菜单
ANALYZE: the delta engine. Dedup is automatic via the fingerprint; this computes what CHANGED since the last run — new high-severity findings and regressions — and writes a run summary.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
OBSERVE: claude-watchman's OWN collected-data footprint (journal DB, run log, cost ledger, backups, monitor-state) against retention windows. Read-only — surfaces a prune finding; never deletes.
ANALYZE: snapshot the machine's normal outbound connections to a baseline file, so the loop can flag NEW connections to NEW destinations as deltas.
ACT: propose or apply remediation, STRICTLY bounded by each finding's risk_tier, and update the journal. The fixer — where the Prime Directive governs most directly.
claude-watchman operator commands — run IN a Claude Code session so token use is visible. Modes: audit | report | status | loop | monitor | fix | inventory | stats. (selfcheck and preflight are zero-token bash — run those with the `watchman` shell CLI, not here.)
EXPRESS: a plain-language report of the last monitoring run for a NON-TECHNICAL reader — when it ran, a brief overview of what happened, expanding on any important issues or warnings, plus recent-run context. Read-only.
OBSERVE: run the profile-appropriate security audit by wrapping Lynis, fold warnings/suggestions into the journal, and track the hardening index over time.
基于 SOC 职业分类
| name | correlate-findings |
| description | ANALYZE: the delta engine. Dedup is automatic via the fingerprint; this computes what CHANGED since the last run — new high-severity findings and regressions — and writes a run summary. |
| lane | coding |
| allowed-tools | Read, Glob, Grep, Bash |
The engine of the loop. The loop's value is noticing change, not re-reporting
steady state. Deduplication is already guaranteed by the fingerprint upsert in
lib/journal.sh; this skill computes the delta against the previous run and
records a run summary the loop uses to decide whether to email.
PRIME DIRECTIVE (outranks everything below). Do nothing destructive. If any action would delete or overwrite a file or directory, modify a database in any way, sever access (firewall/SSH/auth), or stop/remove a service or package — STOP, WARN the operator in plain language why it is destructive, and ASK for explicit per-action permission before proceeding. In the unattended loop there is no one to ask, so the action does not happen: record it and surface it instead. The only non-destructive database operation is routine create-or-update through lib/journal.sh. This rule has no exceptions and no mode that overrides it.
After the observe skills in every /watchman audit / /watchman loop, before
send-report/report-status.
bash lib/wm <function> [args…] — which sources the libs under bash internally; never source lib/… directly (dontAsk refuses a dot-source). Initialize with bash lib/wm journal_init.last_seen_at / the prior
runs row as the boundary). The signal events, per profile:
regressed findings (a fix that came back) and newly-open
findings at/above the notify severity;inspect-logs against the baseline-network snapshot, plus log-retention regressions.fixed→regressed transition (already set by the
journal upsert) is the highest-signal event — count and surface it prominently.bash lib/wm journal_run_start, write a one-line summary
(counts of new/regressed/cleared) with bash lib/wm journal_run_finish. This summary is what
the loop threshold-checks.lib/journal.sh.lib/journal.sh — journal_run_start, journal_run_finish, journal_count_open, journal_count_regressed (reached via bash lib/wm <function>).lib/profile.sh — which deltas matter per profile (reached via bash lib/wm <function>).