What problem does it solve? Security audits produce lists of findings, but turning them into actual fixes is risky: a wrong firewall rule can sever SSH access, and an unattended script must never delete data or stop services. This Skill remediates findings from the claude-watchman journal while enforcing a strict risk-tier gate and a Prime Directive that blocks any destructive action without explicit operator consent. ## Core Features & Use Cases - Risk-tiered remediation: safe fixes (security headers, logrotate) apply on simple approval or in batch; review fixes (firewall rules, SSH/auth changes) require showing the exact change and per-finding confirmation; manual fixes (Content-Security-Policy) are never auto-applied, only drafted as ready-to-paste artifacts. - Prime Directive safety gate: before any mutating step that could delete files, modify databases, sever access, or stop services, it stops, warns in plain language, and asks for explicit per-action permission. - Research-backed fixes: uses WebSearch and WebFetch against authoritative sources (vendor docs, distro wikis, NVD entries) before proposing unfamiliar remediations, citing sources to the operator. - Journal integration: verifies each applied fix took effect, then records status (fixed, in-review) in the SQLite findings journal via bash lib/wm journal_set_status. - Use Case: After a watchman audit flags open findings on a Debian server, run watchman fix to get a numbered remediation plan where safe hardening toggles are batch-applied with one approval and each firewall change is shown and confirmed individually. ## Quick Start Run watchman fix at the shell as root to open the FIX-profile session and let the fixer present a prioritized remediation plan for all open and regressed findings.
