mcpField
S
security-monitor

security-monitor

github.com/aaaaqwqSecurity11143 installsUpdated 1w ago
Repository

About security-monitor

security-monitor is a background security monitoring skill for Clawdbot deployments. It detects intrusion indicators and unusual activity, reporting through console output, JSON logs, and configurable Telegram alerts.

Key features

  1. 01Detect failed logins and brute-force attacks
  2. 02Identify port scans and unusual processes
  3. 03Monitor file changes and Docker health
  4. 04Write JSON logs and send alerts

Use cases

  1. 01Continuously monitor a Clawdbot deployment
  2. 02Investigate suspicious logins and port activity
  3. 03Spot unauthorized file changes or container issues

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/aaaaqwq/agi-super-team --skill security-monitor

After installing, type/security-monitorin Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

_meta.json
.clawhub/
origin.json
scripts/
monitor.cjs

Details

From the project README

Security Monitor Skill

When to use

Run continuous security monitoring to detect breaches, intrusions, and unusual activity on your Clawdbot deployment.

Setup

No external dependencies required. Runs as a background process.

How to

Start real-time monitoring
node skills/security-monitor/scripts/monitor.cjs --interval 60
Run in daemon mode (background)
node skills/security-monitor/scripts/monitor.cjs --daemon --interval 60
Monitor for specific threats
node skills/security-monitor/scripts/monitor.cjs --threats=credentials,ports,api-calls

What It Monitors

ThreatDetectionResponse
Brute force attacksFailed login detectionAlert + IP tracking
Port scanningRapid connection attemptsAlert
Process anomaliesUnexpected processesAlert
File changesUnauthorized modificationsAlert
Container healthDocker issuesAlert

Output

  • Console output (stdout)
  • JSON logs at /root/clawd/clawdbot-security/logs/alerts.log
  • Telegram alerts (configurable)

Daemon Mode

Use systemd or PM2 to keep monitoring active:

# With PM2
pm2 start monitor.cjs --name "clawdbot-security" -- --daemon --interval 60

Combined with Security Audit

Run audit first, then monitor continuously:

# One-time audit
node skills/security-audit/scripts/audit.cjs --full

# Continuous monitoring
node skills/security-monitor/scripts/monitor.cjs --daemon

Related skills

  • security-audit - One-time security scan (install separately)

Comments

Markdown supported