Menu
ANALYZE: severity scoring against the baseline and profile, so the report leads with what actually matters on THIS machine.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
OBSERVE: claude-watchman's OWN collected-data footprint (journal DB, run log, cost ledger, backups, monitor-state) against retention windows. Read-only — surfaces a prune finding; never deletes.
ANALYZE: snapshot the machine's normal outbound connections to a baseline file, so the loop can flag NEW connections to NEW destinations as deltas.
ACT: propose or apply remediation, STRICTLY bounded by each finding's risk_tier, and update the journal. The fixer — where the Prime Directive governs most directly.
claude-watchman operator commands — run IN a Claude Code session so token use is visible. Modes: audit | report | status | loop | monitor | fix | inventory | stats. (selfcheck and preflight are zero-token bash — run those with the `watchman` shell CLI, not here.)
EXPRESS: a plain-language report of the last monitoring run for a NON-TECHNICAL reader — when it ran, a brief overview of what happened, expanding on any important issues or warnings, plus recent-run context. Read-only.
OBSERVE: run the profile-appropriate security audit by wrapping Lynis, fold warnings/suggestions into the journal, and track the hardening index over time.
| name | prioritize-redflags |
| description | ANALYZE: severity scoring against the baseline and profile, so the report leads with what actually matters on THIS machine. |
| lane | coding |
| allowed-tools | Read, Glob, Grep, Bash |
Orders the journal by what matters here. Raw severity is not enough: the same
finding ranks differently on a public server than a workstation, and a regression
outranks a long-standing known issue. Produces the ranking the report leads with.
Its only writes are routine journal updates through lib/journal.sh.
PRIME DIRECTIVE (outranks everything below). Do nothing destructive. If any action would delete or overwrite a file or directory, modify a database in any way, sever access (firewall/SSH/auth), or stop/remove a service or package — STOP, WARN the operator in plain language why it is destructive, and ASK for explicit per-action permission before proceeding. In the unattended loop there is no one to ask, so the action does not happen: record it and surface it instead. The only non-destructive database operation is routine create-or-update through lib/journal.sh. This rule has no exceptions and no mode that overrides it.
After correlate-findings, before report-status/send-report.
bash lib/wm <function> [args…] — which sources the libs under bash internally; never source lib/… directly (dontAsk refuses a dot-source). Initialize with bash lib/wm journal_init.open/regressed finding from: base severity, profile weight
(bash lib/wm profile_severity for its check_id), status (regressed gets a boost — a fix
that came back is urgent), category, and exposure (a security finding on a
public-facing server outranks the same on a workstation).bash lib/wm profile_severity says a
check carries a different weight here than its default, update the finding's
severity via lib/journal.sh so the report and thresholds agree.report-status/send-report to consume (highest first).lib/profile.sh — profile_severity, profile exposure weighting (reached via bash lib/wm <function>).lib/journal.sh — finding reads and severity updates (reached via bash lib/wm <function>).correlate-findings — supplies the delta this ranking emphasizes.