Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Audit round 3: instant shutdown via RUNNING.wait(), O_NOFOLLOW on all writes, IPv6 URL bracketing, IOC subdomain matching, systemd hardening (12 directives), git SHA verification, 188 tests
What This Skill Does
ReefWatch is a host-based intrusion detection daemon for Linux and macOS. It continuously scans for brute-force attacks, malware, privilege escalation, file tampering, cryptominers, and network anomalies using YARA, Sigma, and custom rules. Alerts are sent to the user only when a real threat is detected, with no LLM token usage during idle monitoring.
Runs as a background daemon without consuming LLM tokens during monitoring, so continuous host-level threat detection adds no per-check cost.
When to use it
- Monitoring a home server for SSH brute-force attempts
- Detecting cryptomining malware on a developer workstation
- Scanning a downloaded binary for malware before execution
- Watching for unauthorized file changes on a Linux host
- Getting alerted when a process attempts privilege escalation
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Start monitoring my system for security threats
- 1Install Python dependencies from requirements.txt
- 2Download initial YARA and Sigma rulesets via setup_rules.py
- 3Launch reefwatch_daemon.py in the background with the local webhook URL and token
- 4Save the daemon PID to /tmp/reefwatch.pid
- 5Confirm to the user that monitoring is active
ReefWatch is now active. I'll alert you if any threats are detected.