Query AWS CloudWatch metrics for ECS/EC2/RDS and return charts.

This skill appears to do exactly what it claims: call CloudWatch GetMetricStatistics and summarize datapoints. Before installing, note three practical points: (1) Metadata omissions — the registry incorrectly omits Node.js and AWS env vars; you must have Node.js available and set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (or otherwise supply credentials) for it to work. (2) Credentials — the skill uses raw credentials to sign requests. Use least-privilege credentials (policy scoped to CloudWatch Read/GetMetricStatistics and any required resource access), prefer short-lived credentials or an instance/role where possible, and avoid exposing long-lived root credentials. (3) Source trust — the skill's source/homepage is unknown. The code is short and readable (no obfuscated network endpoints), but if you plan to run it in production, review the code yourself or run it in an isolated environment. If you want tighter security, require the author to declare required binaries/env vars in metadata and to provide a verifiable source URL or package repository.

Type: OpenClaw Skill Name: aws-cloud-watch Version: 0.0.1 The skill is designed to query AWS CloudWatch metrics. It is classified as suspicious due to two main vulnerabilities. First, it implements AWS SigV4 signing manually in `src/cli.mjs`, a complex cryptographic protocol that is highly prone to subtle security flaws if not perfectly implemented. Second, `src/skill.mjs` uses `child_process.spawnSync` with `shell: true` on Windows, directly forwarding user-controlled arguments, which creates a shell injection vulnerability allowing arbitrary command execution if malicious input is provided (e.g., via prompt injection against the agent).