network-watcher

To audit network permissions, analyze the SKILL.md file for declared endpoints and monitor actual runtime network traffic. This process validates that outbound connections only access legitimate, expected endpoints without attempting unauthorized data transmission.

Before installing a skill requiring network access, auditing its SKILL.md declarations and runtime behavior ensures it only connects to legitimate, expected endpoints. This prevents unauthorized network access and blocks potential data exfiltration vectors proactively.

Yes, runtime monitoring of actual network traffic detects unauthorized API calls by comparing outbound connections against declared endpoints. This identifies suspicious activity and potential exfiltration patterns during skill execution.

Common exfiltration patterns include DNS tunneling to bypass security controls and embedding sensitive data within standard request bodies. Heuristic and explicit safe-pattern checks identify these unauthorized methods of sending sensitive information over the network.

Heuristic checks rely on known exfiltration patterns and explicit safe-pattern rules, potentially missing novel data transmission methods. They require both declared endpoint analysis from SKILL.md and runtime traffic monitoring to maintain detection accuracy.