monitor-security

Continuous Operation (Non-Negotiable)

This skill is always-on. It:

• Runs on its configured schedule indefinitely — it NEVER stops unless explicitly halted by the user
• The agent MUST NOT stop and wait for the human to ask for status or remember to check
• If a cycle fails, diagnose the failure, attempt auto-repair, and continue
• Only escalate to the human if genuinely blocked after exhausting /dogpile research
• Gracefully handles restarts and maintains state across cycles
• Is designed for multi-day/week/month autonomous operation

Anti-pattern: Reporting status and waiting for the human to ask "what next?" is UNACCEPTABLE. The agent must proactively fix issues and continue the monitoring loop.

Architecture

Hourly Threat Intel Loop (:00-:10)
  consume-feed → social-bridge → dogpile (if critical CVE) → threat_intel_digest.json