Nex Healthcheck

Multi-service health and uptime monitoring dashboard for websites, APIs, infrastructure, and applications across multiple systems. Monitor website availabili...

This repo looks like a legitimate local health/uptime monitor. Before installing: (1) Review and run setup.sh yourself (it creates ~/.nex-healthcheck and a ~/.local/bin wrapper and can install a user systemd timer). (2) Only add SSH targets you control — the ssh_cmd check runs arbitrary commands on remote hosts and will execute whatever you configure. (3) Telegram env vars are only needed for notifications; you can run checks without them. (4) All data is stored in a local SQLite DB (~/.nex-healthcheck/healthcheck.db); consider file permissions and backup needs. (5) Note there are some minor code issues (parsing/exception edge-cases) but nothing that indicates deliberate misdirection or hidden exfiltration. If you need higher assurance, run the tool in a contained environment (dedicated account or container) and audit any configured SSH targets and the token you supply to Telegram.

Type: OpenClaw Skill Name: nex-healthcheck Version: 1.0.0 The skill bundle provides infrastructure monitoring but is classified as suspicious due to high-risk implementation flaws. Specifically, lib/checkers.py uses subprocess.check_output with shell=True and unvalidated string interpolation for Docker, systemd, and SSH-based checks, creating a significant shell injection surface. While the tool's features—including remote command execution and an optional systemd persistence timer in setup.sh—are consistent with its stated purpose, the lack of input sanitization poses a major security risk if the agent is manipulated via prompt injection. IOCs include the project homepage nex-ai.be and api.telegram.org.