Ai Monitor Pro

AI monitoring for construction sites and IT infrastructure: dashboards, alerts, incident playbooks, photo reports, SLA and capacity control.

What to do before installing or running anything from this skill: - Do NOT run install.sh, build.sh, or test/smoke-test.sh as-is on a production host or as root. Treat them as untrusted code until reviewed. - Request or inspect the full contents of install.sh and test/smoke-test.sh. Look for network downloads (curl/wget), creation of systemd services, cronjobs, use of sudo, writes to /etc or /root, or hardcoded external endpoints/IPs. - Verify what credentials/integration tokens are required. The skill references Telegram, Prometheus/Grafana, Cloudflare and sending alerts, but the registry lists no required env vars — ask the author which secrets (e.g., TELEGRAM_BOT_TOKEN, PROMETHEUS_API_KEY, SSH keys) are needed and how they are stored/used. - If you must test: run inside an isolated VM or disposable container with no access to production network or secrets; monitor outbound network connections and filesystem changes. - Pay attention to privacy and legal risk: the skill claims to handle photo reports from construction sites; confirm how photos and personal data are stored/transmitted and that uploads are not sent to unknown third-party servers. - Prefer a manual / read-only trial: fill config.yaml with dummy values and exercise prompts that only generate textual playbooks/dashboards (no integrations) to validate functionality before enabling integrations or running installer scripts. - If you want a deeper review, provide the install.sh and test/smoke-test.sh contents (or allow a static analysis run) so the scripts can be audited for downloads, service installation, credential exfiltration, or other risky behavior. Why this is suspicious: the package claims 'instruction-only' and '15 min install' yet includes executable install/build scripts and integration-driven features without declaring required credentials. That gap (scripts + undisclosed integrations/credentials) increases the chance the package will perform unexpected network or system actions when installed.

Type: OpenClaw Skill Name: raai-ai-monitor-pro Version: 3.5.3 The skill bundle provides an AI agent with a comprehensive framework for infrastructure monitoring and incident response, which includes instructions to execute high-risk system commands such as SSH remote execution, service restarts, and file deletions (e.g., 'rm -rf /tmp/*' in SKILL.md). While these capabilities are plausibly required for the stated SRE/Monitoring purpose, they grant the agent broad administrative power that could be abused via prompt injection. No evidence of intentional malice, data exfiltration, or hidden backdoors was found in the scripts (build.sh, install.sh) or configuration files.