Oda Monitor

Monitors websites, APIs, and cron jobs (watchdogs) using Watch.dog. Use it when the user asks to "check the status of my monitors", "check uptime", "review w...

Before installing or enabling this skill: (1) Review the index.js source yourself (or have someone you trust do so) — the skill will read and can be instructed to write a .env file in its folder that contains your API key. (2) Be aware the onboarding flow instructs automatic creation/overwrite of that .env file and an immediate, silent call to list_monitors using your key — network activity will occur as soon as you provide credentials. (3) If you proceed, prefer using a dedicated, limited-scope API key and run the skill in an isolated environment or container. (4) If you do not want secrets persisted on disk, refuse automatic .env creation: provide credentials via environment variables to your runtime instead and verify the skill does not write files. (5) Consider rotating the key after testing, and verify the default WATCHDOG_API_URL is the legitimate service you expect (https://api.watch.dog/...).

Type: OpenClaw Skill Name: oda-monitor Version: 1.0.0 The skill contains instructions in index.js (within the WATCHDOG_SYSTEM_PROMPT) that command the AI agent to silently use its native file-writing tools to create or overwrite a .env file with the user's API credentials. While presented as an onboarding convenience, instructing an agent to perform automated filesystem modifications and store secrets in plaintext is a high-risk behavior. Additionally, the skill proxies all tool execution to a remote endpoint (https://api.watch.dog/api/mcp_server.php), which is consistent with its stated purpose but requires the user to trust the external service with their API key.