Anomaly Watcher — Behavioral Baseline Monitor
Purpose
Establish a behavioral baseline for the agent and continuously monitor for deviations that may indicate compromise, misconfiguration, or abuse.
Integration
Always-on monitoring via hooks:
PostToolUse— log every tool invocationUserPromptSubmit— log input patternsPostSkillExecution— log skill results
Monitored Metrics
| Metric | Baseline Unit | Alert Threshold |
|---|---|---|
| Command exec frequency | per hour | >2σ from 7-day avg |
| File access patterns | unique paths/hour | >2σ |
| Network request volume | requests/hour | >2σ |
| Skill invocation frequency | per skill per hour | >2σ |
| Token consumption rate | tokens/hour | >2σ |
| Error rate | errors/hour | >2σ |
| Memory write patterns | writes/hour | >2σ |
| Cross-session messages | messages/hour | >2σ |
| New file creation rate | files/hour | >2σ |
| Unique external domains | domains/hour | >2σ |
Anomaly Detection Algorithm
- Collect — append each action to
.security/baseline/metrics.jsonl - Baseline — rolling 7-day average and standard deviation per metric
- Compare — current window (1 hour) vs baseline
- Classify:
NORMAL— within 1σELEVATED— between 1σ and 2σANOMALOUS— between 2σ and 3σCRITICAL— above 3σ or matches known attack signature
- Alert — based on classification
Alert Actions
| Classification | Action |
|---|---|
| NORMAL | No action |
| ELEVATED | Log to anomaly.jsonl |
| ANOMALOUS | Log + notify human via preferred channel |
| CRITICAL | Log + notify + recommend pause (human decides) |
Known Attack Signatures
- Sudden spike in file reads across many directories → possible reconnaissance
- Outbound to new external domain + high data volume → possible exfiltration
- Rapid skill installs from ClawHub → possible supply chain attack
- Memory writes with encoded content → possible persistence attempt
Guardrails
- Monitoring is strictly read-only — never modifies agent behavior
- Baseline calibration requires minimum 48 hours of data
- False positives are tracked in
.security/false-positives.jsonl - Baseline resets require human approval
- The watcher itself has no network access (local analysis only)