Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Rpi Cpu Monitor

v1.0.0

树莓派 CPU 温度监控。当需要监控树莓派 CPU 温度时使用此 skill。功能:(1) 读取当前 CPU 温度,(2) 设置定时监控任务,(3) 温度超标时自动告警。支持 crontab 方案(零消耗,推荐)和 OpenClaw cron 方案。

0· 479·1 current·1 all-time
byarcherwei@archerweiye
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The skill's stated purpose (read temperature, schedule checks, alert on high temp) matches the script. However the code expects a Raspberry Pi tool (vcgencmd) and access to a local OpenClaw gateway API — neither of these requirements are declared in the skill metadata. The script also hard-codes a path with a specific username (/home/weiye/.openclaw/gateway-token), which is not coherent with a general-purpose skill.
!
Instruction Scope
SKILL.md instructs creating and scheduling the provided script. The script reads a local file (/home/weiye/.openclaw/gateway-token) to construct an Authorization header and posts to http://localhost:3000/api/..., which means it accesses a user-specific secret and calls a local agent API. The skill did not document or request that secret or the config path. This is scope creep relative to the declared 'no required config paths / env vars'.
Install Mechanism
There is no install spec (instruction-only) and the repository includes the monitoring script. No remote downloads or archive extraction are requested, so install risk is low.
!
Credentials
requires.env and required config paths are empty, yet the script accesses a sensitive token file at a hard-coded path. It does not provide a documented, configurable way to supply that token (for example via an environment variable or a documented path), and the path includes a specific username which will cause failures or unintended behavior. The lack of declared credentials/configs is disproportionate to the skill's metadata.
Persistence & Privilege
The skill does not request always: true, does not modify other skills, and does not demand system-wide changes beyond adding a cron job (which is user-initiated). Its runtime behavior is limited to the scheduled script.
What to consider before installing
This skill's code largely does what the description says, but inspect and adapt the script before installing. Key points to consider: - The script reads a local OpenClaw gateway token at /home/weiye/.openclaw/gateway-token; that file is a sensitive credential. Confirm the correct path for your system or change the script to accept the token via a documented environment variable (e.g., OPENCLAW_GATEWAY_TOKEN) or a configurable path. Do not install unchanged if the hard-coded path contains another user's data. - The script expects vcgencmd (Raspberry Pi utility) or /sys/class/thermal/... — ensure you're actually on a Raspberry Pi and that vcgencmd exists; the skill metadata does not declare this dependency. - The script only contacts http://localhost:3000 (local OpenClaw gateway). This reduces network-exfiltration risk, but the gateway token could be used to make other local API calls with the agent's privileges — ensure the token's scope and storage permissions are appropriate. - Consider changing file permissions on the gateway-token so it is not world-readable and test the script manually before scheduling via cron. - Prefer the crontab approach if you want minimal external model calls; if you use OpenClaw cron, confirm the messages and session parameters are safe and that repeated model invocations are acceptable. If you want a cleaner integration, ask the author to (1) remove hard-coded username paths, (2) declare required config paths / env vars, and (3) provide instructions to securely supply the gateway token.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ec00g1h19xsnqxmckfpaqs981j1sw

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

树莓派 CPU 温度监控

快速开始

方案 1:crontab 方案(推荐,零消耗)

# 创建监控脚本
cat > /path/to/scripts/cpu-temp-monitor.sh << 'EOF'
#!/bin/bash
TEMP=$(vcgencmd measure_temp 2>/dev/null | cut -d= -f2 | cut -d\' -f1)
[ -z "$TEMP" ] && TEMP=$(cat /sys/class/thermal/thermal_zone0/temp | awk '{print $1/1000}')
TEMP_INT=${TEMP%.*}

if [ "$TEMP_INT" -gt 70 ]; then
  curl -s -X POST "http://localhost:3000/api/sessions/agent:main:main/message" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $(cat /home/weiye/.openclaw/gateway-token)" \
    -d '{"message":"⚠️ CPU温度过高: '${TEMP}'°C", "channel":"feishu"}'
fi
EOF

chmod +x /path/to/scripts/cpu-temp-monitor.sh

# 添加到 crontab(每 35 分钟执行)
crontab -e
# 添加: */35 * * * * /path/to/scripts/cpu-temp-monitor.sh

方案 2:OpenClaw cron 方案

# 启用 OpenClaw 内置 cron(每次调用大模型)
openclaw cron add --name "CPU温度监控" --schedule "*/35 * * * *" \
  --message "检查CPU温度:运行 vcgencmd measure_temp,如果>70°C发送警告" \
  --session isolated

对比

方案大模型调用适用场景
crontab0 次(仅超标时 API)生产环境,推荐
OpenClaw cron每次 1 次测试/开发

配置项

  • 温度阈值:默认 70°C,可修改脚本中的 70
  • 监控间隔:默认 35 分钟,修改 crontab 表达式
  • 告警渠道:默认飞书,修改 API 调用中的 channel 参数

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…