Truenas Skill

Manage TrueNAS SCALE via API. Check pool health, manage datasets and snapshots, monitor alerts, control services, manage apps, orchestrate Dockge container stacks, and manage bookmarks. Use when the user asks about their NAS, storage, backups, containers, bookmarks, or homelab services.

This skill appears to be what it claims, but review and follow these precautions before installing: 1) Use a least-privilege TrueNAS API key (read-only where possible). 2) Prefer TRUENAS_VERIFY_TLS=1 and valid certificates; only disable TLS verification if you understand the risk of man-in-the-middle attacks on your LAN. 3) Only provide optional service credentials (Dockge, Sonarr, Radarr, Plex, etc.) that you intend the skill to access — every credential you supply increases exposure. 4) If you run the included Node scripts, run npm install in a controlled environment and review package-lock.json; the dependencies are common WebSocket/socket.io libs but are fetched from npm. 5) Inspect/trust the GitHub source (homepage) or run the skill in an isolated agent environment if you are unsure.

Type: OpenClaw Skill Name: truenas-skill Version: 1.2.0 The skill is classified as suspicious due to its default insecure TLS configuration (`curl -k`, `rejectUnauthorized: false`) for TrueNAS, which is explicitly mentioned and justified in `SKILL.md` and implemented in `scripts/truenas-ws.mjs`. While an override (`TRUENAS_VERIFY_TLS=1`) is provided, this default behavior introduces a potential Man-in-the-Middle vulnerability. Additionally, the skill is designed to handle a large number of sensitive API keys and URLs for various homelab services (e.g., `TRUENAS_API_KEY`, `DOCKGE_USER/PASS`, `SONARR_API_KEY`, `RADARR_API_KEY`, etc.) as environment variables, which, while necessary for its stated purpose, significantly expands the attack surface for credential exposure if the agent environment is compromised. There is no evidence of intentional malicious behavior like data exfiltration to unauthorized third parties or backdoors.