llm-security/commands/watch.md
Kjell Tore Guttormsen f153f969a0 feat(ultraplan-local): v1.6.0 — /ultraresearch-local deep research command
Add /ultraresearch-local for structured research combining local codebase
analysis with external knowledge via parallel agent swarms. Produces research
briefs with triangulation, confidence ratings, and source quality assessment.

New command: /ultraresearch-local with modes --quick, --local, --external, --fg.
New agents: research-orchestrator (opus), docs-researcher, community-researcher,
security-researcher, contrarian-researcher, gemini-bridge (all sonnet).
New template: research-brief-template.md.

Integration: --research flag in /ultraplan-local accepts pre-built research
briefs (up to 3), enriches the interview and exploration phases. Planning
orchestrator cross-references brief findings during synthesis.

Design principle: Context Engineering — right information to right agent at
right time. Research briefs are structured artifacts in the pipeline:
ultraresearch → brief → ultraplan --research → plan → ultraexecute.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-04-08 08:58:35 +02:00

1.6 KiB

name description allowed-tools model
security:watch Continuous security monitoring — runs diff on a recurring interval Bash, Read, Skill sonnet

/security watch [path] [--interval 6h]

Set up continuous security monitoring. Establishes a baseline, then runs /security diff on a recurring interval to detect regressions.

Step 1: Parse Arguments

Extract from $ARGUMENTS:

  • path — first non-flag argument (default .)
  • --interval <value> — loop interval like 6h, 30m, 1h (default 6h)

Step 2: Establish Baseline

Determine plugin root (parent of this commands/ folder) and resolve the target path.

node <plugin-root>/scanners/scan-orchestrator.mjs "<target>" --save-baseline

Parse stdout JSON. Display:

## Security Watch: <target>

**Baseline established** at <timestamp>
**Findings:** XC XH XM XL XI | **Risk Score:** X/100 | **Verdict:** ALLOW/WARNING/BLOCK

Starting watch with interval: <interval>

If the verdict is BLOCK, add a warning: "Initial scan shows BLOCK verdict — you will be alerted to any new findings above this baseline."

Step 3: Start Loop

Use the Skill tool to invoke the built-in /loop skill:

  • skill: loop
  • args: <interval> /security diff <target>

This runs /security diff <target> every <interval>. Each diff compares against the latest baseline and saves a new one — a rolling window of changes.

Step 4: Advisory

After starting the loop, display:

**Watch active.** `/security diff <target>` runs every <interval>.

To run as a system cron job instead:
  node <plugin-root>/scanners/watch-cron.mjs

To stop watching: Escape or Ctrl+C