Service Watchdog

Monitors self-hosted services by checking HTTP endpoints, TCP ports, SSL expiry, and DNS resolution, then reports status and alerts in concise, chat-friendly...

This skill appears coherent and limited to local monitoring, but before installing: 1) inspect the full watchdog.sh for any alerting/webhook blocks (the SKILL.md doesn't describe sending data to external endpoints; if the script contains webhook integrations, verify the endpoints and auth are ones you expect); 2) be aware it will create and append a history CSV in the workspace (set WATCHDOG_WORKSPACE or use --no-history if you don't want files written); 3) run it in a controlled environment (container or non-sensitive workspace) first to confirm behavior; 4) ensure only allowed hosts/domains are placed in watchdog.json to avoid scanning unintended targets; and 5) verify required utilities (curl, jq, openssl, nc/dig) are the versions you trust. If you want higher assurance, provide the full, untruncated watchdog.sh for a line-by-line audit.

Type: OpenClaw Skill Name: service-watchdog Version: 1.0.0 The `watchdog.sh` script is highly vulnerable to shell injection, allowing for Remote Code Execution (RCE). Values read from the `watchdog.json` configuration file (e.g., `url`, `host`, `port`, `domain`, `method`) are directly interpolated into commands executed via `curl`, `nc`, `ncat`, `dig`, `nslookup`, `host`, and `openssl` without proper sanitization. A critical example is the `check_tcp` function's fallback to `bash -c "echo >/dev/tcp/${host}/${port}"`, where a malicious `host` value in `watchdog.json` could lead to arbitrary command execution. While the skill's stated purpose is benign, these vulnerabilities pose a significant security risk if an attacker can control the `watchdog.json` file.