Cairn AI agent worker tooling: tsec SKILL.md, TSEC env vars, DeepSeek/OpenRouter
Detects host-side telemetry indicating Cairn agent worker artifacts, including specific process command line terms, tsec skill files and environment variables, combined with network connections to OpenRouter from the same host.
Microsoft Sentinel (KQL)

