Security audit
Security checks across malware telemetry and agentic risk
LuLu Monitor has a coherent firewall-helper purpose, but it installs persistent unpinned remote code and can let AI-controlled actions change firewall rules.
Review the GitHub repository and npm dependencies before installing, because the submitted skill fetches and runs code outside the reviewed artifact. Keep auto-execute disabled unless you accept automatic firewall changes, prefer temporary allow/block actions, and remove the LaunchAgent and Accessibility permission when you no longer need the monitor.
## Auto-Execute Mode (Optional) For reduced interruptions, enable auto-execute mode. When the AI has high confidence (known safe programs like curl, brew, node, git connecting to normal destinations), it will: 1. Automatically execute the Allow action 2. Still send a Telegram notification explaining what was auto-allowed **To enable:**
5. Provides 4 action buttons: Always Allow, Allow Once, Always Block, Block Once 6. Executes the action on LuLu when user taps a button ## Auto-Execute Mode (Optional) For reduced interruptions, enable auto-execute mode. When the AI has high confidence (known safe programs like curl, brew, node, git connecting to normal destinations), it will: 1. Automatically execute the Allow action
## Auto-Execute Mode (Optional) For reduced interruptions, enable auto-execute mode. When the AI has high confidence (known safe programs like curl, brew, node, git connecting to normal destinations), it will: 1. Automatically execute the Allow action 2. Still send a Telegram notification explaining what was auto-allowed
cat > ~/.openclaw/lulu-monitor/config.json << 'EOF'
{
"telegramId": "YOUR_TELEGRAM_ID",
"autoExecute": true,
"autoExecuteAction": "allow-once"
}
EOF**Options:** - `autoExecute`: `false` (default) - all alerts require manual button press - `autoExecuteAction`: `"allow-once"` (default, conservative) or `"allow"` (permanent rule) ## Installation
mkdir -p "$LAUNCH_AGENTS" # Create launchd plist cat > "$LAUNCH_AGENTS/$PLIST_NAME" << EOF <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0">
echo "" echo "🔄 Starting service..." mkdir -p "$INSTALL_DIR/logs" launchctl unload "$LAUNCH_AGENTS/$PLIST_NAME" 2>/dev/null || true launchctl load "$LAUNCH_AGENTS/$PLIST_NAME" # Verify service is running
echo "🔄 Starting service..." mkdir -p "$INSTALL_DIR/logs" launchctl unload "$LAUNCH_AGENTS/$PLIST_NAME" 2>/dev/null || true launchctl load "$LAUNCH_AGENTS/$PLIST_NAME" # Verify service is running sleep 2
echo "🔄 Starting service..." mkdir -p "$INSTALL_DIR/logs" launchctl unload "$LAUNCH_AGENTS/$PLIST_NAME" 2>/dev/null || true launchctl load "$LAUNCH_AGENTS/$PLIST_NAME" # Verify service is running sleep 2
65/65 vendors flagged this skill as clean.
No suspicious patterns detected.