Initial commit: custom OpenClaw skills from docker-test

- workspace: capmetro-monitor, github-notifications, model-selector
- workspace-security: vt-monitor, monitor-unauthorized
- workspace-home: cron-manager, monitor-unauthorized
- extensions: vt-sentinel (VT-Sentinel plugin)

Includes sync.sh for pull/push, README, AGENTS.md, .gitignore.

workspace-security/vt-monitor/scripts/log-splitter.sh

@@ -0,0 +1,51 @@
+#!/bin/bash
+# VT-Sentinel log splitter — extracts sentinel entries into dedicated log
+# Usage: bash log-splitter.sh [start|stop|status]
+set -eo pipefail
+
+GATEWAY_LOG="/tmp/openclaw/openclaw.log"
+VT_LOG="/tmp/openclaw/vt-sentinel.log"
+PID_FILE="/tmp/openclaw/vt-log-splitter.pid"
+PATTERN="VT-Sentinel\|vt-sentinel\|vtsentinel"
+
+start() {
+    # Kill existing
+    stop 2>/dev/null || true
+    
+    # Start tail from current end of file
+    nohup tail -F "$GATEWAY_LOG" 2>/dev/null \
+        | grep --line-buffered -i "$PATTERN" \
+        >> "$VT_LOG" 2>/dev/null &
+    echo $! > "$PID_FILE"
+    echo "Started (PID $(cat $PID_FILE)), writing to $VT_LOG"
+}
+
+stop() {
+    if [ -f "$PID_FILE" ]; then
+        PID=$(cat "$PID_FILE")
+        # Kill the tail pipeline (parent + children)
+        pkill -P "$PID" 2>/dev/null || true
+        kill "$PID" 2>/dev/null || true
+        rm -f "$PID_FILE"
+        echo "Stopped"
+    else
+        echo "Not running"
+    fi
+}
+
+status() {
+    if [ -f "$PID_FILE" ] && kill -0 "$(cat $PID_FILE)" 2>/dev/null; then
+        echo "Running (PID $(cat $PID_FILE))"
+        [ -f "$VT_LOG" ] && echo "Log size: $(du -h "$VT_LOG" | cut -f1), $(wc -l < "$VT_LOG") lines"
+    else
+        echo "Not running"
+        rm -f "$PID_FILE" 2>/dev/null
+    fi
+}
+
+case "${1:-start}" in
+    start)  start ;;
+    stop)   stop ;;
+    status) status ;;
+    *)      echo "Usage: $0 [start|stop|status]" ;;
+esac