Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Clawhub Skill Infra Watchdog

Self-hosted infrastructure monitoring for HTTP, TCP, SSL, disk, memory, load, Docker, DNS, and custom commands with alerting via OpenClaw messaging.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 458 · 1 current installs · 1 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description match the included code: watchdog.py implements HTTP, TCP, Docker, disk/memory checks and local storage under ~/.openclaw/workspace/infra-watchdog-data. However, the skill claims alerting via WhatsApp/Telegram/Discord and 'Zero external SaaS required' without declaring how those channels are configured (no required env vars, no webhook/token config described). That is an unexplained capability.
Instruction Scope
SKILL.md instructions target only the skill's own workspace (~/.openclaw/workspace/infra-watchdog-data) and describe CLI usage (init, add-monitor, check, cron-install). That scope is reasonable for a monitoring tool. The instructions do reference sending alerts to external messaging channels but give no details on credentials or endpoints; they also instruct editing the local config.json which is consistent with local-only storage.
Install Mechanism
No install spec (instruction-only) is present; code is included as a script (watchdog.py). This is low-risk in terms of automatic downloads. The included code invokes system commands (docker, df, free, docker inspect) via subprocess which is expected for a monitoring tool but means it relies on host binaries being present.
!
Credentials
The skill requests no environment variables or credentials but claims to send messages to WhatsApp/Telegram/Discord. Those channels normally require credentials (bot token, webhook URL, WhatsApp gateway credentials). The absence of declared env vars or a documented credential setup is a disproportionate omission and makes the alerting claim unclear. Additionally, skill.json lists openclaw tools including 'message'—it's plausible alerts are routed via the platform's message facility, but SKILL.md and code do not explain how user messaging preferences or credentials are handled.
Persistence & Privilege
always is false and there are no install routines that modify other skills or global settings described. The skill writes only under its own workspace path, so requested persistence and privileges appear appropriate for its purpose.
What to consider before installing
Before installing or running this skill, verify how alerts are actually delivered: inspect watchdog.py for the alerting implementation to see whether it uses OpenClaw's internal 'message' tool, requires webhooks, or contains hardcoded endpoints. Confirm the upstream repository and author identity (SKILL.md lists a GitHub project but the registry entry lacks a homepage). Do not provide any messaging API tokens or system credentials until you understand where they are stored and how they are transmitted. Run the script in a restricted environment (or container) first to observe network activity and cron-install behavior. If you rely on WhatsApp/Telegram/Discord alerts, ask the author or examine the code for explicit setup steps (webhook URLs, bot tokens, or instructions for local gateways) — the current package does not document those credentials, which is the main inconsistency that makes this skill suspicious.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.1.0
Download zip
alertingvk97544p03d32fyh3t6tp476h8n81rds5devopsvk97544p03d32fyh3t6tp476h8n81rds5homelabvk97544p03d32fyh3t6tp476h8n81rds5infrastructurevk97544p03d32fyh3t6tp476h8n81rds5latestvk97bztdr3shj6acyrjtx6myae181vyanmonitoringvk97544p03d32fyh3t6tp476h8n81rds5

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Infra Watchdog — Infrastructure Monitoring & Health Alerts

Self-hosted infrastructure monitoring for OpenClaw agents. Zero external SaaS required — monitors everything locally and alerts via WhatsApp, Telegram, or Discord.

What It Does

  • HTTP/HTTPS endpoint monitoring — checks status codes, response time, SSL validity
  • TCP port checks — database, SSH, custom services
  • Docker container status — running, stopped, unhealthy
  • System resources — CPU, RAM, disk usage with configurable thresholds
  • SSL certificate expiry — alerts 30 days before expiry
  • DNS resolution checks — verifies domain → IP mappings
  • Proxmox VM/CT status — checks via local API
  • Alerts via WhatsApp/Telegram/Discord — with configurable cooldown

Quick Start

# Initialize data directory & config
infra-watchdog init

# Add your first monitor
infra-watchdog add-monitor --type http --name "My API" --url https://myapi.example.com

# Add a TCP port check
infra-watchdog add-monitor --type tcp --name "PostgreSQL" --host localhost --port 5432

# Add a Docker container check
infra-watchdog add-monitor --type docker --name "My App" --container myapp

# Run all checks now
infra-watchdog check

# View current status dashboard
infra-watchdog dashboard

# Install auto-check cron (every 5 min)
infra-watchdog cron-install

Commands

CommandDescription
infra-watchdog initSet up data directory and default config
infra-watchdog add-monitorAdd a new monitor (http/tcp/docker/resource/ssl/dns)
infra-watchdog listList all configured monitors and their current state
infra-watchdog checkRun all checks immediately
infra-watchdog check --name <name>Run a specific monitor
infra-watchdog statusSummary: UP/DOWN/WARN counts
infra-watchdog dashboardASCII dashboard with all monitors
infra-watchdog cron-installInstall auto-check cron job

Monitor Types

HTTP/HTTPS

infra-watchdog add-monitor \
  --type http \
  --name "Main API" \
  --url https://api.example.com/health \
  --expected-status 200 \
  --timeout 5

TCP Port

infra-watchdog add-monitor \
  --type tcp \
  --name "Postgres" \
  --host 192.168.1.10 \
  --port 5432

Docker Container

infra-watchdog add-monitor \
  --type docker \
  --name "Nginx" \
  --container nginx-proxy

System Resources

infra-watchdog add-monitor \
  --type resource \
  --name "Disk /" \
  --resource disk \
  --path / \
  --warn-at 80 \
  --alert-at 90

SSL Certificate

infra-watchdog add-monitor \
  --type ssl \
  --name "My Domain SSL" \
  --host example.com \
  --port 443 \
  --warn-days 30

Configuration

Edit ~/.openclaw/workspace/infra-watchdog-data/config.json:

{
  "alert_channel": "whatsapp",
  "alert_cooldown_minutes": 15,
  "check_interval_minutes": 5,
  "ssl_expiry_warning_days": 30
}

Alert Channels

ChannelConfig value
WhatsApp"whatsapp"
Telegram"telegram"
Discord"discord"
None (log only)"none"

Use Cases

Homelab Monitoring

Track all your self-hosted services: Proxmox, Docker stacks, databases, Jellyfin, Home Assistant, etc. Get a WhatsApp alert the moment anything goes down.

API Uptime Monitoring

If you sell API services on RapidAPI, this skill monitors your endpoints 24/7 and pings you before customers notice an outage.

SSL Expiry Prevention

Never let a certificate expire again. Get a WhatsApp warning 30 days before expiry.

Resource Alerts

Disk full at 3am? Get alerted before it kills your services.

Data Storage

All data stored locally at ~/.openclaw/workspace/infra-watchdog-data/. SQLite database, no cloud sync, no telemetry.

Requirements

  • Python 3.8+
  • Docker (optional, for container monitoring)
  • OpenClaw 1.0+

Source & Issues

Files

3 total
Select a file
Select a file to preview.

Comments

Loading comments…