Four NEW agent-native CLI harnesses for the questions every AI agent should answer about the machine it is about to operate on — WITHOUT ever crossing the line from measuring to administering: what is running here, what is holding files open (including deleted-but-open), what state are the systemd units in, what are the machine's vitals. Read-only recon with labeled views and explicit limits — then decisions, in that order.
License: Apache 2.0. Python 3.8+, zero dependencies.
| skill | what it does | highlights |
|---|---|---|
| procsight | process table recon, one /proc snapshot | per-process truth (pid, ppid, user, state, RSS KB, threads, cmdline, CPU% from one utime+stime delta over --interval), systemd unit hint when the cgroup names one; views: top-N (--top cpu\|mem), --pid detail with children, --pid --tree parent→child walk (depth-capped), --zombies state-Z finder. Nothing is killed, signaled, written, or reniced — a vanished pid is a clean exit-1 finding, never an internal error |
| openfiles | held-file recon, one /proc/*/fd pass | total fd entries + top-N open-fd owners; --pid detail (every fd → resolved target, fdinfo pos when readable); --deleted names deleted-but-open files with holder-ranked cmdlines — the "disk shows full but no file exists" case. Sizes of deleted files are deliberately reported as not-statable — never invented |
| unitpeek | systemd unit recon | unitpeek UNIT reports load/active/sub state, main pid, NRestarts, since-timestamp, last-exit code/status via systemctl show; --failed scans failed units machine-wide (list-units --failed, parsed). Mutating verbs are refused by construction — recon and administration stay in different hands |
| vitals | one-shot host vitals snapshot | uptime/idle seconds, load 1/5/15m, cpu count, kernel-reported MemTotal/MemAvailable/Swap (kB) + mem-used-%, per-mount total/free/used-% via read-only statvfs for mounts YOU name (--mount, repeatable), thermal zones (celsius) — or an honest null when hwmon exposes nothing |
CI-grade exit contracts throughout: success/finding/operational-error are three different exit codes in every skill (0 / 1 / 2, with vitals using 0/2 as its contract defines), so scripts and agents branch on truth instead of parsing prose.
The four skills compose into a full recon of any machine, in permission-safe order: vitals (is it healthy — mem, swap, load, disk) → procsight (what is running — top consumers, zombies, trees) → openfiles (what holds what open — deleted-but-open blockers) → unitpeek (what did systemd admit to — failed units, restart counts). Each stage is read-only, labeled, and composed of fields that trace to /proc, /sys, statvfs, or systemctl — nothing guessed silently.
unzip CLI-Anything_Bundle9_ProcRecon_v1.0.zip
# copy any skill folder (the folder containing its SKILL.md) into your agent's
# skills directory, e.g. ~/.openclaw/skills/
cp -r procsight ~/.openclaw/skills/
The agent then knows how to measure process tables, held files, unit states and host vitals with JSON output and explicit read-only contracts.
python3 procsight/agent-harness/cli_anything/procsight/__main__.py --top mem --count 5
python3 procsight/agent-harness/cli_anything/procsight/__main__.py --pid 1 --tree
python3 openfiles/agent-harness/cli_anything/openfiles/__main__.py --deleted
python3 unitpeek/agent-harness/cli_anything/unitpeek/__main__.py ssh.service
python3 unitpeek/agent-harness/cli_anything/unitpeek/__main__.py --failed
python3 vitals/agent-harness/cli_anything/vitals/__main__.py --mount / --mount /home
Optional pip install per skill (each folder ships an agent-harness/setup.py):
cd procsight/agent-harness && pip install .
Every skill carries its own battery. Total this bundle: 64 checks.
python3 procsight/agent-harness/cli_anything/procsight/tests/test_core.py # 20 checks
python3 openfiles/agent-harness/cli_anything/openfiles/tests/test_core.py # 14 checks
python3 unitpeek/agent-harness/cli_anything/unitpeek/tests/test_core.py # 14 checks
python3 vitals/agent-harness/cli_anything/vitals/tests/test_core.py # 16 checks
Verified live on 2026-10-19: 20 + 14 + 14 + 16 = 64 checks, 0 failed. The batteries live-fire each skill's real CLI end-to-end on the running host itself: openfiles' battery proves the deleted-but-open finder with a real file created, opened, unlinked and then found; unitpeek's runs against the host's actual systemd (read-only verbs only); procsight's reads the live process table (one battery run caught 77 real zombie processes on the test host). No external network, no fixture daemons, nothing mutated.
All four skills are strictly read-only: /proc and /sys reads, fd-info
reads, systemctl show / list-units --failed only (mutating verbs are
refused by construction), shutil.statvfs. No writes, no signals, no
handle closures, no privileged calls, no daemon starts. Views are
labeled exactly where they end — unreadable owners are skipped
honestly, missing optional fields (thermal, swap) are honest nulls, and
nothing is invented.
Apache 2.0. Yours to run, modify, and ship anywhere — including inside your own products.