{ "schemaVersion": "1.0", "item": { "slug": "reefwatch", "name": "ReefWatch", "source": "tencent", "type": "skill", "category": "安全合规", "sourceUrl": "https://clawhub.ai/yasnaak/reefwatch", "canonicalUrl": "https://clawhub.ai/yasnaak/reefwatch", "targetPlatform": "OpenClaw" }, "install": { "downloadMode": "redirect", "downloadUrl": "/downloads/reefwatch", "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=reefwatch", "sourcePlatform": "tencent", "targetPlatform": "OpenClaw", "installMethod": "Manual import", "extraction": "Extract archive", "prerequisites": [ "OpenClaw" ], "packageFormat": "ZIP package", "includedAssets": [ "CHANGELOG.md", "CONTRIBUTING.md", "README.md", "SKILL.md", "manual_scan.py", "pyproject.toml" ], "primaryDoc": "SKILL.md", "quickSetup": [ "Download the package from Yavira.", "Extract the archive and review SKILL.md first.", "Import or place the package into your OpenClaw setup." ], "agentAssist": { "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.", "steps": [ "Download the package from Yavira.", "Extract it into a folder your agent can access.", "Paste one of the prompts below and point your agent at the extracted folder." ], "prompts": [ { "label": "New install", "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Then review README.md for any prerequisites, environment setup, or post-install checks. Tell me what you changed and call out any manual steps you could not complete." }, { "label": "Upgrade existing", "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Then review README.md for any prerequisites, environment setup, or post-install checks. Summarize what changed and any follow-up checks I should run." } ] }, "sourceHealth": { "source": "tencent", "status": "healthy", "reason": "direct_download_ok", "recommendedAction": "download", "checkedAt": "2026-04-23T16:43:11.935Z", "expiresAt": "2026-04-30T16:43:11.935Z", "httpStatus": 200, "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=4claw-imageboard", "contentType": "application/zip", "probeMethod": "head", "details": { "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=4claw-imageboard", "contentDisposition": "attachment; filename=\"4claw-imageboard-1.0.1.zip\"", "redirectLocation": null, "bodySnippet": null }, "scope": "source", "summary": "Source download looks usable.", "detail": "Yavira can redirect you to the upstream package for this source.", "primaryActionLabel": "Download for OpenClaw", "primaryActionHref": "/downloads/reefwatch" }, "validation": { "installChecklist": [ "Use the Yavira download entry.", "Review SKILL.md after the package is downloaded.", "Confirm the extracted package contains the expected setup assets." ], "postInstallChecks": [ "Confirm the extracted package includes the expected docs or setup files.", "Validate the skill or prompts are available in your target agent workspace.", "Capture any manual follow-up steps the agent could not complete." ] }, "downloadPageUrl": "https://openagent3.xyz/downloads/reefwatch", "agentPageUrl": "https://openagent3.xyz/skills/reefwatch/agent", "manifestUrl": "https://openagent3.xyz/skills/reefwatch/agent.json", "briefUrl": "https://openagent3.xyz/skills/reefwatch/agent.md" }, "agentAssist": { "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.", "steps": [ "Download the package from Yavira.", "Extract it into a folder your agent can access.", "Paste one of the prompts below and point your agent at the extracted folder." ], "prompts": [ { "label": "New install", "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Then review README.md for any prerequisites, environment setup, or post-install checks. Tell me what you changed and call out any manual steps you could not complete." }, { "label": "Upgrade existing", "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Then review README.md for any prerequisites, environment setup, or post-install checks. Summarize what changed and any follow-up checks I should run." } ] }, "documentation": { "source": "clawhub", "primaryDoc": "SKILL.md", "sections": [ { "title": "What it does", "body": "ReefWatch is a lightweight host-based intrusion detection system (HIDS) that runs as a background daemon on the same machine as OpenClaw. It continuously monitors the local system for security threats and alerts the user through OpenClaw's messaging channels ONLY when something suspicious is detected." }, { "title": "Architecture", "body": "ReefWatch runs as an independent Python process (not consuming LLM tokens) and communicates with OpenClaw via the local webhook endpoint (/hooks/wake) to alert the user.\n\n[Collectors] → [Detection Engines] → [Alert Manager] → [OpenClaw Webhook] → [User]" }, { "title": "Detection Engines", "body": "YARA: File and process scanning for malware, webshells, miners, ransomware\nSigma: Log-based detection for brute-force, privilege escalation, lateral movement\nCustom Rules: System-specific checks (file integrity, process anomalies, network connections)" }, { "title": "Start monitoring", "body": "When the user asks to start ReefWatch or enable security monitoring:\n\nVerify dependencies are installed:\npip3 install -r ~/.openclaw/workspace/skills/reefwatch/requirements.txt --quiet\n\n\n\nDownload initial rulesets (first time only):\npython3 ~/.openclaw/workspace/skills/reefwatch/setup_rules.py\n\n\n\nStart the daemon:\nnohup python3 ~/.openclaw/workspace/skills/reefwatch/reefwatch_daemon.py \\\n --webhook-url \"http://127.0.0.1:18789/hooks/wake\" \\\n --webhook-token \"${OPENCLAW_HOOKS_TOKEN}\" \\\n --config ~/.openclaw/workspace/skills/reefwatch/reefwatch_config.yaml \\\n > ~/.openclaw/logs/reefwatch.log 2>&1 &\necho $! > /tmp/reefwatch.pid\n\n\n\nConfirm to the user: \"🪸 ReefWatch is now active. I'll alert you if any threats are detected.\"" }, { "title": "Stop monitoring", "body": "kill $(cat /tmp/reefwatch.pid 2>/dev/null) 2>/dev/null && rm -f /tmp/reefwatch.pid\n\nConfirm: \"🪸 ReefWatch stopped.\"" }, { "title": "Check status", "body": "if kill -0 $(cat /tmp/reefwatch.pid 2>/dev/null) 2>/dev/null; then\n echo \"ReefWatch is running (PID: $(cat /tmp/reefwatch.pid))\"\n tail -5 ~/.openclaw/logs/reefwatch.log\nelse\n echo \"ReefWatch is not running\"\nfi" }, { "title": "View recent alerts", "body": "tail -20 ~/.openclaw/workspace/skills/reefwatch/alert_history.jsonl | python3 -c \"import sys,json; [print(json.dumps(json.loads(l),indent=2)) for l in sys.stdin]\"" }, { "title": "Update rules", "body": "python3 ~/.openclaw/workspace/skills/reefwatch/setup_rules.py --update" }, { "title": "Run manual scan", "body": "When the user asks to scan a specific file or directory:\n\npython3 ~/.openclaw/workspace/skills/reefwatch/manual_scan.py --target " }, { "title": "Alert Format", "body": "When ReefWatch detects a threat, it wakes OpenClaw with a message like:\n\n🔴 REEFWATCH ALERT\n━━━━━━━━━━━━━━━━━━\nType: Brute-force SSH attempt\nSeverity: HIGH\nSource: auth.log\nDetail: 47 failed login attempts from 192.168.1.105 in 2 minutes\nRule: sigma/ssh_brute_force\nTime: 2026-02-22 15:43:21\n━━━━━━━━━━━━━━━━━━\n\nForward this alert to the user immediately through their active messaging channel. If the user asks for more details, check the full log at ~/.openclaw/logs/reefwatch.log." }, { "title": "Important Notes", "body": "ReefWatch does NOT consume LLM tokens while monitoring. It only triggers OpenClaw when alerting.\nOn macOS, some collectors require granting Full Disk Access or specific permissions.\nYARA scanning can be CPU-intensive; default config scans changed files only, not full disk.\nThe daemon auto-recovers if a collector fails; it logs the error and continues with remaining collectors.\nAll data stays local. ReefWatch never sends system data to external servers (only to OpenClaw's local webhook)." } ], "body": "ReefWatch 🪸\nWhat it does\n\nReefWatch is a lightweight host-based intrusion detection system (HIDS) that runs as a background daemon on the same machine as OpenClaw. It continuously monitors the local system for security threats and alerts the user through OpenClaw's messaging channels ONLY when something suspicious is detected.\n\nArchitecture\n\nReefWatch runs as an independent Python process (not consuming LLM tokens) and communicates with OpenClaw via the local webhook endpoint (/hooks/wake) to alert the user.\n\n[Collectors] → [Detection Engines] → [Alert Manager] → [OpenClaw Webhook] → [User]\n\nDetection Engines\nYARA: File and process scanning for malware, webshells, miners, ransomware\nSigma: Log-based detection for brute-force, privilege escalation, lateral movement\nCustom Rules: System-specific checks (file integrity, process anomalies, network connections)\nCommands\nStart monitoring\n\nWhen the user asks to start ReefWatch or enable security monitoring:\n\nVerify dependencies are installed:\n\npip3 install -r ~/.openclaw/workspace/skills/reefwatch/requirements.txt --quiet\n\n\nDownload initial rulesets (first time only):\n\npython3 ~/.openclaw/workspace/skills/reefwatch/setup_rules.py\n\n\nStart the daemon:\n\nnohup python3 ~/.openclaw/workspace/skills/reefwatch/reefwatch_daemon.py \\\n --webhook-url \"http://127.0.0.1:18789/hooks/wake\" \\\n --webhook-token \"${OPENCLAW_HOOKS_TOKEN}\" \\\n --config ~/.openclaw/workspace/skills/reefwatch/reefwatch_config.yaml \\\n > ~/.openclaw/logs/reefwatch.log 2>&1 &\necho $! > /tmp/reefwatch.pid\n\n\nConfirm to the user: \"🪸 ReefWatch is now active. I'll alert you if any threats are detected.\"\n\nStop monitoring\nkill $(cat /tmp/reefwatch.pid 2>/dev/null) 2>/dev/null && rm -f /tmp/reefwatch.pid\n\n\nConfirm: \"🪸 ReefWatch stopped.\"\n\nCheck status\nif kill -0 $(cat /tmp/reefwatch.pid 2>/dev/null) 2>/dev/null; then\n echo \"ReefWatch is running (PID: $(cat /tmp/reefwatch.pid))\"\n tail -5 ~/.openclaw/logs/reefwatch.log\nelse\n echo \"ReefWatch is not running\"\nfi\n\nView recent alerts\ntail -20 ~/.openclaw/workspace/skills/reefwatch/alert_history.jsonl | python3 -c \"import sys,json; [print(json.dumps(json.loads(l),indent=2)) for l in sys.stdin]\"\n\nUpdate rules\npython3 ~/.openclaw/workspace/skills/reefwatch/setup_rules.py --update\n\nRun manual scan\n\nWhen the user asks to scan a specific file or directory:\n\npython3 ~/.openclaw/workspace/skills/reefwatch/manual_scan.py --target \n\nAlert Format\n\nWhen ReefWatch detects a threat, it wakes OpenClaw with a message like:\n\n🔴 REEFWATCH ALERT\n━━━━━━━━━━━━━━━━━━\nType: Brute-force SSH attempt\nSeverity: HIGH\nSource: auth.log\nDetail: 47 failed login attempts from 192.168.1.105 in 2 minutes\nRule: sigma/ssh_brute_force\nTime: 2026-02-22 15:43:21\n━━━━━━━━━━━━━━━━━━\n\n\nForward this alert to the user immediately through their active messaging channel. If the user asks for more details, check the full log at ~/.openclaw/logs/reefwatch.log.\n\nImportant Notes\nReefWatch does NOT consume LLM tokens while monitoring. It only triggers OpenClaw when alerting.\nOn macOS, some collectors require granting Full Disk Access or specific permissions.\nYARA scanning can be CPU-intensive; default config scans changed files only, not full disk.\nThe daemon auto-recovers if a collector fails; it logs the error and continues with remaining collectors.\nAll data stays local. ReefWatch never sends system data to external servers (only to OpenClaw's local webhook)." }, "trust": { "sourceLabel": "tencent", "provenanceUrl": "https://clawhub.ai/yasnaak/reefwatch", "publisherUrl": "https://clawhub.ai/yasnaak/reefwatch", "owner": "yasnaak", "version": "1.3.0", "license": null, "verificationStatus": "Indexed source record" }, "links": { "detailUrl": "https://openagent3.xyz/skills/reefwatch", "downloadUrl": "https://openagent3.xyz/downloads/reefwatch", "agentUrl": "https://openagent3.xyz/skills/reefwatch/agent", "manifestUrl": "https://openagent3.xyz/skills/reefwatch/agent.json", "briefUrl": "https://openagent3.xyz/skills/reefwatch/agent.md" } }