ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Openclaw Skill

v1.0.0

AI monitoring that fixes your code — query alerts, trigger remediations, rollback deploys, chat with your infrastructure

⭐ 0· 23·0 current·0 all-time
byJesus Bernal@orbita-pos
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
✓
Purpose & Capability
The skill is an InariWatch integration that claims to monitor many platforms and perform remediations; requiring a single INARIWATCH_TOKEN is consistent because the backend service is expected to hold downstream integrations and credentials. No unrelated credentials or binaries are requested.
ℹ
Instruction Scope
SKILL.md instructs the agent to query alerts, trigger fixes, rollback deploys, read and reindex codebases, and modify the user's ~/.openclaw/openclaw.json or run openclaw mcp commands. These are within the stated remediation/monitoring scope, but several actions are destructive (trigger_fix, rollback_deploy) — the doc correctly advises explicit user confirmation before performing them.
ℹ
Install Mechanism
There is no registry install spec (instruction-only). The README suggests running `npx @inariwatch/mcp init` which will download and run code from the npm registry at runtime — a legitimate but higher-risk action than pure configuration. Verify the npm package name and publisher before running.
✓
Credentials
Only INARIWATCH_TOKEN is required and declared as primary; this is proportional because the InariWatch service likely brokers access to downstream platforms. No unrelated secrets or extra environment variables are requested.
✓
Persistence & Privilege
always:false and user-invocable:true (normal). The skill's setup steps modify the user's OpenClaw MCP config (~/.openclaw/openclaw.json) or call openclaw mcp set — modifying the agent's config is expected for an integration and is documented. No unusual permanent privileges or cross-skill config writes are requested.
Assessment
This skill appears coherent for its stated purpose, but take these precautions before installing: - Treat INARIWATCH_TOKEN as sensitive: only provide a token with the minimum scope needed and be prepared to revoke it if needed. - Confirm destructive actions: the skill can trigger fixes and rollbacks; only proceed when you explicitly confirm those operations. - Verify the npm helper: SKILL.md suggests `npx @inariwatch/mcp init` — npx will fetch and execute code from the npm registry. Verify the package identity (publisher, package page, version) before running and prefer to inspect the package source if you can. - Review InariWatch account integrations: the skill relies on the service to access GitHub, CI, and hosting providers. Ensure you trust the InariWatch account and that its integrations and permissions are appropriate. - If you need stronger assurance, ask the publisher for: a link to the npm package, the MCP package source, security/release info, and documentation of what minimum token scopes are required. Overall: reasonable match for its purpose, but because it can change production and downloads code via npx, proceed with deliberate review and least-privilege tokens.

Like a lobster shell, security has layers — review code before you run it.

latestvk97ab1zp4jbq3ct9kk1q7b2qes84r6fe

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

EnvINARIWATCH_TOKEN
Primary envINARIWATCH_TOKEN

Comments