A lightweight host-based intrusion detection system (HIDS) providing continuous background security monitoring for Linux and macOS.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install reefwatch
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install reefwatch using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is ReefWatch?
ReefWatch is a robust security daemon designed to provide host-level protection by monitoring your local machine for a wide array of threats. As part of the Openclaw Skills ecosystem, it functions as an independent background process that identifies malware, brute-force attacks, and unauthorized system changes without consuming LLM tokens during its monitoring phase.
By leveraging industry-standard detection engines like YARA and Sigma, ReefWatch ensures that your development environment remains secure. It specifically targets suspicious process behavior, file tampering, and network anomalies, only alerting the user via the Openclaw Skills framework when a legitimate threat is identified, thereby minimizing noise and maximizing security oversight.
ReefWatch Use Cases
- Detecting brute-force SSH or login attempts in real-time logs.
- Scanning for malware, webshells, and cryptominers using YARA signatures.
- Monitoring system integrity to detect unauthorized privilege escalation.
- Identifying suspicious background processes or network connections.
- Performing on-demand manual security scans of specific project directories.
How ReefWatch Works
- Data collectors continuously ingest system logs, process lists, and file metadata.
- The Detection Engine processes this data using YARA, Sigma, and custom-defined rulesets.
- When a match is found, the Alert Manager evaluates the severity and generates a threat report.
- The daemon sends a secure payload to the Openclaw Skills local webhook endpoint.
- OpenClaw processes the notification and alerts the user through their preferred communication channel.
ReefWatch Setup
To initialize ReefWatch within your environment, follow these steps:
# Install necessary Python dependencies
pip3 install -r ~/.openclaw/workspace/skills/reefwatch/requirements.txt --quiet
# Download and initialize the security rulesets
python3 ~/.openclaw/workspace/skills/reefwatch/setup_rules.py
# Launch the daemon process in the background
nohup python3 ~/.openclaw/workspace/skills/reefwatch/reefwatch_daemon.py \
--webhook-url "http://127.0.0.1:18789/hooks/wake" \
--webhook-token "${OPENCLAW_HOOKS_TOKEN}" \
--config ~/.openclaw/workspace/skills/reefwatch/reefwatch_config.yaml \
> ~/.openclaw/logs/reefwatch.log 2>&1 &
ReefWatch Data Schema & Taxonomy
| Component | Storage Path | Description |
|---|---|---|
| Alert History | alert_history.jsonl |
A persistent, line-delimited JSON log of all security events. |
| Rulesets | skills/reefwatch/rules/ |
Directory containing YARA (.yar) and Sigma (.yml) definitions. |
| System Logs | ~/.openclaw/logs/reefwatch.log |
Technical execution logs and collector status information. |
| Configuration | reefwatch_config.yaml |
User-defined settings for scan frequency and threshold levels. |
ReefWatch Advanced Features
- Resource-efficient monitoring that scans only changed files to minimize CPU impact.
- Automated rule updates to keep protection current with the latest threat intelligence.
- Support for custom Sigma rules to monitor specific application-level logs.
- Self-recovering collector architecture that handles individual component failures gracefully.
- Deep integration with Openclaw Skills for automated incident response and notification.
SKILL.md
Loading
Related Openclaw Skills
supurr
A professional-grade CLI for backtesting and deploying automated trading strategies on the Hyperliquid DEX.
Dialogflow CX to Studio Migration
Automate the migration of Dialogflow CX agents into CX Agent Studio using official Google Cloud REST and RPC APIs.
Dialogflow CX NLU
A specialized toolset for managing NLU components within Google Dialogflow CX using the v3beta1 REST API.
Dialogflow CX Flows
Programmatically manage conversation flows and pages within Google Dialogflow CX using the v3beta1 REST API.
Claude Code Orchestrator
A tmux-based orchestration tool for managing long-running Claude Code development tasks with high visibility and automated callbacks.
Claude Code Orchestrator (tmux-first)
A robust orchestration framework for running Claude Code in observable tmux sessions with automated progress tracking and completion callbacks.
METADATA
Featured*
