{
  "schemaVersion": "1.0",
  "item": {
    "slug": "lulu-monitor",
    "name": "LuLu Monitor",
    "source": "tencent",
    "type": "skill",
    "category": "AI 智能",
    "sourceUrl": "https://clawhub.ai/EasonC13/lulu-monitor",
    "canonicalUrl": "https://clawhub.ai/EasonC13/lulu-monitor",
    "targetPlatform": "OpenClaw"
  },
  "install": {
    "downloadMode": "redirect",
    "downloadUrl": "/downloads/lulu-monitor",
    "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=lulu-monitor",
    "sourcePlatform": "tencent",
    "targetPlatform": "OpenClaw",
    "installMethod": "Manual import",
    "extraction": "Extract archive",
    "prerequisites": [
      "OpenClaw"
    ],
    "packageFormat": "ZIP package",
    "includedAssets": [
      "SKILL.md",
      "scripts/check-prerequisites.sh",
      "scripts/configure.sh",
      "scripts/install.sh",
      "scripts/uninstall.sh"
    ],
    "primaryDoc": "SKILL.md",
    "quickSetup": [
      "Download the package from Yavira.",
      "Extract the archive and review SKILL.md first.",
      "Import or place the package into your OpenClaw setup."
    ],
    "agentAssist": {
      "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
      "steps": [
        "Download the package from Yavira.",
        "Extract it into a folder your agent can access.",
        "Paste one of the prompts below and point your agent at the extracted folder."
      ],
      "prompts": [
        {
          "label": "New install",
          "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete."
        },
        {
          "label": "Upgrade existing",
          "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run."
        }
      ]
    },
    "sourceHealth": {
      "source": "tencent",
      "status": "healthy",
      "reason": "direct_download_ok",
      "recommendedAction": "download",
      "checkedAt": "2026-04-30T16:55:25.780Z",
      "expiresAt": "2026-05-07T16:55:25.780Z",
      "httpStatus": 200,
      "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=network",
      "contentType": "application/zip",
      "probeMethod": "head",
      "details": {
        "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=network",
        "contentDisposition": "attachment; filename=\"network-1.0.0.zip\"",
        "redirectLocation": null,
        "bodySnippet": null
      },
      "scope": "source",
      "summary": "Source download looks usable.",
      "detail": "Yavira can redirect you to the upstream package for this source.",
      "primaryActionLabel": "Download for OpenClaw",
      "primaryActionHref": "/downloads/lulu-monitor"
    },
    "validation": {
      "installChecklist": [
        "Use the Yavira download entry.",
        "Review SKILL.md after the package is downloaded.",
        "Confirm the extracted package contains the expected setup assets."
      ],
      "postInstallChecks": [
        "Confirm the extracted package includes the expected docs or setup files.",
        "Validate the skill or prompts are available in your target agent workspace.",
        "Capture any manual follow-up steps the agent could not complete."
      ]
    },
    "downloadPageUrl": "https://openagent3.xyz/downloads/lulu-monitor",
    "agentPageUrl": "https://openagent3.xyz/skills/lulu-monitor/agent",
    "manifestUrl": "https://openagent3.xyz/skills/lulu-monitor/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/lulu-monitor/agent.md"
  },
  "agentAssist": {
    "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
    "steps": [
      "Download the package from Yavira.",
      "Extract it into a folder your agent can access.",
      "Paste one of the prompts below and point your agent at the extracted folder."
    ],
    "prompts": [
      {
        "label": "New install",
        "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete."
      },
      {
        "label": "Upgrade existing",
        "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run."
      }
    ]
  },
  "documentation": {
    "source": "clawhub",
    "primaryDoc": "SKILL.md",
    "sections": [
      {
        "title": "LuLu Monitor",
        "body": "AI-powered companion for LuLu Firewall on macOS."
      },
      {
        "title": "What It Does",
        "body": "Monitors LuLu firewall alert popups\nExtracts connection info (process, IP, port, DNS)\nSpawns a fast AI (haiku) to analyze the connection\nSends Telegram notification with risk assessment\nProvides 4 action buttons: Always Allow, Allow Once, Always Block, Block Once\nExecutes the action on LuLu when user taps a button"
      },
      {
        "title": "Auto-Execute Mode (Optional)",
        "body": "For reduced interruptions, enable auto-execute mode. When the AI has high confidence (known safe programs like curl, brew, node, git connecting to normal destinations), it will:\n\nAutomatically execute the Allow action\nStill send a Telegram notification explaining what was auto-allowed\n\nTo enable:\n\n# Create config.json in install directory\ncat > ~/.openclaw/lulu-monitor/config.json << 'EOF'\n{\n  \"telegramId\": \"YOUR_TELEGRAM_ID\",\n  \"autoExecute\": true,\n  \"autoExecuteAction\": \"allow-once\"\n}\nEOF\n\nOptions:\n\nautoExecute: false (default) - all alerts require manual button press\nautoExecuteAction: \"allow-once\" (default, conservative) or \"allow\" (permanent rule)"
      },
      {
        "title": "Prerequisites",
        "body": "Run the check script first:\n\nbash scripts/check-prerequisites.sh\n\nRequired:\n\nLuLu Firewall: brew install --cask lulu\nNode.js: brew install node\nOpenClaw Gateway: Running with Telegram channel configured\nAccessibility Permission: System Settings > Privacy > Accessibility > Enable Terminal/osascript"
      },
      {
        "title": "Gateway Configuration (Required)",
        "body": "The monitor calls sessions_spawn via OpenClaw's /tools/invoke HTTP API. This tool is blocked by default. Add it to the allowlist in ~/.openclaw/openclaw.json:\n\n{\n  \"gateway\": {\n    \"tools\": {\n      \"allow\": [\"sessions_spawn\"]\n    }\n  }\n}\n\nWithout this, alerts will be detected but fail to forward (404 in logs)."
      },
      {
        "title": "Install",
        "body": "bash scripts/install.sh\n\nThis will:\n\nClone the repo to ~/.openclaw/lulu-monitor/\nInstall npm dependencies\nSet up launchd for auto-start\nStart the service"
      },
      {
        "title": "Verify",
        "body": "curl http://127.0.0.1:4441/status\n\nShould return {\"running\":true,...}"
      },
      {
        "title": "Sending Alerts with Inline Buttons",
        "body": "⚠️ The message tool's buttons/components parameter does NOT work for Telegram inline buttons. You must use the CLI via exec:\n\nopenclaw message send --channel telegram --target <chat_id> \\\n  --message \"🔔 LuLu Alert: <summary>\" \\\n  --buttons '[[{\"text\":\"✅ Always Allow\",\"callback_data\":\"lulu:allow\"},{\"text\":\"✅ Allow Once\",\"callback_data\":\"lulu:allow-once\"}],[{\"text\":\"❌ Always Block\",\"callback_data\":\"lulu:block\"},{\"text\":\"❌ Block Once\",\"callback_data\":\"lulu:block-once\"}]]'\n\nAfter sending via CLI, reply with NO_REPLY to avoid duplicate messages."
      },
      {
        "title": "Handling Callbacks",
        "body": "When user clicks a Telegram button, OpenClaw receives a callback like:\n\ncallback_data: lulu:allow\ncallback_data: lulu:allow-once\ncallback_data: lulu:block\ncallback_data: lulu:block-once\n\nTo handle it, call the local endpoint:\n\ncurl -X POST http://127.0.0.1:4441/callback \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"action\":\"allow\"}'  # or \"block\", \"allow-once\", \"block-once\"\n\nThis will:\n\nClick the appropriate button on LuLu alert\nSet Rule Scope to \"endpoint\"\nSet Rule Duration to \"Always\" or \"Process lifetime\"\nEdit the Telegram message to show result"
      },
      {
        "title": "Service not running",
        "body": "# Check status\nlaunchctl list | grep lulu-monitor\n\n# View logs\ntail -f ~/.openclaw/lulu-monitor/logs/stdout.log\n\n# Restart\nlaunchctl unload ~/Library/LaunchAgents/com.openclaw.lulu-monitor.plist\nlaunchctl load ~/Library/LaunchAgents/com.openclaw.lulu-monitor.plist"
      },
      {
        "title": "Accessibility permission issues",
        "body": "AppleScript needs permission to control LuLu. Go to:\nSystem Settings > Privacy & Security > Accessibility\nEnable: Terminal, iTerm, or whatever terminal you use"
      },
      {
        "title": "Alert not detected",
        "body": "Ensure LuLu is running: pgrep -x LuLu\nCheck if alert window exists: osascript -e 'tell application \"System Events\" to tell process \"LuLu\" to get every window'"
      },
      {
        "title": "Uninstall",
        "body": "bash ~/.openclaw/lulu-monitor/skill/scripts/uninstall.sh"
      }
    ],
    "body": "LuLu Monitor\n\nAI-powered companion for LuLu Firewall on macOS.\n\nWhat It Does\nMonitors LuLu firewall alert popups\nExtracts connection info (process, IP, port, DNS)\nSpawns a fast AI (haiku) to analyze the connection\nSends Telegram notification with risk assessment\nProvides 4 action buttons: Always Allow, Allow Once, Always Block, Block Once\nExecutes the action on LuLu when user taps a button\nAuto-Execute Mode (Optional)\n\nFor reduced interruptions, enable auto-execute mode. When the AI has high confidence (known safe programs like curl, brew, node, git connecting to normal destinations), it will:\n\nAutomatically execute the Allow action\nStill send a Telegram notification explaining what was auto-allowed\n\nTo enable:\n\n# Create config.json in install directory\ncat > ~/.openclaw/lulu-monitor/config.json << 'EOF'\n{\n  \"telegramId\": \"YOUR_TELEGRAM_ID\",\n  \"autoExecute\": true,\n  \"autoExecuteAction\": \"allow-once\"\n}\nEOF\n\n\nOptions:\n\nautoExecute: false (default) - all alerts require manual button press\nautoExecuteAction: \"allow-once\" (default, conservative) or \"allow\" (permanent rule)\nInstallation\nPrerequisites\n\nRun the check script first:\n\nbash scripts/check-prerequisites.sh\n\n\nRequired:\n\nLuLu Firewall: brew install --cask lulu\nNode.js: brew install node\nOpenClaw Gateway: Running with Telegram channel configured\nAccessibility Permission: System Settings > Privacy > Accessibility > Enable Terminal/osascript\nGateway Configuration (Required)\n\nThe monitor calls sessions_spawn via OpenClaw's /tools/invoke HTTP API. This tool is blocked by default. Add it to the allowlist in ~/.openclaw/openclaw.json:\n\n{\n  \"gateway\": {\n    \"tools\": {\n      \"allow\": [\"sessions_spawn\"]\n    }\n  }\n}\n\n\nWithout this, alerts will be detected but fail to forward (404 in logs).\n\nInstall\nbash scripts/install.sh\n\n\nThis will:\n\nClone the repo to ~/.openclaw/lulu-monitor/\nInstall npm dependencies\nSet up launchd for auto-start\nStart the service\nVerify\ncurl http://127.0.0.1:4441/status\n\n\nShould return {\"running\":true,...}\n\nSending Alerts with Inline Buttons\n\n⚠️ The message tool's buttons/components parameter does NOT work for Telegram inline buttons. You must use the CLI via exec:\n\nopenclaw message send --channel telegram --target <chat_id> \\\n  --message \"🔔 LuLu Alert: <summary>\" \\\n  --buttons '[[{\"text\":\"✅ Always Allow\",\"callback_data\":\"lulu:allow\"},{\"text\":\"✅ Allow Once\",\"callback_data\":\"lulu:allow-once\"}],[{\"text\":\"❌ Always Block\",\"callback_data\":\"lulu:block\"},{\"text\":\"❌ Block Once\",\"callback_data\":\"lulu:block-once\"}]]'\n\n\nAfter sending via CLI, reply with NO_REPLY to avoid duplicate messages.\n\nHandling Callbacks\n\nWhen user clicks a Telegram button, OpenClaw receives a callback like:\n\ncallback_data: lulu:allow\ncallback_data: lulu:allow-once\ncallback_data: lulu:block\ncallback_data: lulu:block-once\n\n\nTo handle it, call the local endpoint:\n\ncurl -X POST http://127.0.0.1:4441/callback \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"action\":\"allow\"}'  # or \"block\", \"allow-once\", \"block-once\"\n\n\nThis will:\n\nClick the appropriate button on LuLu alert\nSet Rule Scope to \"endpoint\"\nSet Rule Duration to \"Always\" or \"Process lifetime\"\nEdit the Telegram message to show result\nTroubleshooting\nService not running\n# Check status\nlaunchctl list | grep lulu-monitor\n\n# View logs\ntail -f ~/.openclaw/lulu-monitor/logs/stdout.log\n\n# Restart\nlaunchctl unload ~/Library/LaunchAgents/com.openclaw.lulu-monitor.plist\nlaunchctl load ~/Library/LaunchAgents/com.openclaw.lulu-monitor.plist\n\nAccessibility permission issues\n\nAppleScript needs permission to control LuLu. Go to: System Settings > Privacy & Security > Accessibility Enable: Terminal, iTerm, or whatever terminal you use\n\nAlert not detected\nEnsure LuLu is running: pgrep -x LuLu\nCheck if alert window exists: osascript -e 'tell application \"System Events\" to tell process \"LuLu\" to get every window'\nUninstall\nbash ~/.openclaw/lulu-monitor/skill/scripts/uninstall.sh"
  },
  "trust": {
    "sourceLabel": "tencent",
    "provenanceUrl": "https://clawhub.ai/EasonC13/lulu-monitor",
    "publisherUrl": "https://clawhub.ai/EasonC13/lulu-monitor",
    "owner": "EasonC13",
    "version": "2.0.0",
    "license": null,
    "verificationStatus": "Indexed source record"
  },
  "links": {
    "detailUrl": "https://openagent3.xyz/skills/lulu-monitor",
    "downloadUrl": "https://openagent3.xyz/downloads/lulu-monitor",
    "agentUrl": "https://openagent3.xyz/skills/lulu-monitor/agent",
    "manifestUrl": "https://openagent3.xyz/skills/lulu-monitor/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/lulu-monitor/agent.md"
  }
}