observation, deep analysis, risk forecasting, and advisory handoff capabilities. Unlike aggressive intelligence-gathering commands that actively probe targets, /matylda operates in a purely passive mode -- watching, correlating, and forecasting without ever generating detectable traffic or triggering alert thresholds on monitored systems.

The command is designed around a three-phase operational model. In the first phase, the matylda-spotter agent establishes passive observation channels across the platform's data streams, collecting signals without interference. In the second phase, deep analysis algorithms process the accumulated observations through multi-dimensional correlation, identifying patterns that would be invisible in any single data source. In the third phase, the command produces risk forecasts and structured advisory briefs that can be handed off to operational agents or human operators for action.

This command operates under the L3 authority level and is executed by the matylda-spotter agent, a specialized intelligence agent trained in passive OSINT collection and behavioral pattern analysis. It is part of the platform's 216-command slash command registry, built on the AIAD (Autonomous Intelligence Agent Design) standard. The L3 authority requirement reflects the sensitive nature of the intelligence products generated by this command, which may contain actionable risk assessments affecting strategic decisions.

The strength of /matylda lies in its patience. While other intelligence commands produce rapid results through active probing, this command excels at long-duration observation campaigns where the value compounds over time as more behavioral data points are correlated. It is particularly effective for monitoring evolving threat landscapes, tracking organizational risk posture changes, and providing early warning of emerging vulnerabilities before they are publicly disclosed or actively exploited.

Architecture

The /matylda command implements a sophisticated observation-analysis-advisory pipeline built on OTP principles for fault tolerance and continuous operation.

+----------------------+     +---------------------+     +--------------------+
|  Observation Layer   |---->|  Analysis Engine     |---->|  Advisory Generator|
|  (Passive Sensors)   |     |  (Correlation Core)  |     |  (Risk Forecasts)  |
+----------------------+     +---------------------+     +--------------------+
         |                           |                           |
         v                           v                           v
+----------------------+     +---------------------+     +--------------------+
|  Signal Aggregator   |     |  Pattern Library     |     |  Handoff Manager   |
|  (Multi-source)      |     |  (Historical Models) |     |  (Agent Dispatch)  |
+----------------------+     +---------------------+     +--------------------+

The Observation Layer comprises a set of passive sensors that monitor data streams without injecting any traffic or queries of their own. These sensors tap into existing telemetry flows, public data feeds, and platform internal state streams. Each sensor operates as an independent OTP process with its own supervision, ensuring that failure in one observation channel does not affect others.

The Analysis Engine performs multi-dimensional correlation across the aggregated observation data. It maintains a library of historical behavioral patterns and uses these as templates for identifying anomalies, trends, and emerging risks. The engine implements a sliding window approach where recent observations are weighted more heavily, but long-duration patterns spanning weeks or months are also tracked.

The Advisory Generator transforms analytical findings into structured risk forecasts and advisory briefs. Each advisory includes a confidence score, supporting evidence chain, recommended actions, and a priority classification. The generator also manages the handoff workflow, routing advisories to appropriate operational agents or human operators based on the content domain and urgency level.

Usage

Basic Observation

# Start passive observation with default parameters
/matylda

# Begin observation on a specific domain or target
/matylda --target=example.com

# Start a named observation campaign
/matylda --campaign="q1-threat-landscape" --duration=30d

Analysis and Forecasting

# Generate risk forecast from accumulated observations
/matylda --forecast

# Deep analysis with specific correlation model
/matylda --analyze --model=behavioral-drift

# Generate advisory brief for a specific observation period
/matylda --advisory --period=7d

Campaign Management

# List active observation campaigns
/matylda --list-campaigns

# Get status of a specific campaign
/matylda --campaign="q1-threat-landscape" --status

# Pause an observation campaign
/matylda --campaign="q1-threat-landscape" --pause

Handoff Operations

# Generate advisory handoff to a specific agent
/matylda --handoff --to=delta-force-commander

# Create structured intelligence brief for human review
/matylda --brief --format=markdown --output=intel-brief.md

# Trigger automated response based on advisory thresholds
/matylda --auto-handoff --threshold=high

Options & Parameters

Option	Type	Default	Description
`--target`	String	platform-wide	Specific target for focused observation
`--campaign`	String	none	Named observation campaign identifier
`--duration`	Duration	continuous	Maximum observation duration (e.g., 7d, 30d, 6h)
`--forecast`	Flag	false	Generate risk forecast from accumulated data
`--analyze`	Flag	false	Run deep analysis on collected observations
`--model`	String	default	Analysis model (behavioral-drift, anomaly, trend, composite)
`--advisory`	Flag	false	Generate advisory brief
`--period`	Duration	24h	Observation period for analysis and advisory generation
`--handoff`	Flag	false	Initiate advisory handoff to another agent
`--to`	String	auto	Target agent for handoff (auto-routes based on advisory domain)
`--brief`	Flag	false	Generate structured intelligence brief
`--format`	String	table	Output format (table, json, markdown, brief)
`--output`	String	stdout	Output file path for exports
`--auto-handoff`	Flag	false	Enable automatic handoff when thresholds are met
`--threshold`	String	critical	Threshold level for auto-handoff (low, medium, high, critical)
`--list-campaigns`	Flag	false	List all active observation campaigns
`--status`	Flag	false	Show campaign or overall status
`--pause`	Flag	false	Pause an active campaign
`--verbose`	Flag	false	Include detailed observation logs and correlation evidence

Execution Flow

Authority Verification -- The system confirms L3 authority for the requesting operator. The elevated authority requirement ensures that only authorized personnel can initiate passive intelligence operations or access the resulting products.
Campaign Initialization -- If a new campaign is specified, the system creates a named campaign record with the specified parameters, duration limits, and target configuration. Existing campaigns are resumed from their last checkpoint.
Sensor Deployment -- Passive observation sensors are activated across relevant data streams. Sensor selection is automatic based on the target specification, with manual override available for specialized requirements.
Continuous Observation -- Sensors collect data passively, feeding the Signal Aggregator in real time. No active probing, no injected traffic. All observation is performed against existing data flows and publicly accessible information.
Pattern Correlation -- The Analysis Engine continuously processes incoming observation data against historical pattern templates, identifying matches, anomalies, and trends. Significant findings trigger internal alerts within the Matylda subsystem.
Risk Forecasting -- When sufficient observation data has been accumulated (or on explicit request), the system generates probabilistic risk forecasts with confidence intervals, supporting evidence chains, and trend projections.
Advisory Production -- Findings and forecasts are compiled into structured advisory briefs with actionable recommendations, priority classifications, and suggested handoff targets.
Handoff Execution -- Advisories are dispatched to the designated recipient (agent or human operator) through the platform's standard messaging infrastructure, with delivery confirmation and acknowledgment tracking.

Integration Points

Component	Integration Type	Description
Prismatic Agents	Agent Execution	Executed by the `matylda-spotter` agent with full AIAD lifecycle management
OSINT Framework	Data Source	Leverages OSINT data streams as passive observation channels
Prismatic Perimeter	Attack Surface	Correlates observations with external attack surface data
Color-Team Security	Threat Intel	Receives Red Team findings as threat pattern templates
NABLA Infinity	Epistemic Framework	Advisory confidence scores validated through Trinity Gate
Quality Gates	Validation	Pre/post execution quality validation for all operations
Telemetry	Observability	Command execution metrics and campaign health tracking
Session Context	State Persistence	Campaign state persisted across sessions for long-duration operations

Best Practices

Campaign Naming: Use descriptive, date-prefixed campaign names (e.g., 2026-q1-supply-chain-risk) to maintain an organized campaign history and enable easy cross-referencing in advisory reports.

Duration Management: Set explicit duration limits on observation campaigns to prevent resource accumulation. A 30-day campaign with explicit renewal is preferable to an indefinite campaign that may be forgotten.

Correlation Model Selection: Choose analysis models appropriate to the observation target. Use behavioral-drift for long-running campaigns monitoring gradual changes, anomaly for detecting sudden deviations, and composite for multi-dimensional analysis.

Handoff Discipline: Always review advisory briefs before initiating automated handoffs. While auto-handoff is supported, the intelligence products from Matylda often benefit from human contextual interpretation before action.

Evidence Chain Preservation: When using advisory outputs for decision-making, preserve the full evidence chain by using the --verbose flag. This supports post-decision audit and aligns with the NABLA Infinity provenance axiom.

Error Handling

Error Condition	Response	Recovery
Insufficient authority (below L3)	Permission denied with authority requirements	Request L3 access through standard escalation
Campaign name conflict	Duplicate campaign error with existing campaign details	Choose a unique campaign name or resume existing
Sensor deployment failure	Warning with degraded mode indicator (partial observation)	System auto-retries; manual sensor selection available
Analysis engine overload	Backpressure applied to observation pipeline	Reduce campaign scope or increase analysis window
Handoff target unavailable	Advisory queued with retry schedule	System retries at increasing intervals; manual handoff available
Observation data insufficient	Advisory generation deferred with data sufficiency estimate	Continue observation until minimum data threshold met

Advanced Usage

Long-Duration Campaigns

For strategic intelligence requirements spanning weeks or months, configure persistent campaigns with checkpoint-based state management:

# Start a 90-day strategic observation campaign
/matylda --campaign="strategic-landscape-2026" --duration=90d --checkpoint=daily

# Generate weekly rolling advisories
/matylda --campaign="strategic-landscape-2026" --advisory --period=7d --recurring=weekly

Multi-Target Correlation

Observe multiple targets simultaneously and correlate findings across them:

# Multi-target observation
/matylda --target=target-a.com,target-b.com,target-c.com --correlate=cross-target

# Generate comparative risk assessment
/matylda --forecast --compare-targets

Integration with Investigation Commands

Chain Matylda observations with active investigation commands for a passive-first workflow:

# Matylda first, then targeted investigation
/matylda --target=example.com --advisory --format=json | /investigate --from-advisory

Doctrine Compliance

All commands operate under the NO MERCY, NO DOUBTS doctrine:

NO MERCY: Zero tolerance for incomplete observation data or unsupported advisory claims. Every advisory must include a complete evidence chain, confidence score, and provenance trail. Advisories that fail quality validation are blocked from handoff.
NO DOUBTS: Full investigation of all observation anomalies before escalation. Risk forecasts must be supported by multiple independent signal sources in accordance with the NABLA Infinity Signal Plurality axiom. The system explicitly tracks and reports uncertainty rather than presenting false confidence.

The passive observation methodology of Matylda directly supports the NO DOUBTS principle by accumulating evidence over time before producing conclusions, ensuring that advisories are grounded in substantive observation rather than premature analysis.

/investigate - Launch comprehensive OSINT investigation across 121+ sources
/email-osint - Email-based OSINT gathering with breach correlation and social profiling
/google-hacking - Google dorking and advanced search intelligence extraction
/agents - List and manage agent ecosystem with status monitoring
/commit - Smart commit with quality gates and conventional format
/connect - MCP server connection management across 14+ servers

Connect & Contribute

Created by Tomáš Korcak (korczis) | Open Source under GHL

GitHub | GitLab | LinkedIn | Contact
Developer Portal | Architecture | Meet the Creator

/matylda