Uptime Monitor

Monitor uptime of websites/services and alert when down. Use when checking if a website is reachable, monitoring service health, or getting alerted on downtime.

This skill appears to do only uptime checks and send alerts to destinations you provide, but review these points before installing: - Provide only trusted webhook URLs. The alert script will POST JSON to whatever ALERT_WEBHOOK_URL you set; do not point it at unknown or third-party endpoints you don't control. - The skill expects environment variables (MONITOR_URLS, ALERT_WEBHOOK_URL, ALERT_EMAIL, CHECK_INTERVAL) documented in SKILL.md but not declared in the registry metadata — make sure you set them intentionally. - Logs are written to the skill's logs directory (scripts use a relative ./../logs path which maps to the skill workspace). Logs contain monitored URLs, timestamps, and alert entries; if URLs are sensitive, protect that directory and its backups. - alert.sh can attempt to send email via the local mail command (may fail if mail is not available); it does not exfiltrate other system data. - If you want extra assurance, run the scripts in a sandboxed environment (or inspect/modify the scripts) and test with non-production/example URLs and a webhook you control. Overall: coherent with its stated purpose; the main issues are the missing env-var declarations in the manifest and the usual caution around webhook endpoints and log handling.

Type: OpenClaw Skill Name: service-health-checker Version: 1.0.0 The skill provides legitimate uptime monitoring and alerting functionality but contains critical shell injection vulnerabilities in `scripts/check.sh` and `scripts/alert.sh`. Specifically, these scripts pass unsanitized variables such as `$URL` and `$ALERT_EMAIL` directly into shell commands within double quotes, which allows for arbitrary command execution via command substitution (e.g., `$(...)`). While the behavior aligns with the stated purpose and no evidence of intentional malice was found, these implementation flaws pose a high risk of remote code execution.