Requirements
- Target platform
- OpenClaw
- Install method
- Manual import
- Extraction
- Extract archive
- Prerequisites
- OpenClaw
- Primary doc
- SKILL.md
Tencent SkillHub ยท Security & Compliance
ReefWatch
Continuous local security monitoring daemon for Linux and macOS. Detects brute-force attacks, malware, privilege escalation, suspicious processes, file tampe...
skill openclawclawhub Free
Continuous local security monitoring daemon for Linux and macOS. Detects brute-force attacks, malware, privilege escalation, suspicious processes, file tampe...
โฌ 0 downloads โ
0 stars Unverified but indexed
Install for OpenClaw
Known item issue.
This item's current download entry is known to bounce back to a listing or homepage instead of returning a package file.
Quick setup
- Open the source page and confirm the package flow manually.
- Review SKILL.md if you can obtain the files.
- Treat this source as manual setup until the download is verified.
Package facts
- Download mode
- Manual review
- Package format
- ZIP package
- Source platform
- Tencent SkillHub
- What's included
- CHANGELOG.md, CONTRIBUTING.md, README.md, SKILL.md, manual_scan.py, pyproject.toml
Validation
- Open the source listing and confirm there is a real package or setup artifact available.
- Review SKILL.md before asking your agent to continue.
- Treat this source as manual setup until the upstream download flow is fixed.
Install with your agent
Agent handoff
Use the source page and any available docs to guide the install because the item currently does not return a direct package file.
- Open the source page via Open source listing.
- If you can obtain the package, extract it into a folder your agent can access.
- Paste one of the prompts below and point your agent at the source page and extracted files.
New install
I tried to install a skill package from Yavira, but the item currently does not return a direct package file. Inspect the source page and any extracted docs, then tell me what you can confirm and any manual steps still required. Then review README.md for any prerequisites, environment setup, or post-install checks.
Upgrade existing
I tried to upgrade a skill package from Yavira, but the item currently does not return a direct package file. Compare the source page and any extracted docs with my current installation, then summarize what changed and what manual follow-up I still need. Then review README.md for any prerequisites, environment setup, or post-install checks.
Trust & source
Release facts
- Source
- Tencent SkillHub
- Verification
- Indexed source record
- Version
- 1.3.0
Provenance
- Publisher
- yasnaak
- Source page
- View original listing
- Canonical URL
- Open canonical page
Documentation
What it does
ReefWatch is a lightweight host-based intrusion detection system (HIDS) that runs as a background daemon on the same machine as OpenClaw. It continuously monitors the local system for security threats and alerts the user through OpenClaw's messaging channels ONLY when something suspicious is detected.
Architecture
ReefWatch runs as an independent Python process (not consuming LLM tokens) and communicates with OpenClaw via the local webhook endpoint (/hooks/wake) to alert the user. [Collectors] โ [Detection Engines] โ [Alert Manager] โ [OpenClaw Webhook] โ [User]
Detection Engines
YARA: File and process scanning for malware, webshells, miners, ransomware Sigma: Log-based detection for brute-force, privilege escalation, lateral movement Custom Rules: System-specific checks (file integrity, process anomalies, network connections)
Start monitoring
When the user asks to start ReefWatch or enable security monitoring: Verify dependencies are installed: pip3 install -r ~/.openclaw/workspace/skills/reefwatch/requirements.txt --quiet Download initial rulesets (first time only): python3 ~/.openclaw/workspace/skills/reefwatch/setup_rules.py Start the daemon: nohup python3 ~/.openclaw/workspace/skills/reefwatch/reefwatch_daemon.py \ --webhook-url "http://127.0.0.1:18789/hooks/wake" \ --webhook-token "${OPENCLAW_HOOKS_TOKEN}" \ --config ~/.openclaw/workspace/skills/reefwatch/reefwatch_config.yaml \ > ~/.openclaw/logs/reefwatch.log 2>&1 & echo $! > /tmp/reefwatch.pid Confirm to the user: "๐ชธ ReefWatch is now active. I'll alert you if any threats are detected."
Stop monitoring
kill $(cat /tmp/reefwatch.pid 2>/dev/null) 2>/dev/null && rm -f /tmp/reefwatch.pid Confirm: "๐ชธ ReefWatch stopped."
Check status
if kill -0 $(cat /tmp/reefwatch.pid 2>/dev/null) 2>/dev/null; then echo "ReefWatch is running (PID: $(cat /tmp/reefwatch.pid))" tail -5 ~/.openclaw/logs/reefwatch.log else echo "ReefWatch is not running" fi
View recent alerts
tail -20 ~/.openclaw/workspace/skills/reefwatch/alert_history.jsonl | python3 -c "import sys,json; [print(json.dumps(json.loads(l),indent=2)) for l in sys.stdin]"
Update rules
python3 ~/.openclaw/workspace/skills/reefwatch/setup_rules.py --update
Run manual scan
When the user asks to scan a specific file or directory: python3 ~/.openclaw/workspace/skills/reefwatch/manual_scan.py --target <path>
Alert Format
When ReefWatch detects a threat, it wakes OpenClaw with a message like: ๐ด REEFWATCH ALERT โโโโโโโโโโโโโโโโโโ Type: Brute-force SSH attempt Severity: HIGH Source: auth.log Detail: 47 failed login attempts from 192.168.1.105 in 2 minutes Rule: sigma/ssh_brute_force Time: 2026-02-22 15:43:21 โโโโโโโโโโโโโโโโโโ Forward this alert to the user immediately through their active messaging channel. If the user asks for more details, check the full log at ~/.openclaw/logs/reefwatch.log.
Important Notes
ReefWatch does NOT consume LLM tokens while monitoring. It only triggers OpenClaw when alerting. On macOS, some collectors require granting Full Disk Access or specific permissions. YARA scanning can be CPU-intensive; default config scans changed files only, not full disk. The daemon auto-recovers if a collector fails; it logs the error and continues with remaining collectors. All data stays local. ReefWatch never sends system data to external servers (only to OpenClaw's local webhook).
Category context
Identity, auth, scanning, governance, audit, and operational guardrails.
Source: Tencent SkillHub
Largest current source with strong distribution and engagement signals.
Package contents
Included in package
4 Docs1 Scripts1 Files
- SKILL.md
- CHANGELOG.md
- CONTRIBUTING.md
- README.md
- manual_scan.py
- pyproject.toml