Requirements
- Target platform
- OpenClaw
- Install method
- Manual import
- Extraction
- Extract archive
- Prerequisites
- OpenClaw
- Primary doc
- SKILL.md
AI-powered LuLu Firewall companion for macOS. Monitors firewall alerts, analyzes connections with AI, sends Telegram notifications with Allow/Block buttons....
AI-powered LuLu Firewall companion for macOS. Monitors firewall alerts, analyzes connections with AI, sends Telegram notifications with Allow/Block buttons....
Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.
I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete.
I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run.
AI-powered companion for LuLu Firewall on macOS.
Monitors LuLu firewall alert popups Extracts connection info (process, IP, port, DNS) Spawns a fast AI (haiku) to analyze the connection Sends Telegram notification with risk assessment Provides 4 action buttons: Always Allow, Allow Once, Always Block, Block Once Executes the action on LuLu when user taps a button
For reduced interruptions, enable auto-execute mode. When the AI has high confidence (known safe programs like curl, brew, node, git connecting to normal destinations), it will: Automatically execute the Allow action Still send a Telegram notification explaining what was auto-allowed To enable: # Create config.json in install directory cat > ~/.openclaw/lulu-monitor/config.json << 'EOF' { "telegramId": "YOUR_TELEGRAM_ID", "autoExecute": true, "autoExecuteAction": "allow-once" } EOF Options: autoExecute: false (default) - all alerts require manual button press autoExecuteAction: "allow-once" (default, conservative) or "allow" (permanent rule)
Run the check script first: bash scripts/check-prerequisites.sh Required: LuLu Firewall: brew install --cask lulu Node.js: brew install node OpenClaw Gateway: Running with Telegram channel configured Accessibility Permission: System Settings > Privacy > Accessibility > Enable Terminal/osascript
The monitor calls sessions_spawn via OpenClaw's /tools/invoke HTTP API. This tool is blocked by default. Add it to the allowlist in ~/.openclaw/openclaw.json: { "gateway": { "tools": { "allow": ["sessions_spawn"] } } } Without this, alerts will be detected but fail to forward (404 in logs).
bash scripts/install.sh This will: Clone the repo to ~/.openclaw/lulu-monitor/ Install npm dependencies Set up launchd for auto-start Start the service
curl http://127.0.0.1:4441/status Should return {"running":true,...}
β οΈ The message tool's buttons/components parameter does NOT work for Telegram inline buttons. You must use the CLI via exec: openclaw message send --channel telegram --target <chat_id> \ --message "π LuLu Alert: <summary>" \ --buttons '[[{"text":"β Always Allow","callback_data":"lulu:allow"},{"text":"β Allow Once","callback_data":"lulu:allow-once"}],[{"text":"β Always Block","callback_data":"lulu:block"},{"text":"β Block Once","callback_data":"lulu:block-once"}]]' After sending via CLI, reply with NO_REPLY to avoid duplicate messages.
When user clicks a Telegram button, OpenClaw receives a callback like: callback_data: lulu:allow callback_data: lulu:allow-once callback_data: lulu:block callback_data: lulu:block-once To handle it, call the local endpoint: curl -X POST http://127.0.0.1:4441/callback \ -H "Content-Type: application/json" \ -d '{"action":"allow"}' # or "block", "allow-once", "block-once" This will: Click the appropriate button on LuLu alert Set Rule Scope to "endpoint" Set Rule Duration to "Always" or "Process lifetime" Edit the Telegram message to show result
# Check status launchctl list | grep lulu-monitor # View logs tail -f ~/.openclaw/lulu-monitor/logs/stdout.log # Restart launchctl unload ~/Library/LaunchAgents/com.openclaw.lulu-monitor.plist launchctl load ~/Library/LaunchAgents/com.openclaw.lulu-monitor.plist
AppleScript needs permission to control LuLu. Go to: System Settings > Privacy & Security > Accessibility Enable: Terminal, iTerm, or whatever terminal you use
Ensure LuLu is running: pgrep -x LuLu Check if alert window exists: osascript -e 'tell application "System Events" to tell process "LuLu" to get every window'
bash ~/.openclaw/lulu-monitor/skill/scripts/uninstall.sh
Agent frameworks, memory systems, reasoning layers, and model-native orchestration.
Largest current source with strong distribution and engagement signals.