monitor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited monitor (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Run .skills/scripts/run_monitor.sh from the project root. It starts the bare clawback proxy, captures its combined stdout+stderr to a log file, and follows that log with error-ish lines highlighted.
Capturing both file descriptors (rather than passing --log-file to the proxy) is deliberate: pre-logger startup failures — EADDRINUSE, a missing TLS cert, an upstream self-loop — write to stderr before the logger exists, so they would otherwise vanish. Here they land in the same log.
.skills/scripts/run_monitor.sh # foreground: start proxy + follow logs; Ctrl-C stops both
.skills/scripts/run_monitor.sh --detach # background: start proxy, print PID + log path, exit
.skills/scripts/run_monitor.sh --stop # stop a --detach'd proxy (graceful SIGTERM, then SIGKILL)
.skills/scripts/run_monitor.sh --status # is the --detach'd proxy alive?
.skills/scripts/run_monitor.sh --attach # don't start anything; just follow an existing log fileOnly one mode at a time; default is foreground follow.
--errors-only — while following, surface only warn/error/4xx/5xx/failurelines (everything else is filtered out).
--log-file PATH — log destination (default data/clawback.run.log).--pid-file PATH — pidfile for detach/stop/status (defaultdata/clawback.run.pid).
--no-color — disable ANSI highlighting (also honored: NO_COLOR env, andauto-off when stdout is not a TTY).
-h, --help — show usage.Anything after -- is forwarded verbatim to clawback:
.skills/scripts/run_monitor.sh -- --port 8090 --log-level debug
.skills/scripts/run_monitor.sh --detach -- --passthrough # baseline arm, backgroundedWhen stdout is a color-capable TTY, the follower colors:
[error] lines, unhandled exceptions, Error: stack traces.[warn] lines.→ 4xx / → 5xx request/ping response.A liveness watcher appends a synthetic red line if the proxy process exits on its own, so a crash shows up in the follow stream instead of the log just going quiet (BSD/macOS tail has no --pid).
For an agent, --detach then tail the log path (e.g. with the Monitor tool, filtering on \[error\]|\[warn\]|→ [45][0-9][0-9]|failed) is the cleanest pattern — it doesn't block, and --stop cleans up afterward. --detach refuses to start a second proxy if its pidfile points at a live one; a separate proxy already holding the port surfaces as an EADDRINUSE failure with the last log lines echoed.
./CLAWBACK.md here sets `host:0.0.0.0, so it is LAN-reachable over HTTPS with the self-signed cert; mutating endpoints are adminToken`-gated, GETs are open).
umask 077 (owner-only) — the proxylog can contain captured auth headers / upstream error bodies.
--stop sends SIGTERM first so the proxy flushes state and closes itslogger, escalating to SIGKILL only if it does not exit within ~5s.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.