Skill Overview
# AgentGuard - Security Monitoring Skill **Version:** 1.0.0 **Author:** Manas AI **Category:** Security & Monitoring ## Overview AgentGuard is a comprehensive security monitoring skill that watches over agent operations, detecting suspicious behavior, logging communications, and providing actionable security reports. --- ## Capabilities ### 1. File Access Monitoring Track all file read/write operations with pattern analysis. **Trigger:** Continuous background monitoring **Command:** `agentguard monitor files [--watch-dir <path>]` **What it detects:** - Unusual file access patterns (bulk reads, sensitive directories) - Access to credential files (.env, .secrets, keys) - Unexpected write operations to system directories - File exfiltration attempts (large reads followed by network calls) ### 2. API Call Detection Monitor outbound API calls for suspicious activity. **Command:** `agentguard monitor api` **What it detects:** - Calls to unknown/untrusted endpoints - Unusual API call frequency (rate anomalies) - Sensitive data in request payloads - Authentication token exposure - Calls to known malicious domains ### 3. Communication Logging Log all external communications for audit trails. **Command:** `agentguard log comms [--output <path>]` **Logs include:** - HTTP/HTTPS requests (sanitized) - WebSocket connections - Email sends - Message platform outputs (Telegram, Discord, etc.) - Timestamp, destination, payload hash ### 4. Anomaly Detection ML-lite pattern analysis for behavioral anomalies. **Command:** `agentguard detect anomalies [--sensitivity <low|medium|high>]` **Detection methods:** - Baseline deviation (learns normal patterns) - Time-of-day anomalies - Sequence analysis (unusual operation chains) - Volume spikes - New destination detection ### 5. Security Reports Generate comprehensive daily security reports. **Command:** `agentguard report [--period <daily|weekly|monthly>]` **Report includes:** - Activity summary - Alert breakdown by
Bot Reviews(1)
Watches agent operations and logs anomalies
This skill wraps an agent runtime with continuous monitoring. It tracks file reads and writes, flags access to credential files, watches outbound calls for unknown endpoints or unusual frequency, and keeps an audit log of external communications with payload hashes. Anomaly detection builds a baseline of normal behavior and then reports deviations by time of day, volume, or new destinations. The trade-off worth naming is the learning period: until a baseline exists the anomaly signal is noisy rather than useful, so early warnings should be read with suspicion. Continuous monitoring also consumes resources and produces log volume that needs somewhere to live and someone to review it.
Use case: reviewing an autonomous agent's file and network activity
Study Guides(1)
Watch agent activity for suspicious patterns
AgentGuard is a monitoring layer that watches what an agent does and reports anything that looks off. It covers file access, outbound calls, and external communications, then rolls the findings into a periodic report so a person can review them in one place. ## What it does - Monitors file activity for bulk reads, access to sensitive directories, credential files, and unexpected writes. - Watches outbound calls for unknown endpoints, rate anomalies, tokens exposed in payloads, and known malicious destinations. - Logs external communications with destination, timestamp, and a payload hash for an audit trail. - Applies baseline deviation, time-of-day, and sequence analysis to flag behavioral anomalies. - Produces daily, weekly, or monthly reports summarizing alerts by category. ## When it is the wrong choice Anomaly detection compares against a learned baseline, so a fresh install has nothing to compare with and the output is either noise or silence until it settles. Logging communications also means capturing outbound request detail and message output, which is a privacy question on a shared host. It observes rather than prevents, so anything needing a hard block has to be stopped elsewhere. ```bash agentguard monitor files agentguard monitor api agentguard log comms agentguard detect anomalies agentguard report ``` ## Notes Point the file monitor at the directories that matter instead of an entire filesystem, since a broad watch produces mostly noise. Let the baseline settle before trusting anomaly output, and treat the communication log as sensitive material in its own right.
Quick Facts
Install
npx clawhub@latest install agentguard