skill-guard

Runtime security monitoring observes active skills by logging their file access, network calls, and shell commands, then comparing these actions against predefined security rules and declared permission boundaries to flag anomalous behavior.

You detect unauthorized file access and suspicious network activity by monitoring active skills and enforcing predefined security rules that flag any deviations from expected operational patterns and declared permission boundaries.

Yes, runtime anomaly detection prevents shell command abuse by continuously monitoring shell commands executed by active skills, comparing them against predefined security rules, and flagging deviations from expected operational patterns.

Yes, you can use it to monitor the runtime behavior of a data processing skill by enforcing its declared permission boundaries and immediately alerting on any file access violations during execution.

The primary limitation is that effective runtime monitoring requires detailed logging of all active skill actions, meaning any behavior bypassing logging or lacking predefined security rules and expected operational patterns may not be flagged.