Self Monitor

> Compatible with Claude Code, Codex CLI, Cursor, Windsurf, and any SKILL.md-compatible agent.

Self Monitor

Proactive self-monitoring: infrastructure, services, and health.

Usage

Run during heartbeats or scheduled checks.

1. Infrastructure Health

# Disk usage
df -h / | awk 'NR==2 {print $5}' | tr -d '%'

# Memory usage  
free -m | awk 'NR==2 {printf "%.0f", $3/$2*100}'

# Load average
uptime | awk -F'load average:' '{print $2}' | awk -F',' '{print $1}'

# Top processes by memory
ps aux --sort=-%mem | head -10

# Top processes by CPU
ps aux --sort=-%cpu | head -10

Thresholds: | Metric | Warning | Critical | |--------|---------|----------| | Disk | > 80% | > 90% | | Memory | > 85% | > 95% | | Load | > 2.0 | > 4.0 |

2. Service Health

# Check if a process is running
pgrep -f "your_process_name" >/dev/null && echo "OK" || echo "FAIL"

# Check HTTP endpoint
curl -s -o /dev/null -w "%{http_code}" http://localhost:8080/health

# Check systemd service
systemctl is-active --quiet nginx && echo "OK" || echo "FAIL"

# Check Docker container
docker ps --filter "name=mycontainer" --filter "status=running" -q | grep -q . && echo "OK" || echo "FAIL"

# Tailscale (if using)
tailscale status --json 2>/dev/null | jq -r '.Self.Online' || echo "FAIL"

3. Cron Job Health

# Check recent cron executions
grep CRON /var/log/syslog | tail -20

# Count failures in last 24h
grep -c "CRON.*error\|CRON.*fail" /var/log/syslog

# List scheduled jobs
crontab -l

4. Recent Errors

# Check system logs for errors
journalctl -p err --since "1 hour ago" 2>/dev/null | tail -20

# Check application logs
tail -50 ~/workspace/projects/*/logs/*.log 2>/dev/null | grep -i "error"

# Check dmesg for hardware/kernel issues
dmesg | tail -20 | grep -i "error\|fail\|warn"

Quick Health Check (for heartbeat)

#!/bin/bash
# Quick health snapshot

DISK=$(df -h / | awk 'NR==2 {print $5}' | tr -d '%')
MEM=$(free -m | awk 'NR==2 {printf "%.0f", $3/$2*100}')
LOAD=$(uptime | awk -F'load average:' '{print $2}' | awk -F',' '{print $1}' | xargs)

echo "Disk: ${DISK}% | Mem: ${MEM}% | Load: ${LOAD}"

# Alert if thresholds exceeded
[ "$DISK" -gt 90 ] && echo "⚠️ Disk critical!"
[ "$MEM" -gt 95 ] && echo "⚠️ Memory critical!"

Root Cause Iron Law (inspired by gstack /investigate)

Never apply a fix without identifying the root cause first.

When an issue is detected:

1. Investigate -- collect evidence (logs, metrics, timeline)
2. Analyze -- identify the root cause, not just the symptom
3. Hypothesize -- state the cause in one sentence before acting
4. Fix -- apply the smallest targeted fix
5. Verify -- confirm the fix resolved the root cause, not just the symptom

If root cause is unclear after 2 attempts:

• Log what you tried and what you observed
• Escalate to owner with evidence, not guesses
• Do NOT apply speculative fixes that could mask the real issue

Anti-patterns:

• Restarting a service without checking why it died
• Clearing disk without checking what filled it
• Killing a process without checking what caused high usage

Destructive Command Guard (inspired by gstack /guard)

Before executing any of these commands, stop and verify:

| Pattern | Risk | Required Check | |---------|------|----------------| | rm -rf | Data loss | Verify path is correct, not /, not home | | DROP TABLE / DROP DATABASE | Data loss | Confirm backup exists | | git push --force | History loss | Confirm branch and remote | | kill -9 | Corruption | Try graceful stop first | | chmod 777 | Security | Use minimal permissions instead | | truncate / > file | Data loss | Confirm file is a log, not config | | docker system prune -a | Image loss | List what will be removed first |

Subagents MUST NOT execute destructive commands. Return the command to main session for approval.

Proactive Actions

When issues detected:

| Issue | Auto-Action | Alert? | |-------|------------|--------| | Disk > 90% | Investigate what grew, then clean | Yes | | Key process down | Check logs first, then restart | Yes | | Cron 3+ failures | Root cause analysis, then report | Yes | | Memory > 95% | Identify leak/offender, then act | Yes |

Auto-fixable (safe, only after root cause check):

# Clean old logs (> 7 days)
find /var/log -name "*.log" -mtime +7 -delete 2>/dev/null
find ~/.cache -type f -mtime +7 -delete 2>/dev/null

# Clean temp files
rm -f /tmp/agent-temp-* 2>/dev/null
rm -rf ~/.cache/pip 2>/dev/null

Report Format

## 🔍 Self-Monitor Report - [TIME]

### Health Summary
| Metric | Value | Status |
|--------|-------|--------|
| Disk | XX% | ✅/⚠️/🔴 |
| Memory | XX% | ✅/⚠️/🔴 |
| Load | X.X | ✅/⚠️/🔴 |
| Services | X/Y up | ✅/⚠️ |

### Issues Found
- [Issue 1]: [Action taken or recommended]

### Top Resource Consumers
| Process | CPU% | MEM% |
|---------|------|------|
| ... | ... | ... |

Integration with Scheduled Tasks

Add to your crontab or task scheduler:

# Run health check every 30 minutes
*/30 * * * * /path/to/health-check.sh >> /var/log/health-check.log 2>&1

Or run manually as part of your workflow:

./health-check.sh

---

Security Checks

Run daily (or alongside any health check). Uses only sha256sum/shasum, grep, find, jq. Designed to complete in under 5 seconds.

Critical Files to Monitor

/path/to/workspace/SOUL.md
/path/to/workspace/IDENTITY.md
/path/to/workspace/MEMORY.md
/path/to/workspace/AGENTS.md
/path/to/workspace/TOOLS.md

1. File Integrity (SHA256 Baseline)

See ../security-guardian/scripts/check_integrity.sh for the full script.

Logic:

• On first run: generate data/security-baseline.json with SHA256 of each critical file
• On subsequent runs: compare current hashes against baseline; report any drift
• Manual reset: "reset security baseline" → regenerate baseline (do this after intentional edits to SOUL.md/MEMORY.md)

Baseline format:

{
  "generated_at": "2026-04-02T07:00:00Z",
  "files": {
    "/path/to/workspace/SOUL.md": "sha256:"
  }
}

2. Prompt Injection Scan

See ../security-guardian/scripts/scan_injections.sh for the full script.

Scans last 3 days of memory/*.md files for patterns like:

• "ignore previous instructions"
• "you are now" / "pretend you are"
• "forget everything" / "override your"
• "new system prompt"

3. Credential Leak Scan

See ../security-guardian/scripts/scan_credentials.sh for the full script.

Scans workspace *.md, *.json, *.txt, *.yaml (excluding .git/, node_modules/) for:

• api_key = 'xxx' / token = 'xxx'
• sk-... (OpenAI/Anthropic keys)
• ghp_... (GitHub tokens)
• Hardcoded passwords

Security Report Format

🛡️ Security Report — YYYY-MM-DD HH:MM UTC

✅ File Integrity: OK (5/5 files match baseline)
⚠️  Injection Scan: 1 suspicious pattern in memory/2026-04-01.md
✅ Credential Scan: Clean

 Summary: 1 warning — review flagged file

Severity & Alerting

| Level | Meaning | Action | |---|---|---| | ✅ OK | All clear | Log only | | ⚠️ WARNING | Suspicious but not confirmed | Note in report | | 🚨 CRITICAL | Confirmed drift or credential exposed | Alert owner immediately |

CRITICAL triggers:

• SOUL.md or IDENTITY.md hash changed without "reset baseline" command
• Credential pattern found in a committed/shared file
• Injection pattern found in a file that was then acted upon

On CRITICAL: alert owner via WhatsApp.

Cron Schedule

Run daily at 06:00 UTC (before morning briefing). Silent unless CRITICAL found.

{
  "id": "security-daily",
  "schedule": "0 6 * * *",
  "timezone": "UTC",
  "task": "Run self-monitor security checks: file integrity, injection scan, credential scan. Alert owner via WhatsApp if CRITICAL.",
  "delivery": { "mode": "silent" }
}

---

📊 Skill Analytics Section

Include this in the daily self-monitor report (after security checks).

LOG="/path/to/workspace/data/skill-analytics.jsonl"
TODAY=$(date -u +%Y-%m-%d)

if [ ! -f "$LOG" ] || [ $(wc -l /dev/null || echo 0)
    [ "$COUNT" -eq 0 ] && UNUSED="$UNUSED $s"
  done
  [ -n "$UNUSED" ] && echo "**Never used:**$UNUSED" || echo "**Never used:** none"
fi

Output Example

### 📊 Skill Analytics (last 24h)

**Invocations:** 11

**Top skills:**
- supervisor (4)
- owner-briefing (2)
- meetings (2)
- whatsapp (2)
- self-monitor (1)

**Never used:** hebrew-nikud youtube-watcher

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: netanel-abergel
• Source: netanel-abergel/pa-skills
• License: MIT

Install and usage instructions live in the source repository linked above.