Nomad

Query HashiCorp Nomad clusters. List jobs, nodes, allocations, evaluations, and services. Read-only operations for monitoring and troubleshooting.

This skill appears to do what it says (read-only Nomad queries), but there are important mismatches and sensitive-data risks to consider before installing: - Metadata mismatch: The SKILL.md requires NOMAD_ADDR and (optionally) NOMAD_TOKEN and TLS cert/key paths, but the registry metadata lists no required environment variables. Ask the publisher to update metadata to declare these requirements so you know what the skill will need. - Sensitive access: If you provide NOMAD_TOKEN or client certs, the skill (when invoked) can read variables and allocation logs that may contain secrets or private data. Only supply a token with the minimal scope (read-only, least privilege) and consider using a token limited to specific namespaces/paths. - Helper tools: Example commands use jq and grep and shell substitution; ensure the runtime environment has those tools and that command examples are safe for your use. The registry should list jq if it's required by common patterns. - Deployment considerations: Run this skill only in a trusted context that can access the Nomad API (NOMAD_ADDR). If you don't want the agent to reach your cluster, do not set NOMAD_ADDR/NOMAD_TOKEN in environments where the agent can access external networks. If you need higher assurance, request from the publisher an updated SKILL.md/registry metadata that explicitly lists required binaries and env vars, documents the exact minimal token scopes needed for safe operation, and clarifies whether any example commands (e.g., log retrieval) could expose secrets. If those issues are addressed, the skill is reasonable for monitoring use; until then, treat it with caution.

Type: OpenClaw Skill Name: nomad Version: 1.0.0 The skill bundle is benign. It provides instructions for querying HashiCorp Nomad clusters using the `nomad` CLI, exclusively focusing on read-only operations like listing jobs, nodes, allocations, and services. The `SKILL.md` explicitly states that the skill is read-only and contains no commands for job submissions or modifications. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, prompt injection attempts against the agent, or obfuscation within the provided files.