Platform Healthcheck

Health check dashboard for agent platform APIs. Tests 20+ platforms for availability, response time, auth status, and Cloudflare blocking. Run: python3 scrip...

Summary and recommended actions: - What it will do: the skill runs a bundled Python script that requests every URL in data/platforms.json, optionally makes auth requests using API keys it finds in local config files, and saves results to data/history.json. - Why this is surprising: the skill's metadata declares no credentials or config-path requirements, yet platforms.json points to per-skill config files under ~/.clawdbot/skills/... and the script reads those files to extract API keys. It also probes local endpoints (127.0.0.1) which can reveal whether local services are running. - Risks: the script will access secret-containing config files in your home directory (read-only) and then include those tokens in outbound auth requests to the corresponding services. It does not appear to exfiltrate tokens to a third party, but it has access to secrets and will perform network requests using them. Probing local services can reveal internal state. - Before installing, consider: - Inspect data/platforms.json and remove or edit any entries whose auth_config points to config files you don't want read. - Inspect the code (scripts/healthcheck.py) yourself (it is bundled) and confirm the behavior is acceptable. - Run the script in an isolated account/container or with a restricted home directory if you want to avoid letting it read existing skill configs. - If you only want external checks, remove local entries (e.g., 127.0.0.1) and entries with auth_config fields. - If you are comfortable, the skill is coherent with a healthcheck purpose, but you should explicitly accept that it will read local config files and make auth requests using any found tokens. If you want, I can produce a minimal platforms.json that removes auth_config/local items, or show the exact lines in the script that read config files and perform auth requests so you can audit them further.

Type: OpenClaw Skill Name: platform-healthcheck Version: 1.0.0 The skill bundle is a platform health check tool designed to monitor the availability and authentication status of various agent APIs. The `scripts/healthcheck.py` script makes HTTP requests to predefined URLs and reads API keys from specific, skill-local configuration files (e.g., `~/.clawdbot/skills/clawquests/config.json`) to verify authentication. This behavior is consistent with its stated purpose of checking API key validity. There is no evidence of data exfiltration, unauthorized command execution, persistence mechanisms, or prompt injection attempts in `SKILL.md`. The use of `os.path.expanduser` to locate configuration files is standard for OpenClaw skills, and SSL verification is appropriately relaxed only for local loopback connections.