Real-time monitoring dashboard for API uptime, response times, error rates, custom health checks, and alert notifications via email or Slack.

This skill appears to implement a simple API-monitoring dashboard, but fix the inconsistencies before running it. Specifically: - The start action does not launch the Node server. After running ./monitor.sh start you must run node server.js (Node 18+) yourself to run the dashboard. Consider modifying monitor.sh to run node server.js in the background if you expect automatic startup. - The add action depends on jq, but jq is not documented in SKILL.md or the registry metadata. Install jq or change the script to avoid it. The script's declared 'required binaries: none' is inaccurate. - The status command expects data/*.json files, but nothing in the provided code writes to data/; expect the status output to be empty unless you add code to persist checks. - The monitor will perform HTTP requests to any endpoint you add. Do not add untrusted or internal-only URLs unless you understand the network exposure (this can cause requests to internal services or external hosts you do not intend to contact). Recommendations before installing/using: - Inspect/modify monitor.sh and the generated server.js to start the server automatically and to persist monitoring results if you need the status command to work. - Install Node 18+ and jq (or remove jq usage). - Run the script in an isolated environment (container) if you will monitor untrusted endpoints, and review endpoints.json before starting. - If you are not comfortable editing the script, do not run it with elevated privileges; run it from a dedicated directory and avoid running as root.

Type: OpenClaw Skill Name: api-monitor-dashboard Version: 1.0.0 The `monitor.sh` script contains a critical shell injection vulnerability in the `add` command, where the `$URL` variable is expanded inside double quotes (`jq ". += [\"$URL\"]"`), allowing for arbitrary command execution if a malicious URL is provided. Additionally, the script dynamically generates a Node.js server (`server.js`) that lacks input validation and contains logic errors (e.g., the `status` command looks for files in `data/*.json` that the server never creates). While these are severe security flaws, they appear to be unintentional programming errors rather than deliberate malware.