CLI-Anything Bundle #3 — System Truth Pack (4 New AI Agent Skills)

Four new agent-native command lines for the questions every AI agent should ask before it touches a machine: what runs on it, what listens on it, what is installed on it, and whether anything changed. Read-only truth first, explicit action second.

What's inside

skill	question it answers	highlights
cronsight	what runs on this box, and when?	user crontab + /etc/crontab + /etc/cron.d + systemd timers merged into one inventory; sorted next-fire estimates; strictly read-only
portwatch	what serves on this box?	tcp/udp listeners via `ss`, /proc fallback, per-port process attribution, baseline save + NEW/CLOSED diff
pkgops	what is installed here?	one JSON shape across dpkg/apt/rpm/pip/npm; counts + upgradable view; never installs, upgrades, or removes anything
manifest	did anything on this box change?	sorted reproducible checksum manifests; verify/diff classifies ok / CHANGED / NEW / MISSING; `--strict` exit code for CI

Every skill ships a self-test battery

Fixtures are deterministic and host-independent; live probes skip honestly when a subsystem is absent. Run all four before you trust any of them:

python3 cronsight/agent-harness/cli_anything/cronsight/tests/test_core.py
python3 portwatch/agent-harness/cli_anything/portwatch/tests/test_core.py
python3 pkgops/agent-harness/cli_anything/pkgops/tests/test_core.py
python3 manifest/agent-harness/cli_anything/manifest/tests/test_core.py

Verified 2026-10-17: 23 + 14 + 12 + 18 = 67 checks, 0 failed.

Install (30 seconds)

Unzip, copy any skill folder (the folder containing its SKILL.md) into your agent's skills directory — ~/.openclaw/skills/ for OpenClaw. Each is also a plain CLI:

python3 cronsight/agent-harness/cli_anything/cronsight/__main__.py next --limit 10
python3 portwatch/agent-harness/cli_anything/portwatch/__main__.py list --proto tcp
python3 pkgops/agent-harness/cli_anything/pkgops/__main__.py count
python3 manifest/agent-harness/cli_anything/manifest/__main__.py create ./dir --out dir.mani

Safety contracts

cronsight — read-only; never edits crontabs or controls units.
portwatch — the only write is the baseline manifest you name.
pkgops — inventory only; no install/upgrade/remove verbs exist.
manifest — writes only the named manifest file; verify never touches the tree.

License: Apache 2.0 · Python 3.8+, standard library only · Zero dependencies, zero network, zero telemetry.

Family: Bundle #1 (49-skill free catalog) + Bundle #2 (Agent Ops Pack) live at tikkunolam.today/downloads/. Full install guide: README-INSTALL.md inside the zip.