VM Health Check

🖥️ Instant VM health checks — no config needed after first run. Point it at any Docker-based Linux server and get a clean report covering CPU, memory, disk,...

This skill appears to do what it says, but take these precautions before installing/using it: - Do not store private key material in project files. The skill saves the SSH key path to TOOLS.md; avoid writing actual private keys and consider not storing the path in a repo (add TOOLS.md to .gitignore or keep credentials out of the workspace). Prefer passing VM_HOST/VM_USER/SSH_KEY as environment variables at runtime. - Host-key verification is disabled (ssh -o StrictHostKeyChecking=no). That avoids interactive prompts but increases MITM risk — consider verifying host keys manually or removing the option. - The cleanup section runs docker image prune -af and docker builder prune -f automatically; these can free space but are destructive to unused images/cache. The SKILL.md warns about not running docker system prune -af, but still confirm before running cleanup on production systems. - The script suppresses stderr (2>/dev/null) in many remote commands which can hide errors. If something looks wrong, run the underlying commands manually on the host to inspect full output. - The DB size checks attempt to connect without credentials (root with empty password); if your containers require credentials, the script will note that and skip — but do not add credentials to TOOLS.md in plaintext. - Review the included script (scripts/vm-check.sh) yourself before running and test in a safe environment. If you need stronger safeguards, modify the script to enforce host-key checking, avoid writing connection info to disk, and require explicit confirmation before any pruning operations.

Type: OpenClaw Skill Name: tonic-vm-check Version: 1.0.2 The skill is classified as suspicious due to potential command injection vulnerabilities and insecure handling of sensitive credentials. The script `scripts/vm-check.sh` constructs shell commands using unsanitized environment variables (`VM_HOST`, `VM_USER`, `SSH_KEY`), which could allow for local command execution if the agent is provided with malicious input. Additionally, `SKILL.md` instructs the agent to store sensitive SSH private key paths in `TOOLS.md`, and the script explicitly disables SSH host key verification (`StrictHostKeyChecking=no`), increasing the risk of man-in-the-middle attacks.