Anomaly Watcher — Behavioral Baseline Monitor#

Purpose#

Establish a behavioral baseline for the agent and continuously monitor for deviations that may indicate compromise, misconfiguration, or abuse.

Integration#

Always-on monitoring via hooks:

• PostToolUse — log every tool invocation
• UserPromptSubmit — log input patterns
• PostSkillExecution — log skill results

Monitored Metrics#

MetricBaseline UnitAlert ThresholdCommand exec frequencyper hour>2σ from 7-day avgFile access patternsunique paths/hour>2σNetwork request volumerequests/hour>2σSkill invocation frequencyper skill per hour>2σToken consumption ratetokens/hour>2σError rateerrors/hour>2σMemory write patternswrites/hour>2σCross-session messagesmessages/hour>2σNew file creation ratefiles/hour>2σUnique external domainsdomains/hour>2σ

Anomaly Detection Algorithm#

1. Collect — append each action to .security/baseline/metrics.jsonl

2. Baseline — rolling 7-day average and standard deviation per metric

3. Compare — current window (1 hour) vs baseline

4. Classify:

   • NORMAL — within 1σ
   • ELEVATED — between 1σ and 2σ
   • ANOMALOUS — between 2σ and 3σ
   • CRITICAL — above 3σ or matches known attack signature

5. Alert — based on classification

Alert Actions#

ClassificationActionNORMALNo actionELEVATEDLog to anomaly.jsonlANOMALOUSLog + notify human via preferred channelCRITICALLog + notify + recommend pause (human decides)

Known Attack Signatures#

• Sudden spike in file reads across many directories → possible reconnaissance
• Outbound to new external domain + high data volume → possible exfiltration
• Rapid skill installs from ClawHub → possible supply chain attack
• Memory writes with encoded content → possible persistence attempt

Guardrails#

• Monitoring is strictly read-only — never modifies agent behavior
• Baseline calibration requires minimum 48 hours of data
• False positives are tracked in .security/false-positives.jsonl
• Baseline resets require human approval
• The watcher itself has no network access (local analysis only)