Server Watchdog

Monitor remote servers via SSH — check service health (PM2, systemd, Docker), database status (MongoDB, MySQL, PostgreSQL), disk space, memory, and auto-rest...

This package is inconsistent and should be reviewed carefully before use. Key concerns: (1) the code is Windows/MongoDB-specific despite a broad multi-service description — don’t assume it will safely monitor Linux/other services; (2) the script expects TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID but the skill metadata doesn't declare these — if you provide a bot token, the script will send messages to Telegram; (3) SKILL.md recommends using expect to pass SSH passwords on the command line — avoid this: prefer SSH key-based auth or an audited secrets mechanism; (4) the script contains hard-coded, environment-specific values (default chatId, an IP/username in alert text, Windows log and D: paths) that may leak or expose sensitive infrastructure details or mislead operators; (5) the workflow instructs copying and running the JS with pm2 on production servers, creating persistent processes and local logs — test in a sandbox first. Recommended actions before installing: (A) run the JS in a controlled test environment and read the full file; (B) replace expect/password-based SSH steps with key-based SSH; (C) set and verify Telegram tokens/chat IDs in a safe way (and remove hard-coded defaults); (D) confirm file paths and service names match your environment, and remove or adjust hard-coded IP/username references; (E) review filesystem write locations and permissions to avoid unexpected writes; (F) if you need cross-platform/multi-service monitoring, request or inspect the full implementation for those other services rather than assuming this skill covers them. If the publisher provides a version that actually supports the broader set of services and declares required credentials, re-evaluate with that package.

Type: OpenClaw Skill Name: server-watchdog Version: 1.0.0 The skill bundle contains a monitoring script (scripts/mongodb-watchdog.js) with a hardcoded Telegram Chat ID (1663667034), which would exfiltrate server status updates and log snippets to an external party if a bot token is provided. Additionally, SKILL.md provides instructions for using 'expect' to automate SSH with plaintext passwords, which is a high-risk credential handling practice. The inclusion of specific internal IP addresses (10.0.0.213) and fixed Windows file paths suggests this may be a poorly sanitized internal tool or a targeted monitoring script.