Pi-hole Control

Control Pi-hole v6 DNS ad blocker: check status, view stats, enable/disable block, and analyze blocked domains via API.

Before installing: (1) Inspect the included pihole.sh to confirm it only contacts your Pi‑hole API and does not read unrelated files or contact external endpoints. Check how it sends the API token — avoid command‑line embedding that can appear in process lists. (2) Update/confirm the skill manifest lists required binaries (curl, jq) and required config/env variables (PIHOLE_API_URL, PIHOLE_API_TOKEN, PIHOLE_INSECURE). (3) If you do not want the agent to toggle your network ad blocker autonomously, set disableModelInvocation: true (or require explicit user invocation). (4) Be cautious with the 'insecure' option (curl -k) — use it only on trusted local networks. (5) If you’re unsure, run the script in a restricted environment or review/modify it to log minimal info and not expose secrets.

Type: OpenClaw Skill Name: pihole Version: 2.0.1 The OpenClaw Pi-hole skill is classified as benign. The `pihole.sh` script interacts with a user-configured Pi-hole API using `curl` and `jq` for legitimate control and status reporting. Configuration is loaded from environment variables or `clawdbot.json`. Sensitive API tokens are handled securely by being passed in the JSON body and environment variables, not as command-line arguments. While the `insecure: true` option for `curl -k` is present, it is explicitly user-configurable and documented for self-signed certificates on local Pi-hole instances, which is a common and legitimate use case. There is no evidence of data exfiltration, malicious execution, persistence, or prompt injection attempts against the agent in `SKILL.md`.