Site Change Alert

Use when monitoring websites for content changes, comparing page snapshots with diff, scheduling periodic checks, or sending alerts via email and webhook not...

This skill appears to do what it says: it fetches pages with curl, keeps snapshots and logs under your home directory, and can POST to a webhook or send email if you configure those endpoints in the local config. Before installing, review and optionally edit the configuration file (~/.site-change-alert/config.sh or ~/.local/share/site-change-alert/*) to ensure WEBHOOK_URL / EMAIL_TO values are correct and point to endpoints you control. Note the repository includes two slightly different scripts and data directories (SITE_ALERT_DIR vs SITE_CHANGE_ALERT_DIR); pick one to avoid duplicate storage. Because the scripts write files to your home, you may want to run them in a contained account or inspect the files they create. If you plan to use webhook/email notifications, do not store sensitive credentials there unless you trust the endpoint and understand how notifications are sent.

Type: OpenClaw Skill Name: site-change-alert Version: 2.0.1 The skill implements a website monitoring system with high-risk capabilities, specifically the ability to modify the user's crontab for persistence (found in the `schedule` command of `scripts/script.sh`). While these features align with the stated purpose, the script contains significant shell injection vulnerabilities; for instance, user-provided URLs are injected directly into crontab entries and configuration files via `sed -i` without sanitization. This allows for potential arbitrary command execution if the agent is prompted to monitor a specially crafted URL string.