Synology Surveillance

Steuere Synology Surveillance Station Kameras über die Web API. Nutze diesen Skill für Snapshots, Live-Streams, Aufnahmen, PTZ-Steuerung und Ereignis-Überwachung. Erfordert Synology NAS mit Surveillance Station.

This skill appears to implement legitimate Synology API calls, but there are several issues to consider before installing: - Metadata vs reality: The registry says no environment variables are required, yet the script needs SYNOLOGY_PASS (and usually SYNOLOGY_USER). Ask the publisher to declare required env vars and mark the primary credential. - Do not store credentials in plaintext files (TOOLS.md). Prefer using the platform's secret store or environment variables protected by the agent host. - The SKILL.md recommends disabling 2FA for the API user — avoid doing this if possible. Create a dedicated, scoped service account with minimal privileges and use HTTPS. - The script contains a bug in BASE_URL generation: it uses "http${SYNO_HTTPS:+s}://..." and because SYNO_HTTPS defaults to the non-empty string "false" this will expand to "https://" even when the user intends HTTP. That can cause port/protocol mismatches. The conditional should check the value (e.g., test for "true") rather than non-empty. - The skill uses plain HTTP examples and may send passwords over unencrypted connections. Ensure you use HTTPS (and correct ports) when exposing credentials or run it only on a trusted LAN. - Because this is an instruction+script package from an unknown source, review the shell script line‑by‑line locally before running it, and test with a throwaway surveillance account and network-isolated NAS if possible. If you intend to use it: ask the author to (1) fix the SYNO_HTTPS logic, (2) declare required env vars in the package metadata, and (3) remove guidance to disable 2FA and to store passwords in TOOLS.md (or explicitly document secure alternatives). Once those are addressed the package would be much more acceptable.

Type: OpenClaw Skill Name: synology-surveillance-skill Version: 0.1.0 The skill is designed to control Synology Surveillance Station cameras via its Web API. The `SKILL.md` provides clear instructions for the AI agent and user, without any prompt injection attempts or instructions to perform actions outside the stated purpose. The `scripts/syno-surveillance.sh` bash script correctly implements the described functionality, using `curl` to interact with the user-configured Synology NAS and `jq` for JSON parsing. It handles session cookies in a temporary file and cleans up. There is no evidence of data exfiltration, malicious execution, persistence, or obfuscation. The handling of credentials (password) is necessary for the skill's function and is done via environment variables or `TOOLS.md`, which are standard mechanisms for OpenClaw skills.