Unifi Inforjota Integration

Query and monitor a UniFi network using a UniFi Integration API key (X-API-KEY) plus compatible read-only classic UniFi Network endpoints. Use when the user...

This skill appears to implement read-only UniFi monitoring, but there are a few things to check before installing: - Docs/code mismatch: README suggests creating a local admin account and using username/password or env vars (UNIFI_USER/UNIFI_PASS), but the scripts only use a token field (UNIFI_TOKEN) in ~/.clawdbot/credentials/unifi/config.json. Do not create or provide higher‑privilege credentials unless you understand why; prefer a read-only Integration API key. - Required binaries are not declared: the scripts call curl, jq, and column. Make sure those are present and from trusted sources. - TLS verification is explicitly skipped (curl -k / -sk) to tolerate self-signed certs. This eases connectivity to local gateways but permits MITM if running from an untrusted network—avoid running these scripts over untrusted networks or consider fixing certificate trust instead of skipping verification. - JSON output modes can expose raw management payloads. Only request raw/json dumps if you want that data and understand it may include sensitive fields. - If you plan to use this, prefer creating a UniFi Integration API key with minimal read-only scope and store it in the indicated config path. If anything about the README/setup still seems unclear, ask the skill author to clarify whether username/password flows are required or deprecated.

Type: OpenClaw Skill Name: unifi-inforjota-integration Version: 1.0.3 The UniFi integration bundle is classified as suspicious due to several security vulnerabilities and documentation inconsistencies. All scripts (e.g., unifi-api.sh, clients.sh, dashboard.sh) systematically utilize 'curl -k' to bypass SSL verification, which exposes the UniFi API key (X-API-KEY) to potential interception via Man-in-the-Middle attacks. Additionally, scripts such as alerts.sh and top-apps.sh lack input validation for user-supplied arguments like the LIMIT parameter, and the README.md contains conflicting information regarding authentication methods (referencing username/password and cookies while the code uses API keys), indicating a high risk of misconfiguration or insecure deployment.