Menu
EXPRESS: a human-readable summary of journal state — open, regressed, fixed, ignored — leading with what matters most. Read-only.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
OBSERVE: claude-watchman's OWN collected-data footprint (journal DB, run log, cost ledger, backups, monitor-state) against retention windows. Read-only — surfaces a prune finding; never deletes.
ANALYZE: snapshot the machine's normal outbound connections to a baseline file, so the loop can flag NEW connections to NEW destinations as deltas.
ACT: propose or apply remediation, STRICTLY bounded by each finding's risk_tier, and update the journal. The fixer — where the Prime Directive governs most directly.
claude-watchman operator commands — run IN a Claude Code session so token use is visible. Modes: audit | report | status | loop | monitor | fix | inventory | stats. (selfcheck and preflight are zero-token bash — run those with the `watchman` shell CLI, not here.)
EXPRESS: a plain-language report of the last monitoring run for a NON-TECHNICAL reader — when it ran, a brief overview of what happened, expanding on any important issues or warnings, plus recent-run context. Read-only.
OBSERVE: run the profile-appropriate security audit by wrapping Lynis, fold warnings/suggestions into the journal, and track the hardening index over time.
| name | report-status |
| description | EXPRESS: a human-readable summary of journal state — open, regressed, fixed, ignored — leading with what matters most. Read-only. |
| lane | coding |
| allowed-tools | Read, Glob, Grep, Bash |
Turns the journal into something a person can act on. Reads the journal and prints
a plain-language summary, led by the prioritize-redflags ranking. Strictly
read-only — it makes no changes and sends no mail (that is send-report).
PRIME DIRECTIVE (outranks everything below). Do nothing destructive. If any action would delete or overwrite a file or directory, modify a database in any way, sever access (firewall/SSH/auth), or stop/remove a service or package — STOP, WARN the operator in plain language why it is destructive, and ASK for explicit per-action permission before proceeding. In the unattended loop there is no one to ask, so the action does not happen: record it and surface it instead. The only non-destructive database operation is routine create-or-update through lib/journal.sh. This rule has no exceptions and no mode that overrides it.
/watchman report, and as the body builder for send-report.
bash lib/wm <function> [args…] — which sources the libs under bash internally; never source lib/… directly (dontAsk refuses a dot-source). Initialize with bash lib/wm journal_init.lib/journal.sh only (bash lib/wm journal_list, counts). Group
by status: regressed first (loudest), then open by priority, then a tally
of fixed/ignored.lynis_hardening_index and its
direction since last run, and the regression count.lib/journal.sh — journal_list, journal_count_open, journal_count_regressed, metric reads (reached via bash lib/wm <function>).prioritize-redflags — supplies the ordering.send-report — wraps this output for email.