System Monitor Pro

Real-time OpenClaw system monitoring with beautiful terminal UI. CPU, memory, disk, GPU, Gateway, cron jobs, model quota, and multi-machine support. Works on...

This skill appears to do what it says — a local/remote system monitor implemented as a Node script — but review a few items before installing/running: 1) The script uses your system ssh client and existing SSH keys for --remote; SSH is invoked with StrictHostKeyChecking=no which will accept new host keys automatically (MITM risk) — avoid using --remote with untrusted networks/hosts or modify the script to remove that option. 2) It runs many shell commands (cat /proc, openclaw CLI, nvidia-smi, etc.), so ensure you trust the script source before running it on sensitive systems. 3) If you plan to run it periodically (HEARTBEAT), run it under a restricted account or sandbox and verify the paths (skill directory) are correct. 4) The code has minor logic/formatting bugs (visual bar threshold uses cpu threshold for all bars) but nothing that indicates malicious intent. If you want higher assurance, request the publisher/source or run the script in a disposable VM/container first.

Type: OpenClaw Skill Name: system-monitor-pro Version: 1.0.0 The `monitor.js` script contains a critical shell injection vulnerability (Remote Code Execution) in the `remoteRun` function. The `remoteHost` variable, derived directly from user input via `process.argv`, is used unescaped within an `ssh` command executed by `execSync`. This allows an attacker to inject and execute arbitrary commands on the local machine running the skill. Additionally, the `SKILL.md` instructions for `--remote user@host` present a prompt injection risk if the agent does not properly sanitize user-provided arguments before execution. The use of `StrictHostKeyChecking=no` also weakens SSH security.