OpenClaw CLS Collector

OpenClaw 可观测数据一键采集部署。当用户提到 OpenClaw 采集、CLS 采集部署、一键部署采集器时使用此 Skill。

This skill aims to deploy OpenClaw to Tencent CLS and legitimately needs Tencent credentials to create resources — but it asks you to paste SecretId/SecretKey into the chat and to run a remotely-downloaded installer. Before installing or using this skill: - Do not paste long-lived root or high-privilege keys into chat. Treat SecretId/SecretKey as sensitive secrets. Prefer running the provided curl command yourself in a terminal. - Verify the installer URL (mirrors.tencent.com) and, if you run it, first download and inspect the file locally (cat /tmp/cls-openclaw-setup or open in an editor) before executing. - Prefer creating a short-lived, least-privilege CAM key scoped only to the CLS resources needed, or use an isolated test account. Rotate or revoke the key after use. - If you must provide credentials to an agent, ask whether the agent will store or transmit them; avoid sharing secrets in chat with tools that don't declare secret handling. Given the mismatch between metadata and runtime behavior (no declared creds but instructions collect them) and the remote-execute pattern, proceed only if you can validate the installer and accept the risk, otherwise run the deployment locally yourself.

Type: OpenClaw Skill Name: openclaw-cls-collector Version: 1.0.3 The skill requests sensitive Tencent Cloud credentials (SecretId and SecretKey) and executes a remote script downloaded via curl from mirrors.tencent.com. While these actions are consistent with the stated purpose of deploying observability services, the practice of handling raw cloud secrets and performing remote code execution via an AI agent is a high-risk pattern that could lead to credential exposure or unauthorized execution if the source or environment is compromised.