lulu-monitor

What This Skill Does

LuLu Monitor is an intelligent AI-powered companion designed specifically for the LuLu Firewall on macOS. It acts as an automated security bridge between your macOS environment and your Telegram client. When the LuLu Firewall triggers a connection alert, this skill captures the process information, target IP, port, and DNS data, and transmits it to an AI model (Haiku) for an immediate risk assessment.

Instead of blindly accepting or denying network requests, you receive a detailed Telegram notification explaining the nature of the connection. The notification includes interactive action buttons, allowing you to trigger 'Always Allow', 'Allow Once', 'Always Block', or 'Block Once' commands directly from your phone or desktop. For power users, the skill includes an 'Auto-Execute' mode that, when enabled via a local configuration file, automatically authorizes low-risk processes like 'curl' or 'git', significantly reducing alert fatigue while maintaining high-level visibility into your outbound traffic.

Installation

To install, execute the following command: clawhub install openclaw/skills/skills/dexiaong/lulu-monitor. Prerequisites include a working installation of LuLu Firewall (via Homebrew), Node.js, an active OpenClaw Gateway with Telegram integration, and specific macOS Accessibility permissions. After running the install script, ensure the service is running by verifying the status endpoint at http://127.0.0.1:4441/status. Always ensure that your ~/.openclaw/lulu-monitor/config.json file is correctly formatted with your Telegram ID to receive alerts.

Use Cases

1. Remote Security Monitoring: Managing network permissions for your macOS machine while away from your computer.
2. Reducing Alert Fatigue: Automatically whitelisting trusted development tools while being alerted only to suspicious or unknown outbound connections.
3. Network Auditing: Getting detailed insights into which processes are phoning home without needing to constantly check the macOS desktop UI.
4. Security Hardening: Applying strict 'Block' policies to unknown connections identified as high-risk by the integrated AI analysis.

Example Prompts

1. "Check the current status of my LuLu monitor service and make sure it is connected to Telegram."
2. "Enable auto-execute mode for my firewall, but set the default action to 'allow-once' for safety."
3. "Summarize the recent firewall alerts caught by the LuLu monitor today."

Tips & Limitations

Always ensure that 'Accessibility' permissions are granted to the terminal or osascript, as this is required for the skill to click buttons on the LuLu UI. Note that auto-execute mode should be used cautiously; while convenient, it could potentially allow malicious traffic if you define overly broad trust rules. If you experience issues with notification delivery, double-check your OpenClaw Gateway configuration.