Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Truenas Skill
v1.2.0Manage TrueNAS SCALE via API. Check pool health, manage datasets and snapshots, monitor alerts, control services, manage apps, orchestrate Dockge container stacks, and manage bookmarks. Use when the user asks about their NAS, storage, backups, containers, bookmarks, or homelab services.
⭐ 0· 1.3k·4 current·4 all-time
by@anotb
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The declared purpose (manage TrueNAS SCALE, pools, datasets, snapshots, apps, Dockge stacks, bookmarks, and related homelab services) matches the required artifacts: TRUENAS_URL and TRUENAS_API_KEY, plus curl/jq/node and scripts for WebSocket and Dockge. Optional references to other homelab services are documented as optional environment variables and align with the described integrations.
Instruction Scope
Runtime instructions and scripts operate on the user-provided service endpoints (TrueNAS, Dockge, and other optional services). They only read env vars and call those endpoints. A noteworthy security choice: TLS verification is disabled by default (curl -k and rejectUnauthorized: false) to accommodate self-signed certs — this increases MITM risk unless the user sets TRUENAS_VERIFY_TLS=1. The SKILL.md asserts credentials 'stay local' and the code sends the API key only to the configured service endpoints; there are no hard-coded external endpoints in the code.
Install Mechanism
The registry entry has no platform install spec (instruction-only), but the package includes package.json and package-lock.json referencing standard npm packages (socket.io-client, ws) from the public npm registry. That is expected for WebSocket/socket.io clients and is not unusual, but it means an install (npm install) pulls dependencies from npm — a moderate, expected risk rather than a red flag.
Credentials
Only TRUENAS_URL and TRUENAS_API_KEY are required (primaryEnv set correctly). Many other env vars are documented as optional for integrations (Dockge credentials, Sonarr/Radarr, Plex, etc.). Those optional credentials are appropriate for the broad homelab scope but increase blast radius if you provide them unnecessarily — only supply the service credentials you actually want the skill to use. Dockge scripts specifically require DOCKGE_URL/DOCKGE_USER/DOCKGE_PASS when invoked.
Persistence & Privilege
The skill does not request always: true, does not modify other skills or system-wide configs, and is user-invocable. It runs as-needed and has no implicit permanent privileges beyond normal execution.
Assessment
This skill appears to be what it claims, but review and follow these precautions before installing: 1) Use a least-privilege TrueNAS API key (read-only where possible). 2) Prefer TRUENAS_VERIFY_TLS=1 and valid certificates; only disable TLS verification if you understand the risk of man-in-the-middle attacks on your LAN. 3) Only provide optional service credentials (Dockge, Sonarr, Radarr, Plex, etc.) that you intend the skill to access — every credential you supply increases exposure. 4) If you run the included Node scripts, run npm install in a controlled environment and review package-lock.json; the dependencies are common WebSocket/socket.io libs but are fetched from npm. 5) Inspect/trust the GitHub source (homepage) or run the skill in an isolated agent environment if you are unsure.Like a lobster shell, security has layers — review code before you run it.
latestvk971cvyfqm7ta3yyd6fncx4ctd810asz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binscurl, jq, node
EnvTRUENAS_URL, TRUENAS_API_KEY
Primary envTRUENAS_API_KEY