Security Monitor V15 T33

提供Linux/Unix服务器进程、网络、文件权限、敏感信息、日志和进程树的安全审计与异常行为检测工具。

This skill appears to be a local host audit tool and is internally coherent, but the source is unknown — review before running. Key points: (1) The script needs access to process lists, network state and filesystem; running as root (recommended for full checks) gives it full read access to sensitive files and secrets — only run on machines you control. (2) Inspect the full scripts/monitor.py for any network calls or hardcoded endpoints (exfiltration risks) before executing; the visible parts use subprocess and local scans which are expected, but the file was truncated in this review. (3) Test in an isolated environment (VM or container) first, and consider restricting scan directories (pass explicit paths) rather than scanning the whole filesystem. (4) If you plan automated runs (cron), ensure alerting integrations (email/webhook) are configured to trusted endpoints and credential handling is safe. (5) Because the skill has no known homepage or publisher reputation, prefer using well-known, audited tools for critical systems or perform a code audit prior to production use.

Type: OpenClaw Skill Name: security-monitor-v15-t33 Version: 1.0.0 The skill bundle is a legitimate system security auditing tool designed for Linux/Unix environments. The core script, `scripts/monitor.py`, performs comprehensive checks for suspicious processes (e.g., reverse shells, netcat listeners), unauthorized network connections, open ports, and insecure VNC configurations. It also includes a secret scanner that identifies the presence of API keys and passwords in configuration files and logs, but notably reports only the file paths and secret types rather than the sensitive values themselves. The instructions in `SKILL.md` and `README.md` are well-documented and align perfectly with the tool's defensive purpose, with no evidence of malicious intent, data exfiltration, or prompt-injection attacks.