Monitor home lab servers via Beszel (PocketBase).

This skill's code does what its description says (authenticates to a PocketBase instance and reads 'systems' and 'container_stats'), but it has important mismatches you should address before installing: - The script requires BESZEL_USER and BESZEL_PASS (and optionally BESZEL_HOST), but the registry and SKILL.md do not declare these. Verify you understand where you'll store/provide those credentials. - SKILL.md tells you to 'source ~/.zshrc' before running. Sourcing your shell rc will execute any commands in that file and may expose secrets. Instead, prefer explicitly exporting only the BESZEL_* variables or running the script with a controlled environment. - BESZEL_HOST defaults to http://127.0.0.1:8090, but if you set BESZEL_HOST to a remote URL the script will send credentials and request data to that host. Ensure BESZEL_HOST points to a trusted, local instance before running. - There is a small code bug/inconsistency: the script does "const https = require('http')" (variable name suggests HTTPS while module is http). This isn't directly malicious but indicates limited review; inspect the code yourself or ask the author to fix/clarify. Recommendations: 1) Ask the publisher for a README that explicitly lists required env vars and network behavior, and for a homepage/source repository to verify provenance. 2) Review the index.js content yourself (or have someone you trust do so). Confirm BESZEL_HOST is safe and that the endpoints used are the PocketBase instance you expect. 3) Avoid sourcing your full shell rc; set BESZEL_USER/BESZEL_PASS in a minimal environment for the command or use a dedicated credential store. If you cannot verify these points or the publisher's reputation, treat this skill as untrusted until clarified.

Type: OpenClaw Skill Name: beszel-check Version: 1.0.0 The skill is classified as suspicious due to insecure handling of credentials and broad environment sourcing. The `index.js` script imports the `http` module but assigns it to a variable named `https`, leading to all network requests (including authentication with `BESZEL_USER` and `BESZEL_PASS` environment variables) being made over unencrypted HTTP. While the default host is localhost, this poses a significant risk if `BESZEL_HOST` is configured to an external HTTP endpoint, exposing credentials in plaintext. Additionally, the `SKILL.md` instructs the agent to `source ~/.zshrc`, which grants broad access to the user's shell environment, a risky capability without clear malicious intent.