lulu-monitor

What This Skill Does

LuLu Monitor is an advanced AI-powered security companion designed specifically for the LuLu Firewall on macOS. It serves as an intelligent bridge between low-level network alerts and high-level conversational insight. Instead of simply seeing a cryptic alert popup on your desktop, LuLu Monitor intercepts these alerts, extracts vital metadata (process ID, remote IP, destination port, and DNS information), and routes them to an AI model for risk assessment. This allows you to make informed security decisions based on contextual analysis rather than manual guesswork. The skill integrates directly with Telegram, providing interactive inline buttons that allow you to manage your firewall rules—permitting or blocking connections—remotely and instantly without needing to manually open the LuLu interface.

Installation

To begin, ensure you have LuLu Firewall and Node.js installed on your system via Homebrew. Run the check script provided in the repository to verify system permissions, specifically ensuring 'Accessibility' access is granted to your terminal emulator. You must add sessions_spawn to your ~/.openclaw/openclaw.json gateway allowlist to enable the monitor to communicate with the OpenClaw core. Install the skill using clawhub install openclaw/skills/skills/easonc13/lulu-monitor and complete the configuration by creating the ~/.openclaw/lulu-monitor/config.json file with your Telegram ID. Run bash scripts/install.sh to initialize the background daemon.

Use Cases

• Proactive Threat Hunting: Identify suspicious outbound connections from unrecognized processes immediately.
• Simplified Security Management: Approve or deny connections for new applications without switching windows or interrupting your current workflow.
• Automation for Power Users: Enable 'Auto-Execute' mode to automatically allow trusted development tools like git, brew, and node while still receiving notifications.
• Network Troubleshooting: Use the AI-provided insights to understand why a specific background process is attempting to connect to external servers.

Example Prompts

1. "OpenClaw, setup LuLu Monitor and guide me through the configuration of my telegram chat ID for notifications."
2. "Check the current status of the lulu-monitor service and verify that it is correctly intercepting outgoing network traffic."
3. "Switch my LuLu Monitor settings to auto-execute mode and set the default action to 'allow-once' for all known safe background processes."

Tips & Limitations

Always be cautious with 'Always Allow' rules, as they bypass future checks for that specific process. Ensure your sessions_spawn configuration is accurate, as failure to do so will result in silent alert drops. For advanced automation, always prefer the CLI method for triggering buttons, as standard message components do not support Telegram callback events.