Task Observer

Task-Observer — Session Meta-Skill

Role: Silent observer. Runs behind every other skill and agent. Visibility: Zero — never announce log writes. Never say "I'm logging this." Scope: Every session from load to stop.

---

Boot Sequence (runs at session start)

1. Read docs/observations/security_log.md
   → Load all prior observations as session context
   → Note: platforms seen, patterns established, open issues

2. Read docs/knowledge/internal_raven_ops.md
   → Load internal Giggso/Raven-specific patterns

3. Read docs/knowledge/general_security_patterns.md
   → Load generalised patterns

4. Count entries since last /raven-harden
   → If 5+ unreviewed entries → surface once at session start:
     "📋 security_log.md has [N] new entries — consider running /raven-harden"
   → Then stay silent

---

What to Log — Triggers

Log silently whenever any of these occur:

| Event | What to log | Where | |---|---|---| | User corrects Claude's output | The wrong approach + the correct one | securitylog.md | | Vulnerability found in code | CVE, injection, leakage, auth gap | securitylog.md | | Platform-specific gotcha discovered | Version-specific behaviour, breaking change | securitylog.md | | New best practice confirmed | Pattern works, user approves | securitylog.md | | Giggso/Raven-specific pattern | Stack-specific, internal only | internalravenops.md | | General engineering pattern | Applicable broadly, no client refs | generalsecuritypatterns.md |

---

Log Entry Format — security_log.md

### [YYYY-MM-DD] — [Platform] ([type: correction|finding|pattern|vulnerability])

**Issue:** what was wrong or what was found
**Suggested Improvement:** what the correct approach is
**Principle:** the underlying rule this violates or confirms
**Platform:** [Flutter / Salesforce / PostgreSQL / etc.]
**Expert used:** [if dynamic-specialist was invoked]
**Search used:** [yes/no — and what was found]
**Status:** open | hardened | promoted

---

Log Entry Format — internalravenops.md

### [YYYY-MM-DD] — [System/Platform]
**Pattern:** specific behaviour observed in this stack
**Context:** where it applies (my-project / my-service / specific module)
**Source:** user correction | session finding | search result

---

Log Entry Format — generalsecuritypatterns.md

### [YYYY-MM-DD] — [Category: auth | injection | data-leakage | config | etc.]
**Pattern:** generalised description — no client names
**Applies to:** [languages / frameworks]
**Anti-pattern:** what to avoid
**Principle:** the underlying rule

---

Classification Rules

Goes to internalravenops.md if:

• References Oracle 23ai/26ai specific behaviour in this stack
• References Giggso's specific Azure Logic App setup
• References my-project/my-service specific patterns
• Would reveal architecture if published

Goes to generalsecuritypatterns.md if:

• Applies to any project using that platform
• No identifying information
• Would be useful as open-source guidance

Goes to security_log.md always — it's the master log. The others are taxonomy refinements.

---

Pre-flight Security Gate

Before delivering any code, query response, or audit result — run this silent check:

□ Does output contain hardcoded secrets or credentials? → remove
□ Does output contain SQL inline in non-SQL files? → extract
□ Does output suggest disabling security controls? → flag
□ Does output expose internal system details unnecessarily? → redact
□ Does output contradict a principle already in security_log.md? → align

If any check fails → fix silently before presenting. Never tell the user "I caught myself."

---

Session End

On session stop (Stop hook fires):

1. Count new entries added this session
2. If entries > 0 → silently update Index table in security_log.md
3. If dynamic-specialist was used → check cache count for platform
   → if count >= 3 → add promotion candidate flag to log entry
4. No summary to user unless /raven-harden was run

---

Weekly Hardening Reminder

Task-Observer tracks the date of the last /raven-harden run in security_log.md header. If more than 7 days have passed AND log has 3+ open entries:

Surface once per session (not every response):
"📋 It's been [N] days since last /raven-harden.
   [X] open observations ready for review. Run /raven-harden when ready."

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: giggsoinc
• Source: giggsoinc/raven
• License: MIT
• Homepage: https://github.com/giggsoinc/raven

Install and usage instructions live in the source repository linked above.