{"skill":{"slug":"aegis","displayName":"AEGIS","summary":"Automated Emergency Geopolitical Intelligence System — real-time threat monitoring and safety alerts for civilians in conflict zones. Use when: (1) setting u...","description":"---\nname: aegis\ndescription: \"Automated Emergency Geopolitical Intelligence System — real-time threat monitoring and safety alerts for civilians in conflict zones. Use when: (1) setting up warzone/crisis safety monitoring for a location, (2) user asks about security situation or threat level, (3) configuring emergency alert delivery, (4) generating security briefings, (5) emergency preparedness planning.\"\nhomepage: \"https://github.com/PleaseChooseUsername/aegis-openclaw-skill\"\nsource: \"https://github.com/PleaseChooseUsername/aegis-openclaw-skill\"\nrequires:\n  binaries:\n    - curl\n    - python3\n  env: []\n  optional_env:\n    - AEGIS_DATA_DIR\n    - AEGIS_BOT_TOKEN\n    - AEGIS_CHANNEL_ID\n  optional_config:\n    - \"api_keys.newsapi\"\n---\n\n# AEGIS — Automated Emergency Geopolitical Intelligence System\n\nCivilian-first threat intelligence for conflict zones. Monitors 28+ sources (RSS, web, APIs, OSINT aggregators) with two delivery modes:\n\n1. **CRITICAL-only scan** (every 15 min) — Posts ONLY for verified, active emergencies (3-phase validation)\n2. **Morning/evening briefings** (8am + 8pm local) — Agent-powered situation reports with actionable guidance\n\nPowered by **World Monitor** (real-time geopolitical intelligence API) and **LiveUAMap** (verified OSINT event feed), supplemented by government sources, major news agencies, and aviation data.\n\n**Not a panic tool.** Calm, factual, action-oriented. Follows official government guidance.\n\n## Requirements\n\n- **curl** — used for all HTTP fetching (RSS, web, APIs). Pre-installed on most systems.\n- **python3** (3.8+) — runs all scripts. No extra pip packages needed (stdlib only).\n- **No API keys required** for baseline 23 sources. Optional: NewsAPI free tier for expanded coverage.\n- **LLM (optional)** — Improves CRITICAL alert accuracy via semantic verification. See [LLM Verification](#llm-verification) below.\n\n## Quick Start\n\n### First-time setup (interactive)\n```bash\npython3 scripts/aegis_onboard.py\n```\nCreates `~/.openclaw/aegis-config.json` with location, language, and alert preferences.\n\n### Manual config\nCreate `~/.openclaw/aegis-config.json`:\n```json\n{\n  \"location\": {\n    \"country\": \"AE\",\n    \"country_code\": \"AE\",\n    \"city\": \"Dubai\",\n    \"timezone\": \"Asia/Dubai\"\n  },\n  \"language\": \"en\",\n  \"alerts\": { \"critical_instant\": true, \"high_batch_minutes\": 30, \"medium_digest_hours\": 6 },\n  \"briefings\": { \"morning\": \"07:00\", \"evening\": \"22:00\" },\n  \"scan_interval_minutes\": 15,\n  \"api_keys\": {}\n}\n```\n\n### Run a scan\n```bash\npython3 scripts/aegis_scanner.py\n```\n\n### Set up cron monitoring\n```\n# CRITICAL-only scan (every 15 min) — posts ONLY for imminent threats\nopenclaw cron add --every 15m --message \"Run AEGIS scan: python3 <skill-dir>/scripts/aegis_cron.py\"\n\n# Morning briefing (adjust time for user timezone — example: 4:00 UTC = 8:00 Dubai)\nopenclaw cron add --cron \"0 4 * * *\" --tz UTC --message \"Run AEGIS morning briefing: python3 <skill-dir>/scripts/aegis_briefing.py morning\"\n\n# Evening briefing (example: 16:00 UTC = 20:00 Dubai)\nopenclaw cron add --cron \"0 16 * * *\" --tz UTC --message \"Run AEGIS evening briefing: python3 <skill-dir>/scripts/aegis_briefing.py evening\"\n\n# Optional: Live feed (every 5 min) — for high-tempo situations only, disable during calm periods\nopenclaw cron add --cron \"*/5 * * * *\" --message \"Run AEGIS live feed: python3 <skill-dir>/scripts/aegis_feed.py\" --disabled\n```\n\n### Optional: Telegram channel delivery\nSet environment variables for direct channel posting:\n- `AEGIS_BOT_TOKEN` — Telegram bot token (from BotFather)\n- `AEGIS_CHANNEL_ID` — Telegram channel ID\n\nOr add to config:\n```json\n{\n  \"telegram\": {\n    \"bot_token\": \"your-token\",\n    \"channel_id\": \"-100xxxxxxxxxx\"\n  }\n}\n```\n\n## Data Storage\n\nAEGIS stores scan state in `~/.openclaw/aegis-data/` (or `$AEGIS_DATA_DIR` if set):\n- `seen_hashes.json` — content dedup hashes (48h rolling window for scans, 6h for feed)\n- `pending_alerts.json` — alerts awaiting batch delivery\n- `scan_log.json` — recent scan results\n- `last_scan.json` — most recent scan output (used by briefings)\n- `feed_state.json` — live feed dedup state and last post timestamp\n- `last_alert_time.json` — channel post cooldown tracker\n- `scan_history.log` — rolling log of scan results (last 500 entries)\n\nAll files are local JSON. No data is sent to external servers beyond the listed sources in `source-registry.json`.\n\n## Sources (30+)\n\nAll sources are defined in `references/source-registry.json`. The scanner **only** contacts URLs listed there.\n\n| Tier | Type | Count | Examples |\n|------|------|-------|----------|\n| 0 🏛️ | Government & Emergency | 7 | GDACS, NCEMA, UAE MoD, US/UK embassies, MOFAIC |\n| 1 📰 | Major News & RSS | 11 | Al Jazeera, Reuters, BBC, Gulf Business, Emirates 24/7, Gulf Today |\n| 2 🔍 | OSINT & Conflict Mapping | 5 | World Monitor API, LiveUAMap (3 regions + feed) |\n| 2 ✈️ | Aviation | 2 | FAA NOTAMs (DXB, AUH) |\n| 3 📋 | Analysis | 2 | Crisis Group, War on the Rocks |\n| 4 🔑 | API-Enhanced (optional) | 1+ | NewsAPI (free tier), GDELT |\n\n### Outbound connections\n\nThe scanner contacts **only**:\n1. URLs listed in `references/source-registry.json` (RSS feeds, news sites, government pages)\n2. `https://world-monitor.com/api/signal-markers` (World Monitor public API)\n3. LiveUAMap regional pages (e.g., `https://iran.liveuamap.com`)\n4. Telegram Bot API (`https://api.telegram.org/bot.../sendMessage`) — only if channel delivery is configured\n\nNo telemetry. No analytics. No phone-home.\n\n## Alert Classification\n\n| Level | Meaning | Trigger |\n|-------|---------|---------|\n| 🔴 CRITICAL | Immediate physical danger **in user's country** | Missiles inbound, sirens, shelter orders, airport shutdown, CBRN |\n| 🟠 HIGH | Significant regional threat | Attacks on neighbors, strait disrupted, flights cancelled, general \"UAE hit by\" context |\n| ℹ️ MEDIUM | Situational awareness | Regional strikes, diplomacy, oil prices, sanctions |\n\nCRITICAL is reserved for \"act now, your life may be in danger.\" Regional developments and background context are HIGH.\n\n### CRITICAL Validation Pipeline (v3.2)\n\nCRITICAL alerts go through 3-phase validation to eliminate false positives:\n\n1. **Regex pre-filter** — Tightened patterns match only active attacks, sirens, shelter orders\n2. **Negative pattern filter** — Disqualifies: past tense (\"has been hit\"), sports, analysis, speculation, historical context\n3. **LLM verification** (optional) — Confirms the item describes an ACTIVE emergency\n\nAdditionally:\n- **Government trust** — Tier 0 sources (NCEMA, government) bypass LLM verification\n- **Source corroboration** — Single source: 4h cooldown; 2+ sources: 1h cooldown\n- **Fail-open safety** — If LLM unavailable or disabled, CRITICAL alerts pass through (safety first)\n\n### LLM Verification\n\nLLM verification is **optional** but recommended. It adds a semantic check that catches false positives the regex filters miss (e.g., \"cricket match cancelled due to war\" triggering CRITICAL).\n\n**Three modes** (configured in `aegis-config.json` under `\"llm\"`):\n\n| Mode | Provider | Cost | Accuracy | Setup |\n|------|----------|------|----------|-------|\n| **Local Ollama** | `\"ollama\"` | Free (runs on your GPU) | Best | Install [Ollama](https://ollama.ai), pull a model |\n| **OpenAI-compatible API** | `\"openai\"` | ~$0.001/verification | Best | Any OpenAI-compatible endpoint (OpenRouter, Together, vLLM, LiteLLM, etc.) |\n| **No LLM** | `\"none\"` | Free | Good (regex + negative patterns only) | No setup needed |\n\n**Without LLM:** AEGIS still works well — the regex pre-filter and negative pattern filter catch most false positives. You may see occasional false CRITICAL alerts that would have been caught by LLM verification.\n\n**Config examples:**\n\n```json\n// Local Ollama (recommended if you have a GPU)\n\"llm\": { \"enabled\": true, \"provider\": \"ollama\", \"endpoint\": \"http://localhost:11434\", \"model\": \"qwen3:8b\" }\n\n// OpenRouter (cheap cloud API)\n\"llm\": { \"enabled\": true, \"provider\": \"openai\", \"endpoint\": \"https://openrouter.ai/api\", \"model\": \"meta-llama/llama-3-8b-instruct\", \"api_key\": \"sk-or-...\" }\n\n// No LLM (regex-only, no external calls)\n\"llm\": { \"enabled\": false, \"provider\": \"none\" }\n```\n\nThe onboarding wizard (`aegis_onboard.py`) will help you choose during setup.\n\n### Anti-Hoax Protocol\n- Tier 0 sources: trusted directly (government/emergency)\n- Tier 1+ CRITICAL candidates: must pass LLM semantic verification\n- Tier 2+: require corroboration from ≥1 Tier 0-1 source for HIGH\n- Social media: excluded entirely\n- Extraordinary claims: require ≥3 independent sources\n\n## Briefings\n\nMorning and evening briefings use agent-powered synthesis to create human-readable situation updates:\n\n### Situation Update Format\nEach briefing includes:\n- **Summary** — What happened in plain English with real numbers\n- **Status** — Current safety status (threat level with description)\n- **Actions** — 4-6 concrete things a civilian should do right now\n- **Daily Impact** — Flights, schools, work, supplies, roads, hospitals\n- **Outlook** — What to expect in the next 12-24 hours\n- **Sources** — Where to verify and get more info\n\n### Delivery Modes\n| Mode | Frequency | Posts on |\n|------|-----------|---------|\n| **CRITICAL scan** | Every 15 min | Imminent danger only (missiles inbound, shelter orders) |\n| **Morning briefing** | Once daily (8am local) | Full situation update with overnight summary |\n| **Evening briefing** | Once daily (8pm local) | Full situation update with daytime summary |\n| **Live feed** | Every 5 min (optional) | Discrete verified events from LiveUAMap + World Monitor |\n\n### Anti-Spam\n- CRITICAL scan: 4-hour cooldown (single source) / 1-hour cooldown (multi-source corroborated)\n- Live feed: 5-minute batch interval, max 8 events per post\n- Briefings: Agent-powered, pin to channel, once per cycle\n\n## Country Profiles\n\nEach supported country has a profile in `references/country-profiles/`. Profiles contain:\n- Emergency contacts and hotlines\n- Neighboring countries and regions of interest (for source filtering)\n- Local threat keyword patterns\n- Shelter and evacuation info\n\nCurrently available: **UAE** (`uae.json`). To add a country: copy `_template.json`, fill in details, submit PR.\n\n## Preparedness Resources\n\nSee `references/preparedness/` for:\n- `go-bag-checklist.md` — What to pack for emergency evacuation\n- `communication-plan.md` — Family communication plan\n- `shelter-guidance.md` — Shelter-in-place protocol\n- `evacuation-guidance.md` — Routes, transport, embassy registration\n\n## Configuration Reference\n\nSee `references/config-reference.md` for all configuration options.\n\n## Cost\n\n- **Sources (30+):** Free (RSS + web scraping + public APIs)\n- **LLM verification (optional):** Free with Ollama; ~$0.001/check with cloud APIs; or disabled (regex-only)\n- **Briefings:** Free with Copilot or local models; ~$0.03-0.05/day with commercial LLMs\n- **Optional NewsAPI:** Free tier (100 req/day) is sufficient\n","tags":{"latest":"3.4.0"},"stats":{"comments":1,"downloads":948,"installsAllTime":4,"installsCurrent":4,"stars":1,"versions":13},"createdAt":1772801844218,"updatedAt":1778491751707},"latestVersion":{"version":"3.4.0","createdAt":1773652174418,"changelog":"Incident-level dedup: prevents channel spam. Multiple reports about the same event (e.g., 7 DXB airport updates) now collapse into 1 alert.","license":"MIT-0"},"metadata":{"setup":[],"os":null,"systems":null},"owner":{"handle":"pleasechooseusername","userId":"s174fd2g09nvqe7dezwzzeh93d884vc0","displayName":"PleaseChooseUsername","image":"https://avatars.githubusercontent.com/u/155990435?v=4"},"moderation":{"isSuspicious":false,"isMalwareBlocked":false,"verdict":"clean","reasonCodes":["review.llm_review"],"summary":"Review: review.llm_review","engineVersion":"v2.4.24","updatedAt":1780089915025}}