Uptime Monitor Agent

Monitor uptime of websites/services and alert when down. Use when checking if a website is reachable, monitoring service health, or getting alerted on downtime.

This skill's code matches an uptime monitor, but the metadata is incomplete — MONITOR_URLS is required at runtime though not declared in the registry. Before installing: (1) verify and set MONITOR_URLS and any ALERT_WEBHOOK_URL to trusted endpoints (a webhook will receive JSON payloads); (2) review the scripts locally (they use curl and may call mail) and confirm you are comfortable with outbound HTTP posts and writing logs to the skill's logs directory; (3) ensure the environment has curl and an MTA if you rely on email alerts; (4) consider running in an isolated environment if you want to limit network exposure; and (5) ask the publisher to correct the registry metadata so required env vars are declared. If you need higher assurance, request provenance (homepage/source) or a signed release.

Type: OpenClaw Skill Name: uptime-monitor-agent Version: 1.0.0 The skill contains a critical command injection vulnerability in `scripts/report.sh` where the `DAYS` argument is used unquoted in a fallback `date` command, allowing for arbitrary code execution on BSD-based systems (e.g., via `7; <command>`). Additionally, `scripts/alert.sh` is vulnerable to JSON injection due to manual payload construction using unescaped variables in a heredoc, and `scripts/check.sh` lacks input validation for the URL argument. While the skill's logic aligns with its stated purpose as an uptime monitor, these vulnerabilities pose a significant risk if the agent handles untrusted input.