Menu
ANALYZE: the delta engine. Dedup is automatic via the fingerprint; this computes what CHANGED since the last run — new high-severity findings and regressions — and writes a run summary.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
OBSERVE: claude-watchman's OWN collected-data footprint (journal DB, run log, cost ledger, backups, monitor-state) against retention windows. Read-only — surfaces a prune finding; never deletes.
ANALYZE: snapshot the machine's normal outbound connections to a baseline file, so the loop can flag NEW connections to NEW destinations as deltas.
ACT: propose or apply remediation, STRICTLY bounded by each finding's risk_tier, and update the journal. The fixer — where the Prime Directive governs most directly.
claude-watchman operator commands — run IN a Claude Code session so token use is visible. Modes: audit | report | status | loop | monitor | fix | inventory | stats. (selfcheck and preflight are zero-token bash — run those with the `watchman` shell CLI, not here.)
EXPRESS: a plain-language report of the last monitoring run for a NON-TECHNICAL reader — when it ran, a brief overview of what happened, expanding on any important issues or warnings, plus recent-run context. Read-only.
OBSERVE: run the profile-appropriate security audit by wrapping Lynis, fold warnings/suggestions into the journal, and track the hardening index over time.
| name | correlate-findings |
| description | ANALYZE: the delta engine. Dedup is automatic via the fingerprint; this computes what CHANGED since the last run — new high-severity findings and regressions — and writes a run summary. |
| lane | coding |
| allowed-tools | Read, Glob, Grep, Bash |
The engine of the loop. The loop's value is noticing change, not re-reporting
steady state. Deduplication is already guaranteed by the fingerprint upsert in
lib/journal.sh; this skill computes the delta against the previous run and
records a run summary the loop uses to decide whether to email.
PRIME DIRECTIVE (outranks everything below). Do nothing destructive. If any action would delete or overwrite a file or directory, modify a database in any way, sever access (firewall/SSH/auth), or stop/remove a service or package — STOP, WARN the operator in plain language why it is destructive, and ASK for explicit per-action permission before proceeding. In the unattended loop there is no one to ask, so the action does not happen: record it and surface it instead. The only non-destructive database operation is routine create-or-update through lib/journal.sh. This rule has no exceptions and no mode that overrides it.
After the observe skills in every /watchman audit / /watchman loop, before
send-report/report-status.
bash lib/wm <function> [args…] — which sources the libs under bash internally; never source lib/… directly (dontAsk refuses a dot-source). Initialize with bash lib/wm journal_init.last_seen_at / the prior
runs row as the boundary). The signal events, per profile:
regressed findings (a fix that came back) and newly-open
findings at/above the notify severity;inspect-logs against the baseline-network snapshot, plus log-retention regressions.fixed→regressed transition (already set by the
journal upsert) is the highest-signal event — count and surface it prominently.bash lib/wm journal_run_start, write a one-line summary
(counts of new/regressed/cleared) with bash lib/wm journal_run_finish. This summary is what
the loop threshold-checks.lib/journal.sh.lib/journal.sh — journal_run_start, journal_run_finish, journal_count_open, journal_count_regressed (reached via bash lib/wm <function>).lib/profile.sh — which deltas matter per profile (reached via bash lib/wm <function>).