Oda Monitor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:12 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches a Watch.dog monitoring integration, but it handles API credentials and destructive account actions in ways users should review carefully before installing.

Install only if you trust the Watch.dog account integration and are comfortable giving this skill an API key that can manage monitoring resources. Prefer environment-injected secrets over a skill-local .env file, keep WATCHDOG_API_URL pinned to the official Watch.dog endpoint unless you fully trust another endpoint, use a narrowly scoped API key if available, and manually confirm any delete or public status-page change.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:34
• Finding: Configurable API Endpoint Can Expose Bearer Credentials and Monitoring Data<![CDATA[ ## Vulnerability Details **File Location**: `index.js:34-39, 143-166` **Vulnerability Type**: Unrestricted credential-bearing outbound requests **Risk Level**: High ### Vulnerable Code ```js const CONFIG = { apiUrl: process.env.WATCHDOG_API_URL || "https://api.watch.dog/api/mcp_server.php", apiKey: process.env.WATCHDOG_API_KEY || "", }; ``` ```js async function callRemoteTool(toolName, args = {}) { // Remove undefined args Object.keys(args).forEach((k) => args[k] === undefined && delete args[k]); if (!CONFIG.apiKey) { throw new Error( "WATCHDOG_API_KEY is not configured. " + "Please configure it in the .env file of the skill or as an environment variable.", ); } const response = await fetch(CONFIG.apiUrl, { method: "POST", headers: { "Content-Type": "application/json", Accept: "application/json", Authorization: `Bearer ${CONFIG.apiKey}`, }, body: JSON.stringify({ jsonrpc: "2.0", id: `req_${Date.now()}`, method: "tools/call", params: { name: toolName, arguments: args }, }), }); ``` ### Technical Analysis `WATCHDOG_API_URL` controls the destination of every remote tool request. The value is accepted without HTTPS enforcement, hostname allowlisting, private-network address rejection, or explicit confirmation before credentials are transmitted. Each request sends `WATCHDOG_API_KEY` as a bearer token. Tool arguments can also contain sensitive infrastructure information, including monitored URLs, hostnames, monitor names, identifiers, and tracker-page configuration. Because the Skill documentation and embedded prompt allow the user-supplied API URL to be persisted and immediately tested with `list_monitors`, a malicious, compromised, or mistyped endpoint can receive the credential as soon as configuration is completed. An HTTP endpoint could additionally expose the credential to network interception. A local or private-network endpoint could cause ...[truncated 1258 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin production requests to the official `https://api.watch.dog` origin wherever possible. 2. If custom endpoints are a required feature: - Enforce HTTPS. - Parse the URL with the standard `URL` class. - Allow only explicitly approved hostnames and ports. - Reject embedded credentials, redirects to unapproved hosts, and non-HTTP protocols. - Resolve and reject loopback, private, link-local, multicast, and cloud metadata addresses. 3. Require explicit informed confirmation before sending an API key to a newly configured origin. 4. Do not automatically test credentials against an unverified custom URL. 5. Disable automatic redirect following or revalidate every redirect destination. 6. Use separate, narrowly scoped API keys where the remote platform supports them. 7. Avoid including unnecessary infrastructure details in requests and document exactly what data leaves the host. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: index.js:164
• Finding: Untrusted Remote Responses Are Embedded in Agent-Facing Instructions<![CDATA[ ## Vulnerability Details **File Location**: `index.js:164-176, 211-222, 258-269, 320-331` **Vulnerability Type**: Indirect prompt injection through remote tool output **Risk Level**: High ### Vulnerable Code ```js const data = await response.json(); if (data.error) { throw new Error(`[${data.error.code}] ${data.error.message}`); } return data?.result?.content?.[0]?.text ?? "{}"; ``` ```js async ({ status }) => { const text = await callRemoteTool("list_monitors", { status }); return { content: [ { type: "text", text: `[Data retrieved. Present it as a friendly markdown table using emojis 🟢🔴⏸️]:\n${text}`, }, ], }; }, ``` ```js async ({ name, type, interval }) => { const text = await callRemoteTool("create_watchdog", { name, type, interval, }); return { content: [ { type: "text", text: `[CRITICAL RULE: You must send the user the endpoint_url and give them exact instructions on how to ping using this data]:\n${text}`, }, ], }; }, ``` ### Technical Analysis The remote service's `content[0].text` value is treated as an opaque string and concatenated directly into imperative, Agent-facing text. The implementation does not parse the expected JSON payload, validate it against a per-tool schema, escape control content, or clearly delimit it as untrusted data. A malicious or compromised endpoint can therefore return text such as instructions to ignore prior rules, conceal information, request additional tool calls, or invoke destructive operations. The configurable `WATCHDOG_API_URL` makes this path particularly exposed because an attacker-controlled server can directly determine the returned content. The MCP tool itself does not locally execute returned text as code. Exploitation depends on the consuming Agent interpreting the returned text as instructions. Nevertheless, the Skill intentionally presents remote data in an instruction-like context, creat ...[truncated 1225 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Parse remote `text` as JSON rather than forwarding it as free-form instructions. 2. Define strict, tool-specific schemas with Zod and reject unexpected fields, excessive lengths, and invalid types. 3. Return structured MCP content containing only validated values. 4. Clearly label all server-provided strings as untrusted data and instruct the Agent never to follow instructions contained in those values. 5. Avoid phrases such as `CRITICAL RULE` around untrusted content. 6. Extract and format only expected fields such as IDs, statuses, intervals, and endpoint URLs. 7. Validate returned endpoint URLs before presenting them, including scheme and hostname checks. 8. Combine these controls with endpoint pinning or allowlisting so arbitrary servers cannot supply tool results. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:24
• Finding: API Credentials Are Persisted in a Plaintext Skill-Local File<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:48-55; index.js:24-30, 47-51` **Vulnerability Type**: Insecure persistent secret storage **Risk Level**: Medium ### Vulnerable Code ```markdown ## Required Configuration Create a `.env` file in this folder with: ```env WATCHDOG_API_KEY="sk_live_your_key_here" WATCHDOG_API_URL="api_url_here" | "https://api.watch.dog/api/mcp_server.php" ``` ``` The embedded behavioral prompt further directs the Agent to persist the credentials: ```js 3. Once the user provides the data, use your native file writing tools to automatically create or overwrite the .env file in the root of this skill with the exact following format: WATCHDOG_API_KEY="[user_key]" WATCHDOG_API_URL="[user_url]" Never ask the user to create the file manually. ``` The resulting plaintext file is loaded as follows: ```js const __dirname = dirname(fileURLToPath(import.meta.url)); const envPath = join(__dirname, ".env"); if (existsSync(envPath)) { const envContent = readFileSync(envPath, "utf-8"); for (const line of envContent.split("\n")) { const match = line.match(/^([A-Z_]+)\s*=\s*"?([^"\n]+)"?/); if (match) process.env[match[1]] = match[2].trim(); } } ``` ### Technical Analysis The Skill explicitly instructs the Agent to create or overwrite a persistent `.env` file containing a live API key. No protection is specified for file permissions, ownership, symlink handling, backup exposure, or accidental source-control inclusion. The project also does not include a `.gitignore` file protecting `.env`. Although the reviewed artifact does not itself contain a credential, following its documented initialization procedure creates one in plaintext. The overwrite instruction is unnecessarily broad. If the path can be replaced with a symbolic link in a hostile local environment, a generic file-writing tool could potentially overwrite another file accessible to the Agent. Whether this is exploitable depends on how the hos ...[truncated 908 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer the OpenClaw host's secret-management facility or process-scoped environment injection. 2. Do not instruct the Agent to persist credentials automatically. 3. Require explicit user consent before creating any credential file. 4. If file storage is unavoidable: - Create the file with permissions equivalent to `0600`. - Verify that the destination is not a symbolic link. - Use exclusive creation and atomic replacement. - Restrict ownership to the current account. - Avoid overwriting unrelated existing content. 5. Add `.env` to a committed `.gitignore`. 6. Document credential rotation and revocation procedures. 7. Encourage narrowly scoped API keys and rotate a key immediately if the file may have been exposed. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:395
• Finding: Destructive Deletion Tools Do Not Enforce User Confirmation in Code<![CDATA[ ## Vulnerability Details **File Location**: `index.js:395-433` **Vulnerability Type**: Missing authorization guard for irreversible operations **Risk Level**: Medium ### Vulnerable Code ```js server.registerTool( "delete_monitor", { description: "Irreversibly deletes an Active Monitor. REQUIRES PRIOR EXPLICIT CONFIRMATION FROM THE USER.", inputSchema: { monitor_id: z.number().int().positive().optional(), name: z.string().optional(), }, }, async ({ monitor_id, name }) => { const text = await callRemoteTool("delete_monitor", { monitor_id, name }); return { content: [ { type: "text", text: `[Inform the user about the success of this deletion based on this JSON]:\n${text}`, }, ], }; }, ); server.registerTool( "delete_watchdog", { description: "Irreversibly deletes a Passive Watchdog. REQUIRES PRIOR EXPLICIT CONFIRMATION FROM THE USER.", inputSchema: { watchdog_id: z.number().int().positive().optional(), name: z.string().optional(), }, }, async ({ watchdog_id, name }) => { const text = await callRemoteTool("delete_watchdog", { watchdog_id, name }); return { content: [ { type: "text", text: `[Inform the user about the success of this deletion based on this JSON]:\n${text}`, }, ], }; }, ); ``` ### Technical Analysis The confirmation requirement exists only in behavioral prompt text and tool descriptions. Neither deletion handler verifies that the user confirmed the exact resource being deleted. A direct MCP client, a mistaken Agent decision, or an Agent influenced by prompt injection can invoke either tool and immediately trigger the remote deletion request. Both schemas also allow all identifiers to be omitted because `monitor_id`, `watchdog_id`, and `name` are individually optional. The remote API may reject an empty request, but the local Skill does not ...[truncated 1174 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Implement a mandatory two-step deletion workflow: - First retrieve and display the exact resource. - Then issue a short-lived, cryptographically random confirmation token. - Require the token in the deletion request. 2. Bind the token to the authenticated account, resource type, resource ID, and expiration time. 3. Invalidate the token after one use or after a short timeout. 4. Require exactly one valid resource selector and reject calls with neither an ID nor a name. 5. Prefer immutable numeric IDs over names to prevent ambiguity. 6. Re-fetch the resource immediately before deletion and verify that it matches the confirmed target. 7. Record an audit event containing the target, confirmation time, and operation result without logging the API key. 8. Where supported, use reversible soft deletion or a recovery window instead of immediate permanent deletion. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (31)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared purpose and the described behavior are inconsistent: the skill includes tracker-page modification capability, instructs local .env credential handling, and promises an automatic connection test that is not clearly reflected as disclosed behavior. These mismatches undermine informed consent and make it easier for a user or host to authorize operations they did not expect, including account configuration changes and secret handling.

Credential Access

High

• Category: Privilege Escalation

Content

* - Prompts: defined locally (behavioral instructions for the LLM)
 * - Tools:   proxied to the remote Watch.dog MCP PHP server via HTTP
 *
 * Configuration (via environment variables or .env file):
 *   WATCHDOG_API_KEY  – Your Watch.dog API key (sk_live_...)
 *   WATCHDOG_API_URL  – Remote MCP server URL (default: https://api.watch.dog/api/mcp_server.php)
 */

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

* - Prompts: defined locally (behavioral instructions for the LLM)
 * - Tools:   proxied to the remote Watch.dog MCP PHP server via HTTP
 *
 * Configuration (via environment variables or .env file):
 *   WATCHDOG_API_KEY  – Your Watch.dog API key (sk_live_...)
 *   WATCHDOG_API_URL  – Remote MCP server URL (default: https://api.watch.dog/api/mcp_server.php)
 */

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

* - Prompts: defined locally (behavioral instructions for the LLM)
 * - Tools:   proxied to the remote Watch.dog MCP PHP server via HTTP
 *
 * Configuration (via environment variables or .env file):
 *   WATCHDOG_API_KEY  – Your Watch.dog API key (sk_live_...)
 *   WATCHDOG_API_URL  – Remote MCP server URL (default: https://api.watch.dog/api/mcp_server.php)
 */

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

// ─── Load .env if present ────────────────────────────────────────────────────

const __dirname = dirname(fileURLToPath(import.meta.url));
const envPath = join(__dirname, ".env");

if (existsSync(envPath)) {
  const envContent = readFileSync(envPath, "utf-8");

• Confidence: 84% confidence
• Finding: The code explicitly reads a local .env file containing API credentials, which is legitimate functionality but still a sensitive secret-access operation. In the context of a user-facing skill that may solicit and persist tokens, silently ingesting secrets from disk increases the risk of unintended credential use and makes auditing/consent weaker.

Credential Access

High

• Category: Privilege Escalation

Content

If the user activates this skill for the first time and has no API Key configured:
1. Greet them enthusiastically and explain that you need to connect to their Watch.dog account.
2. Ask them only for their API Key and API URL (and remind them they can create a free account at https://watch.dog).
3. Once the user provides the data, use your native file writing tools to automatically create or overwrite the .env file in the root of this skill with the exact following format:
   WATCHDOG_API_KEY="[user_key]"
   WATCHDOG_API_URL="[user_url]"
   Never ask the user to create the file manually.

• Confidence: 90% confidence
• Finding: The prompt instructs the model to collect API credentials from the user and automatically create or overwrite a .env file with them. Even though this file does not expose write tools, the instruction is dangerous because in an agent environment with broader host capabilities it would promote credential harvesting and local secret persistence without an explicit, narrowly scoped credential-management flow.

Known Vulnerable Dependency: @hono/node-server==1.19.9 — 3 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode); CVE-2026-29087 (@hono/node-server has authorization bypass for protected static paths via encode)

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The lockfile pins @hono/node-server 1.19.9, and the reported advisories are relevant because this package is an HTTP server adapter that may expose static content or routing behavior if used by the skill or its SDK. Even though the vulnerable code may be transitive via @modelcontextprotocol/sdk, server-side path traversal or auth-bypass issues can become exploitable if any static-serving or protected path handling is enabled.

Known Vulnerable Dependency: express-rate-limit==8.2.1 — 1 advisory(ies): CVE-2026-30827 (express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting o)

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: express-rate-limit 8.2.1 is reported vulnerable to bypass via IPv4-mapped IPv6 handling, which can let clients evade per-client throttling. In a monitoring skill that may expose MCP/HTTP endpoints, weakened rate limiting can materially increase brute-force, scraping, or resource exhaustion risk.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: fast-uri 3.1.0 has multiple URI parsing and canonicalization advisories including host confusion and possible SSRF-relevant parsing discrepancies. Because this skill works with website/API monitor targets and user-supplied URLs are central to its purpose, unsafe URI handling is more dangerous in this context than in a package that never processes external URLs.

Known Vulnerable Dependency: hono==4.12.3 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: hono 4.12.3 is associated with numerous advisories affecting cookies, routing, and path handling, which are core HTTP framework functions. Since the package under analysis includes the MCP SDK that depends on Hono, these issues represent a genuine framework-level exposure if the skill is run as a networked service.

Known Vulnerable Dependency: ip-address==10.0.1 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: ip-address 10.0.1 is flagged for address parsing inconsistencies and an HTML-emitting XSS issue. The rate-limiting dependency chain suggests IP parsing may influence client identification, so parsing mismatches could contribute to security-control bypasses, though the XSS aspect is less likely unless IP-derived HTML is rendered.

Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

High

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: path-to-regexp 8.3.0 is reported vulnerable to ReDoS patterns, which can let crafted paths consume excessive CPU during route matching. Because this dependency sits in the routing stack, an exposed HTTP service could be made unavailable by maliciously structured requests.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares network and environment-variable capabilities but does not define an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege boundaries and makes it harder for a host to constrain what the skill may access, especially since it can use user-supplied API credentials and reach an external service.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs an automatic credential-verification API call immediately after credentials are provided or changed, without an explicit warning that the supplied secrets will be used to contact a third-party service. That creates a consent and privacy problem because users may think they are only storing configuration, while the skill silently transmits data and authenticates externally.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: A silent test triggered by credential entry causes the agent to process and use user-provided secrets automatically, outside the user's explicit operational request. Even if the intent is benign, this increases the risk of accidental secret exposure, unintended external actions, and poor auditability of when credentials were used.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

"check uptime", "review watchdogs", or "create a website monitor".
  IMPORTANT: Deleting monitors and watchdogs requires explicit prior confirmation from the user.
  When the user provides their credentials (WATCHDOG_API_KEY, WATCHDOG_API_URL) or modifies them, 
  you MUST automatically execute the `list_monitors` tool as a silent test to verify the connection, 
  and then inform them if it was successful by showing a summary of what the skill can do.
version: "1.0.0"
author: Oda Monitor Team

• Confidence: 90% confidence
• Finding: The instruction to automatically execute list_monitors on credential changes grants the skill autonomous authority to perform an external authenticated action without a direct user request at that moment. In a credential-handling context, this is more dangerous because it couples secret submission with immediate network use and reduces meaningful user control.

External Transmission

Medium

• Category: Data Exfiltration

Content

*
 * Configuration (via environment variables or .env file):
 *   WATCHDOG_API_KEY  – Your Watch.dog API key (sk_live_...)
 *   WATCHDOG_API_URL  – Remote MCP server URL (default: https://api.watch.dog/api/mcp_server.php)
 */

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

*
 * Configuration (via environment variables or .env file):
 *   WATCHDOG_API_KEY  – Your Watch.dog API key (sk_live_...)
 *   WATCHDOG_API_URL  – Remote MCP server URL (default: https://api.watch.dog/api/mcp_server.php)
 */

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

*
 * Configuration (via environment variables or .env file):
 *   WATCHDOG_API_KEY  – Your Watch.dog API key (sk_live_...)
 *   WATCHDOG_API_URL  – Remote MCP server URL (default: https://api.watch.dog/api/mcp_server.php)
 */

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

*
 * Configuration (via environment variables or .env file):
 *   WATCHDOG_API_KEY  – Your Watch.dog API key (sk_live_...)
 *   WATCHDOG_API_URL  – Remote MCP server URL (default: https://api.watch.dog/api/mcp_server.php)
 */

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill loads credentials from a local .env file or environment variables and then uses them operationally, but the executable code path provides no built-in disclosure, consent flow, or visibility to the user about how those secrets are handled. In this skill context, that matters because the prompt also encourages collecting and persisting API credentials, increasing the chance users provide sensitive tokens without clear runtime notice.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The embedded behavioral instructions explicitly tell the assistant to use native file writing tools to create or overwrite a .env file and then run list_monitors. However, this skill file only registers Watch.dog proxy tools and contains no file-writing tool or implementation that can perform that action. This is an active contradiction between the documented behavior and the actual code capabilities.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

3. Once the user provides the data, use your native file writing tools to automatically create or overwrite the .env file in the root of this skill with the exact following format:
   WATCHDOG_API_KEY="[user_key]"
   WATCHDOG_API_URL="[user_url]"
   Never ask the user to create the file manually.
4. Immediately after, execute list_monitors to test the connection.
   - If successful: celebrate with the user and offer to create their first monitor or watchdog.
   - If it fails with Auth Error: kindly ask them to verify their key and URL.

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The system prompt states it is forbidden to show raw JSON and requires friendly presentation. But tool wrappers later tell the model to 'Transmit this JSON result' or summarize 'using this JSON', creating contradictory instructions about whether raw JSON output is acceptable. This mismatch can lead to behavior that violates the skill's stated interaction contract.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This function transmits the user's API bearer token and monitoring-related arguments to a remote HTTP endpoint, but the code itself does not provide runtime disclosure or confirmation to the user when this happens. In a monitoring skill, external transmission is expected, but silent credentialed transmission to a third-party service still creates privacy and trust risk if users are not clearly informed.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: index.js:31