القائمة
EXPRESS: a human-readable summary of journal state — open, regressed, fixed, ignored — leading with what matters most. Read-only.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
OBSERVE: claude-watchman's OWN collected-data footprint (journal DB, run log, cost ledger, backups, monitor-state) against retention windows. Read-only — surfaces a prune finding; never deletes.
ANALYZE: snapshot the machine's normal outbound connections to a baseline file, so the loop can flag NEW connections to NEW destinations as deltas.
ACT: propose or apply remediation, STRICTLY bounded by each finding's risk_tier, and update the journal. The fixer — where the Prime Directive governs most directly.
claude-watchman operator commands — run IN a Claude Code session so token use is visible. Modes: audit | report | status | loop | monitor | fix | inventory | stats. (selfcheck and preflight are zero-token bash — run those with the `watchman` shell CLI, not here.)
EXPRESS: a plain-language report of the last monitoring run for a NON-TECHNICAL reader — when it ran, a brief overview of what happened, expanding on any important issues or warnings, plus recent-run context. Read-only.
OBSERVE: run the profile-appropriate security audit by wrapping Lynis, fold warnings/suggestions into the journal, and track the hardening index over time.
| name | report-status |
| description | EXPRESS: a human-readable summary of journal state — open, regressed, fixed, ignored — leading with what matters most. Read-only. |
| lane | coding |
| allowed-tools | Read, Glob, Grep, Bash |
Turns the journal into something a person can act on. Reads the journal and prints
a plain-language summary, led by the prioritize-redflags ranking. Strictly
read-only — it makes no changes and sends no mail (that is send-report).
PRIME DIRECTIVE (outranks everything below). Do nothing destructive. If any action would delete or overwrite a file or directory, modify a database in any way, sever access (firewall/SSH/auth), or stop/remove a service or package — STOP, WARN the operator in plain language why it is destructive, and ASK for explicit per-action permission before proceeding. In the unattended loop there is no one to ask, so the action does not happen: record it and surface it instead. The only non-destructive database operation is routine create-or-update through lib/journal.sh. This rule has no exceptions and no mode that overrides it.
/watchman report, and as the body builder for send-report.
bash lib/wm <function> [args…] — which sources the libs under bash internally; never source lib/… directly (dontAsk refuses a dot-source). Initialize with bash lib/wm journal_init.lib/journal.sh only (bash lib/wm journal_list, counts). Group
by status: regressed first (loudest), then open by priority, then a tally
of fixed/ignored.lynis_hardening_index and its
direction since last run, and the regression count.lib/journal.sh — journal_list, journal_count_open, journal_count_regressed, metric reads (reached via bash lib/wm <function>).prioritize-redflags — supplies the ordering.send-report — wraps this output for email.