Menu
EXPRESS: email the operator via SMTP when the delta crosses a threshold. A quiet machine sends nothing. Credentials come only from .env via lib/smtp.sh.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
OBSERVE: claude-watchman's OWN collected-data footprint (journal DB, run log, cost ledger, backups, monitor-state) against retention windows. Read-only — surfaces a prune finding; never deletes.
ANALYZE: snapshot the machine's normal outbound connections to a baseline file, so the loop can flag NEW connections to NEW destinations as deltas.
ACT: propose or apply remediation, STRICTLY bounded by each finding's risk_tier, and update the journal. The fixer — where the Prime Directive governs most directly.
claude-watchman operator commands — run IN a Claude Code session so token use is visible. Modes: audit | report | status | loop | monitor | fix | inventory | stats. (selfcheck and preflight are zero-token bash — run those with the `watchman` shell CLI, not here.)
EXPRESS: a plain-language report of the last monitoring run for a NON-TECHNICAL reader — when it ran, a brief overview of what happened, expanding on any important issues or warnings, plus recent-run context. Read-only.
OBSERVE: run the profile-appropriate security audit by wrapping Lynis, fold warnings/suggestions into the journal, and track the hardening index over time.
| name | send-report |
| description | EXPRESS: email the operator via SMTP when the delta crosses a threshold. A quiet machine sends nothing. Credentials come only from .env via lib/smtp.sh. |
| lane | coding |
| allowed-tools | Read, Glob, Grep, Bash |
How a headless, scheduled claude-watchman reaches the operator. Builds the report
(via report-status) and dispatches it only when correlate-findings says the
delta crossed a configured threshold — so the operator hears from the tool only
when something is worth hearing about. Mail credentials live solely in .env and
are read solely by lib/smtp.sh.
PRIME DIRECTIVE (outranks everything below). Do nothing destructive. If any action would delete or overwrite a file or directory, modify a database in any way, sever access (firewall/SSH/auth), or stop/remove a service or package — STOP, WARN the operator in plain language why it is destructive, and ASK for explicit per-action permission before proceeding. In the unattended loop there is no one to ask, so the action does not happen: record it and surface it instead. The only non-destructive database operation is routine create-or-update through lib/journal.sh. This rule has no exceptions and no mode that overrides it.
In /watchman loop, after correlate-findings, gated by the threshold. Not part of
a plain /watchman report (that just prints).
bash lib/wm <function> [args…] — which sources the libs under bash internally; never source lib/… directly (dontAsk refuses a dot-source). Initialize with bash lib/wm journal_init.WATCHMAN_NOTIFY_MIN_SEVERITY, OR a regression occurred and
WATCHMAN_NOTIFY_ON_REGRESSION=yes, OR (workstation) a new outbound destination and
WATCHMAN_NOTIFY_ON_NEW_OUTBOUND=yes. Otherwise send nothing and exit quietly.report-status output. Subject should name the machine and
lead with the headline (e.g. "watchman: 1 REGRESSED, 2 new high on "). When the
loop is driven by the headless schedule (cron/systemd via watchman run) there is
no live token meter, so append the run-cost ledger to the body — run bash lib/wm schedule_ledger_summary and add its output under a "Headless run cost" footer so the
operator still sees what the scheduled passes have spent. (It self-describes as "none
yet" when only the visible tmux /loop is in use, so it is always safe to include.)bash lib/wm send_report "<subject>" <body_file> in lib/smtp.sh. Never read
.env or SMTP creds directly — smtp.sh is the only gate..env missing / SMTP_PASS blank)
or msmtp absent, smtp.sh logs and skips — the loop continues, never crashes.lib/smtp.sh — send_report, smtp_is_configured (the only reader of .env; reached via bash lib/wm <function>).lib/journal.sh — run summary and counts (reached via bash lib/wm <function>).lib/schedule.sh — schedule_ledger_summary (read-only token/cost of headless watchman run passes; reached via bash lib/wm schedule_ledger_summary).config/watchman.conf — notify thresholds.report-status — supplies the email body.