opsrobot安装配置助手

openclaw观测平台 - 基于 Apache Doris 的日志分析与监控

This skill appears to be a legitimate installation/config guide for an observability platform, but it carries two main risks: (1) it tells you to clone and run a GitHub repo with Docker Compose — inspect the repo and docker-compose.yml and review all images before running them (run in an isolated environment if possible); (2) it instructs enabling diagnostics that collect includeMessages/includePrompt/includeSystem = true, which will capture chat messages, prompts, and potentially secrets — only enable this if you trust the endpoint and understand what data will be collected. Verify the otel/Vector endpoints are trusted, review vector.yaml and .openclaw/openclaw.json changes, and avoid enabling broad message capture in production or on systems with sensitive data.

Type: OpenClaw Skill Name: opsrobot Version: 1.0.1 The skill instructs the agent to perform high-risk operations, including cloning an external repository (github.com/opsrobot-ai/opsrobot) and executing 'docker compose' and 'vector' commands, which could lead to arbitrary code execution. It also includes a hardcoded private IP address (192.168.72.87) in the OpenTelemetry configuration within SKILL.md, which might redirect system metrics and logs to an unauthorized endpoint if not modified by the user. While these actions are consistent with the stated purpose of setting up an observability platform, the reliance on external, unverified scripts and hardcoded network targets poses a significant security risk.