Purpose

Establish a behavioral baseline for the agent and continuously monitor for deviations that may indicate compromise, misconfiguration, or abuse.

Integration

Always-on monitoring via hooks:

• PostToolUse — log every tool invocation
• UserPromptSubmit — log input patterns
• PostSkillExecution — log skill results

Monitored Metrics

Metric	Baseline Unit	Alert Threshold
Command exec frequency	per hour	>2σ from 7-day avg
File access patterns	unique paths/hour	>2σ
Network request volume	requests/hour	>2σ
Skill invocation frequency	per skill per hour	>2σ
Token consumption rate	tokens/hour	>2σ
Error rate	errors/hour	>2σ
Memory write patterns	writes/hour	>2σ
Cross-session messages	messages/hour	>2σ
New file creation rate	files/hour	>2σ
Unique external domains	domains/hour	>2σ

Anomaly Detection Algorithm

• Collect — append each action to .security/baseline/metrics.jsonl
• Baseline — rolling 7-day average and standard deviation per metric
• Compare — current window (1 hour) vs baseline
• Classify:

- NORMAL — within 1σ - ELEVATED — between 1σ and 2σ - ANOMALOUS — between 2σ and 3σ - CRITICAL — above 3σ or matches known attack signature

• Alert — based on classification

Alert Actions

Classification	Action
NORMAL	No action
ELEVATED	Log to anomaly.jsonl
ANOMALOUS	Log + notify human via preferred channel
CRITICAL	Log + notify + recommend pause (human decides)

Known Attack Signatures

• Sudden spike in file reads across many directories → possible reconnaissance
• Outbound to new external domain + high data volume → possible exfiltration
• Rapid skill installs from ClawHub → possible supply chain attack
• Memory writes with encoded content → possible persistence attempt

Guardrails

• Monitoring is strictly read-only — never modifies agent behavior
• Baseline calibration requires minimum 48 hours of data
• False positives are tracked in .security/false-positives.jsonl
• Baseline resets require human approval
• The watcher itself has no network access (local analysis only)