Initial commit: custom OpenClaw skills from docker-test

- workspace: capmetro-monitor, github-notifications, model-selector
- workspace-security: vt-monitor, monitor-unauthorized
- workspace-home: cron-manager, monitor-unauthorized
- extensions: vt-sentinel (VT-Sentinel plugin)

Includes sync.sh for pull/push, README, AGENTS.md, .gitignore.

workspace/model-selector/SKILL.md

@@ -0,0 +1,86 @@
+---
+name: model-selector
+description: Safely change an agent's primary and fallback models by validating IDs against the live LLM proxy model list. Use for model switches, fallback chain updates, and model-availability troubleshooting.
+---
+
+# Model Selector
+
+## Core Rules
+
+1. Validate model IDs against `/v1/models` before proposing changes.
+2. Keep at least 2 fallback models.
+3. Do not remove a primary model without setting a replacement.
+4. Use exact IDs from the model catalog; do not guess.
+5. Prefer provider diversity in fallbacks.
+6. Get explicit user approval before writing config.
+7. Treat `/model` as temporary; it creates per-session overrides.
+8. After backend default changes, clear session pins and reset active sessions.
+
+## Workflow
+
+### 1) Fetch Available Models
+
+```bash
+bash {baseDir}/scripts/list-models.sh
+bash {baseDir}/scripts/list-models.sh --providers
+```
+
+### 2) Validate Candidate IDs
+
+```bash
+bash {baseDir}/scripts/validate-model.sh "nvidia_nim/moonshotai/kimi-k2.5"
+```
+
+### 3) Inspect Current Configuration
+
+```bash
+bash {baseDir}/scripts/show-current.sh
+```
+
+### 4) Apply Backend Model Changes
+
+```bash
+# Primary only
+bash {baseDir}/scripts/update-model.sh --primary "nanogpt/moonshotai/kimi-k2.5"
+
+# Fallbacks only
+bash {baseDir}/scripts/update-model.sh --fallbacks "nvidia_nim/moonshotai/kimi-k2.5,chutes/zai-org/GLM-5-TEE"
+
+# Primary + fallbacks
+bash {baseDir}/scripts/update-model.sh \
+  --primary "nanogpt/moonshotai/kimi-k2.5" \
+  --fallbacks "nvidia_nim/moonshotai/kimi-k2.5,chutes/zai-org/GLM-5-TEE"
+```
+
+### 5) Required Rollout Sequence (Do Not Skip)
+
+1. Clear per-session model pins so defaults can apply.
+2. Restart gateway so in-memory runtime state reloads config.
+3. In active channels/threads, run `/reset` (or `/new`) before testing.
+
+Use pin cleanup helper:
+
+```bash
+# Clear all session model pins for an agent
+bash {baseDir}/scripts/clear-session-model-pins.sh --agent home
+
+# Clear only one channel session family
+bash {baseDir}/scripts/clear-session-model-pins.sh --agent home --channel 1470162839284224184
+```
+
+## Model ID Format
+
+- Catalog ID format: `<provider>/<model-path>`
+- Config reference format: `llm-proxy/<catalog-id>`
+
+Examples:
+- `nanogpt/moonshotai/kimi-k2.5` -> `llm-proxy/nanogpt/moonshotai/kimi-k2.5`
+- `nvidia_nim/moonshotai/kimi-k2.5` -> `llm-proxy/nvidia_nim/moonshotai/kimi-k2.5`
+
+For `/model` inside a session, use catalog IDs (without `llm-proxy/`).
+
+## Troubleshooting Quick Checks
+
+1. Model missing: rerun `list-models.sh` and validate exact ID.
+2. Old model still used: clear session pins + restart gateway + `/reset`.
+3. Unexpected fallbacks: confirm fallback chain order in `show-current.sh`.