Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Unifi Inforjota Integration
v1.0.3Query and monitor a UniFi network using a UniFi Integration API key (X-API-KEY) plus compatible read-only classic UniFi Network endpoints. Use when the user...
⭐ 0· 60·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The scripts implement read-only UniFi monitoring via an X-API-KEY token and UniFi proxy endpoints, which is coherent with the skill name/description. However README.md and parts of the documentation also instruct creating a local admin account and mention username/password or env var alternatives (UNIFI_USER/UNIFI_PASS), but the runtime scripts (unifi-api.sh and others) only consume a 'token' field (UNIFI_TOKEN). This doc/code mismatch is confusing and should be clarified. Also the package does not declare required runtime binaries even though the scripts call curl, jq, and column.
Instruction Scope
SKILL.md and the scripts stay within monitoring/read-only GET requests to the gateway (integration and classic read endpoints) and call only the UniFi gateway URL supplied by the user. They do read a local credentials file (~/.clawdbot/credentials/unifi/config.json) for the token/url/site, which is expected. Caveats: README suggests creating a local admin account and storing username/password, which the scripts do not use — that guidance could cause users to create unnecessary privileged accounts. Scripts also offer a JSON-output mode that can dump full payloads if explicitly requested.
Install Mechanism
This is an instruction-only skill with shell scripts included (no network install steps). Nothing is downloaded or extracted during install, which is low risk. Files are plain shell scripts and docs.
Credentials
The skill requests no platform secrets in metadata and uses a local config file containing the UniFi gateway URL and API token. That is proportionate for a UniFi integration. Caveats: README also documents username/password env vars (UNIFI_USER/UNIFI_PASS) not used by the scripts, which could prompt users to store more sensitive credentials than necessary. The scripts expect the token in a config JSON at a specific path (or via UNIFI_CONFIG_FILE), which is sensible but should be documented consistently.
Persistence & Privilege
The skill does not request always:true, does not modify other skills or system-wide configs, and only reads a user-local credentials file. It exports helper functions when sourced, but that is confined to the shell session. No persistent privileges or automatic global changes are requested.
What to consider before installing
This skill appears to implement read-only UniFi monitoring, but there are a few things to check before installing:
- Docs/code mismatch: README suggests creating a local admin account and using username/password or env vars (UNIFI_USER/UNIFI_PASS), but the scripts only use a token field (UNIFI_TOKEN) in ~/.clawdbot/credentials/unifi/config.json. Do not create or provide higher‑privilege credentials unless you understand why; prefer a read-only Integration API key.
- Required binaries are not declared: the scripts call curl, jq, and column. Make sure those are present and from trusted sources.
- TLS verification is explicitly skipped (curl -k / -sk) to tolerate self-signed certs. This eases connectivity to local gateways but permits MITM if running from an untrusted network—avoid running these scripts over untrusted networks or consider fixing certificate trust instead of skipping verification.
- JSON output modes can expose raw management payloads. Only request raw/json dumps if you want that data and understand it may include sensitive fields.
- If you plan to use this, prefer creating a UniFi Integration API key with minimal read-only scope and store it in the indicated config path. If anything about the README/setup still seems unclear, ask the skill author to clarify whether username/password flows are required or deprecated.Like a lobster shell, security has layers — review code before you run it.
latestvk978801dyvtke8zda4chfmcks183g00m
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
