server-log-analysis-en

Connect to remote servers over SSH, read sibling config.yaml to understand service metadata and log locations, download only required log snippets to local t...

Before installing or running this skill: 1) Inspect config.yaml and remove any real credentials—do not keep plaintext passwords or private keys in the skill folder. Replace them with references to environment variables or an external secret manager. 2) Confirm that you explicitly consent to any SSH connections the skill will make and restrict connections to only authorized hosts. 3) Review the 'local_temp_dir' and ensure downloaded logs are stored in a controlled location, rotated, and deleted when no longer needed to avoid leaving sensitive data on the agent host. 4) Prefer SSH key-based auth and jump-host configuration rather than root/password; update config.yaml to use auth.method and auth.password_env or key references as suggested in reference.md. 5) If you need an audit trail, log when and what was downloaded and who authorized the operation. 6) If you cannot verify that config.yaml contains only placeholders, treat the bundle as potentially leaking secrets and do not use it until sanitized. If you want a safer setup, ask the skill author to remove credentials from the package and to declare the required environment variables (e.g., SSH_KEY, SSH_USER) in the skill metadata.

Type: OpenClaw Skill Name: server-log-analysis-en Version: 1.0.0 The skill bundle is designed for remote server log analysis via SSH but contains a significant security vulnerability in 'config.yaml', which includes hardcoded root credentials (username: root, password: password). While 'SKILL.md' and 'reference.md' provide instructions to minimize data collection and avoid storing plaintext secrets, the inclusion of default/weak credentials in the configuration file poses a high risk of unauthorized access and potential misuse of the SSH capabilities.