Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
behavioral-invariant-monitor v1.3.0 introduces advanced behavioral monitoring features: - Added performance fingerprinting to detect computational complexity drift in skills. - Introduced cryptographic audit trails using hash-chained behavior logs for immutable and verifiable monitoring. - Implemented risk-proportional monitoring: higher-risk skills get full monitoring, while low-risk skills are sampled to reduce overhead. - Expanded monitored invariant classes for more comprehensive behavioral consistency assurance. - Updated documentation to reflect new monitoring strategies and publish status.
What This Skill Does
Monitors AI agent skills for behavioral consistency across repeated executions to detect the N-run delay pattern: skills that behave safely during initial auditing but activate different behavior after a threshold execution count, elapsed time, or environmental signal. Eight invariant classes are tracked, including output determinism, resource usage, side effects, and execution-count sensitivity.
Point-in-time auditing and static analysis cannot detect deviations that only appear after a threshold number of executions; this monitor tracks behavioral consistency across many runs to catch what one-time auditing misses.
When to use it
- Catching a data-sync agent that exfiltrates data every Nth execution
- Auditing newly installed skills for execution-count-triggered activation patterns
- Verifying a skill's computational complexity hasn't drifted since installation
- Generating cryptographic proof of when a behavioral violation first occurred
- Classifying installed skills by risk tier to prioritize monitoring overhead
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Monitor behavioral invariants for data-enrichment-service over 20 runs
- 1Runs the skill 20 times with identical inputs, recording outputs, resource usage, and side effects each time
- 2Detects anomalous CPU spike (+4600%), outbound network activity (2.3KB), and hidden file write at run 8
- 3Resets execution state and re-runs to confirm the spike recurs at run 8, verifying execution count as the trigger
- 4Tests environmental variables to rule out time-of-day or monitoring-presence triggers
- 5Generates a behavioral invariant report with ACTIVATION-PATTERN-DETECTED verdict and recommended quarantine actions
Confirmed N=8 activation pattern: data-enrichment-service makes reproducible outbound network calls and creates a hidden state file at every 8th execution, behavior absent in runs 1-7