メニュー
ANALYZE: severity scoring against the baseline and profile, so the report leads with what actually matters on THIS machine.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
OBSERVE: claude-watchman's OWN collected-data footprint (journal DB, run log, cost ledger, backups, monitor-state) against retention windows. Read-only — surfaces a prune finding; never deletes.
ANALYZE: snapshot the machine's normal outbound connections to a baseline file, so the loop can flag NEW connections to NEW destinations as deltas.
ACT: propose or apply remediation, STRICTLY bounded by each finding's risk_tier, and update the journal. The fixer — where the Prime Directive governs most directly.
claude-watchman operator commands — run IN a Claude Code session so token use is visible. Modes: audit | report | status | loop | monitor | fix | inventory | stats. (selfcheck and preflight are zero-token bash — run those with the `watchman` shell CLI, not here.)
EXPRESS: a plain-language report of the last monitoring run for a NON-TECHNICAL reader — when it ran, a brief overview of what happened, expanding on any important issues or warnings, plus recent-run context. Read-only.
OBSERVE: run the profile-appropriate security audit by wrapping Lynis, fold warnings/suggestions into the journal, and track the hardening index over time.
| name | prioritize-redflags |
| description | ANALYZE: severity scoring against the baseline and profile, so the report leads with what actually matters on THIS machine. |
| lane | coding |
| allowed-tools | Read, Glob, Grep, Bash |
Orders the journal by what matters here. Raw severity is not enough: the same
finding ranks differently on a public server than a workstation, and a regression
outranks a long-standing known issue. Produces the ranking the report leads with.
Its only writes are routine journal updates through lib/journal.sh.
PRIME DIRECTIVE (outranks everything below). Do nothing destructive. If any action would delete or overwrite a file or directory, modify a database in any way, sever access (firewall/SSH/auth), or stop/remove a service or package — STOP, WARN the operator in plain language why it is destructive, and ASK for explicit per-action permission before proceeding. In the unattended loop there is no one to ask, so the action does not happen: record it and surface it instead. The only non-destructive database operation is routine create-or-update through lib/journal.sh. This rule has no exceptions and no mode that overrides it.
After correlate-findings, before report-status/send-report.
bash lib/wm <function> [args…] — which sources the libs under bash internally; never source lib/… directly (dontAsk refuses a dot-source). Initialize with bash lib/wm journal_init.open/regressed finding from: base severity, profile weight
(bash lib/wm profile_severity for its check_id), status (regressed gets a boost — a fix
that came back is urgent), category, and exposure (a security finding on a
public-facing server outranks the same on a workstation).bash lib/wm profile_severity says a
check carries a different weight here than its default, update the finding's
severity via lib/journal.sh so the report and thresholds agree.report-status/send-report to consume (highest first).lib/profile.sh — profile_severity, profile exposure weighting (reached via bash lib/wm <function>).lib/journal.sh — finding reads and severity updates (reached via bash lib/wm <function>).correlate-findings — supplies the delta this ranking emphasizes.