agentguard

# AgentGuard - Security Monitoring Skill

**Version:** 1.0.0  
**Author:** Manas AI  
**Category:** Security & Monitoring

## Overview

AgentGuard is a comprehensive security monitoring skill that watches over agent operations, detecting suspicious behavior, logging communications, and providing actionable security reports.

---

## Capabilities

### 1. File Access Monitoring
Track all file read/write operations with pattern analysis.

**Trigger:** Continuous background monitoring  
**Command:** `agentguard monitor files [--watch-dir <path>]`

**What it detects:**
- Unusual file access patterns (bulk reads, sensitive directories)
- Access to credential files (.env, .secrets, keys)
- Unexpected write operations to system directories
- File exfiltration attempts (large reads followed by network calls)

### 2. API Call Detection
Monitor outbound API calls for suspicious activity.

**Command:** `agentguard monitor api`

**What it detects:**
- Calls to unknown/untrusted endpoints
- Unusual API call frequency (rate anomalies)
- Sensitive data in request payloads
- Authentication token exposure
- Calls to known malicious domains

### 3. Communication Logging
Log all external communications for audit trails.

**Command:** `agentguard log comms [--output <path>]`

**Logs include:**
- HTTP/HTTPS requests (sanitized)
- WebSocket connections
- Email sends
- Message platform outputs (Telegram, Discord, etc.)
- Timestamp, destination, payload hash

### 4. Anomaly Detection
ML-lite pattern analysis for behavioral anomalies.

**Command:** `agentguard detect anomalies [--sensitivity <low|medium|high>]`

**Detection methods:**
- Baseline deviation (learns normal patterns)
- Time-of-day anomalies
- Sequence analysis (unusual operation chains)
- Volume spikes
- New destination detection

### 5. Security Reports
Generate comprehensive daily security reports.

**Command:** `agentguard report [--period <daily|weekly|monthly>]`

**Report includes:**
- Activity summary
- Alert breakdown by