network-watcher

You audit outbound connections by analyzing destination endpoints, ports, and data egress patterns to identify unauthorized API calls and data exfiltration attempts. The network-audit module applies exfiltration heuristics and explicit safe-pattern checks to detect suspicious activity.

Data exfiltration detection scrutinizes network requests to identify data leakage attempts like sending sensitive data via DNS queries or raw IP connections. It evaluates request destinations, tunneling patterns, and data egress risk using endpoint scrutiny and behavioral heuristics.

You check for unauthorized API calls by auditing the skill's declared network endpoints before granting permissions. This process reviews destinations, ports, and tunneling patterns to identify potential security risks like suspicious outbound connections.

Yes, the network-audit module detects DNS tunneling patterns and raw IP connections. It reviews destinations, ports, and data egress risk using endpoint scrutiny and exfiltration heuristics to flag these suspicious outbound activities.

Exfiltration heuristics rely on endpoint scrutiny and explicit safe-pattern checks, meaning they may flag unknown but benign destinations as suspicious. Auditing focuses on declared endpoints and outbound connection patterns rather than decrypting or inspecting encrypted payload contents.