Security Monitor

This skill's code aligns with a monitoring purpose, but it reads system auth logs and project .env files under /root without declaring that access. Before installing: 1) Inspect the script yourself (the repository includes scripts/monitor.cjs) to confirm there are no network exfiltration calls — the current file logs locally and has no implemented external alerts, but it will expose contents of .env if present. 2) Understand that it writes logs/state to /root/clawd/clawdbot-security and may need to be run as root to access /var/log/auth.log and /root paths; run it in a sandbox or container if you cannot grant that access. 3) If you expect Telegram alerts, note the Telegram send is a TODO — no remote alerting is implemented. 4) If you want to proceed, consider limiting what .env files contain (remove high-value secrets), adjust watched paths to less-sensitive locations, or modify the script to require explicit credentials/configuration for any credential checks. 5) Prefer running only after code review or on a test instance; ask the publisher for an explanation of why the skill must read /root/clawd/skills/.env and for a threat model that justifies reading root-owned logs. If the author provides a version that only reads declared, documented paths (or documents required permissions), the assessment could move to benign.