lulu-monitor

What This Skill Does

LuLu Monitor is an advanced AI-powered integration for the LuLu Firewall on macOS. It acts as a proactive security layer, sitting between your firewall's raw alert popups and your decision-making process. Rather than relying on simple intuition or manual review, the skill captures connection metadata—including the initiating process, destination IP addresses, ports, and DNS resolution—and immediately passes this data to an AI model (haiku). The AI analyzes the connection context, assesses potential risks, and pushes a summarized, actionable report directly to your Telegram interface.

Key features include:

• Intelligent Alert Analysis: Automatically determines if a connection is suspicious or routine.
• Remote Interaction: Four distinct action buttons allow you to manage LuLu rules (Always Allow, Allow Once, Always Block, Block Once) remotely.
• Auto-Execute Mode: For power users, the skill can automatically handle trusted software traffic, drastically reducing alert fatigue.
• Real-time Monitoring: Bridges the gap between macOS desktop events and mobile notifications, ensuring you are aware of your network perimeter activity at all times.

Installation

To install LuLu Monitor, ensure you have LuLu Firewall, Node.js, and an active OpenClaw Gateway installed. Begin by running the prerequisite check script: bash scripts/check-prerequisites.sh. Once verified, execute the installation script bash scripts/install.sh, which automates repository cloning, dependency installation, and launchd configuration. Finally, verify the service is operational by querying the local status endpoint at http://127.0.0.1:4441/status.

Use Cases

• Remote Security Management: Manage firewall rules while away from your Mac, receiving push notifications when unknown applications attempt to dial out.
• Audit & Investigation: Review past connection logs for suspicious patterns or unauthorized background process activity.
• Developer Workflow Optimization: Automatically permit development tools like node, curl, and git to bypass manual firewall confirmation while keeping logs of their activity.
• Incident Response: Quickly identify and block malicious exfiltration attempts by seeing the process tree and destination data directly on your phone.

Example Prompts

1. "Check the current status of the LuLu Monitor and tell me how many connections were auto-allowed today."
2. "Enable auto-execute mode for LuLu Monitor with conservative settings for known safe binary connections."
3. "Summarize the last five blocked connections from my LuLu monitor logs."

Tips & Limitations

• Privacy: The skill processes sensitive connection data through an AI model; ensure your OpenClaw environment is secured.
• Permissions: Ensure that Terminal and osascript have Accessibility permissions enabled in System Settings, or the skill will fail to interact with LuLu windows.
• AI Accuracy: While the model is highly effective, always manually verify high-risk or unrecognized processes, especially when using Auto-Execute mode.