security-monitor

Monitors Clawdbot systems for intrusions, anomalous API calls, and credential misuse.

Updated Feb 10, 2026
One-click install
npx skills add https://github.com/delorenj/00_ceiling --skill security-monitor-delorenj
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-monitor
Source: https://github.com/delorenj/00_ceiling/tree/main/security-monitor
Command: npx skills add https://github.com/delorenj/00_ceiling --skill security-monitor-delorenj

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill provides continuous, real-time monitoring of your Clawdbot deployment to detect and alert on security breaches, intrusions, and unusual system activity.

Core Features & Use Cases

  • Intrusion Detection: Monitors for brute-force attacks, port scanning, and unexpected process behavior.
  • Credential Monitoring: Alerts on suspicious API key usage patterns.
  • System Integrity: Detects unauthorized file modifications and container health issues.
  • Use Case: Automatically detect and alert on a brute-force login attempt targeting your Clawdbot server, including the source IP address.

Quick Start

Start real-time security monitoring with a 60-second interval.

Frequently Asked Questions about security-monitor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect brute-force attacks and port scanning on my server in real-time?

Real-time credential monitoring tracks API key usage patterns to alert on suspicious activity. It detects anomalous API calls and potential credential misuse by continuously logging security alerts to a file for review.

Can I run continuous security monitoring as a background daemon process?

Yes, continuous security monitoring supports daemon mode for background operation. You can configure it with a 60-second interval to repeatedly check for system anomalies, process behavior changes, and file modifications without manual intervention.

What is the best way to monitor for unauthorized file modifications and container health issues?

System integrity monitoring detects unauthorized file changes and container health issues by running continuous checks. It logs these security anomalies to an alert file, ensuring you are notified of unexpected system activity or degraded container states.

Does real-time threat detection work for catching anomalous API calls and process anomalies?

Yes, real-time threat detection works by monitoring for anomalous API calls and unexpected process behavior. It continuously evaluates system activity against expected baselines, logging security alerts for process anomalies and suspicious credential usage.