Agent Heartbeat

Unified heartbeat system for OpenClaw agents. Runs parallel health checks, data collectors, and state monitors in one command. Returns a single actionable su...

This skill runs whatever shell commands you put in heartbeat.yaml and does so with the agent's full environment and filesystem access. Before installing or scheduling it: 1) audit every heartbeat.yaml you will use — do not include commands that reference unknown URLs or inline keys; 2) remove any sensitive credentials from the agent environment or use dedicated low-privilege service accounts for monitored endpoints; 3) run the script in an isolated environment (container or VM) first to observe behavior; 4) avoid enabling cron/autonomous runs until you trust the config and code; 5) if you must run on a host with secrets, constrain collectors to safe wrappers (or whitelist allowed commands) so they cannot read arbitrary files or exfiltrate data. If you want, I can scan your heartbeat.yaml or the specific collector commands for risky patterns and suggest safer alternatives.

Type: OpenClaw Skill Name: wren-heartbeat Version: 1.0.0 The skill 'wren-heartbeat' provides a generic framework for executing arbitrary shell commands defined in a 'heartbeat.yaml' configuration file. The core logic in 'scripts/heartbeat.js' uses 'execSync' with 'shell: true' to run these commands, which is a high-risk behavior that allows for arbitrary code execution (RCE) if the configuration is manipulated. While the stated purpose is system monitoring and health checks, the broad capability and the instructions in 'SKILL.md' to automate these checks via cron jobs create a significant security risk without sufficient sandboxing or input validation.