Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

System Monitor Pro

Real-time OpenClaw system monitoring with beautiful terminal UI. CPU, memory, disk, GPU, Gateway, cron jobs, model quota, and multi-machine support. Works on...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 526 · 10 current installs · 10 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The name/description match the included monitor.js. The script collects CPU, memory, disk, GPU, uptime, cron/openclaw status and supports SSH remote monitoring — all expected for a system-monitoring skill. It calls OpenClaw CLI commands (openclaw gateway/cron) which is coherent with 'Gateway' and 'cron job' monitoring.
Instruction Scope
SKILL.md instructs running the bundled monitor.js with optional --remote/--json/--alert-only. The script runs local system commands (cat /proc, df, uptime, nvidia-smi, etc.) and, if --remote is used, executes commands over ssh. This is within scope for monitoring, but the script disables SSH host-key checking (-o StrictHostKeyChecking=no), which reduces SSH security (MITM risk) and is worth noting before using against remote hosts.
Install Mechanism
No install spec; the skill is instruction + a single Node.js script. No external downloads or packaged installers are performed by the skill itself.
Credentials
The skill declares no required env vars or credentials. It does implicitly rely on the system's ssh client and any SSH keys/config in the user's environment for remote monitoring, and on the presence of the OpenClaw CLI and Node.js. Those implicit dependencies are proportional to the claimed functionality.
Persistence & Privilege
always is false and the skill does not modify other skills or system configuration. It simply reads system state and prints output; it does not request elevated persistence or extra privileges.
Assessment
This skill appears to do what it says — a local/remote system monitor implemented as a Node script — but review a few items before installing/running: 1) The script uses your system ssh client and existing SSH keys for --remote; SSH is invoked with StrictHostKeyChecking=no which will accept new host keys automatically (MITM risk) — avoid using --remote with untrusted networks/hosts or modify the script to remove that option. 2) It runs many shell commands (cat /proc, openclaw CLI, nvidia-smi, etc.), so ensure you trust the script source before running it on sensitive systems. 3) If you plan to run it periodically (HEARTBEAT), run it under a restricted account or sandbox and verify the paths (skill directory) are correct. 4) The code has minor logic/formatting bugs (visual bar threshold uses cpu threshold for all bars) but nothing that indicates malicious intent. If you want higher assurance, request the publisher/source or run the script in a disposable VM/container first.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
latestvk97aaw7mgs2g10mhndqn6eckr981ye9j

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

System Monitor Pro 🖥️

Real-time OpenClaw system monitoring skill. Beautiful formatted output directly in your chat.

Features

  • 🖥️ CPU / Memory / Disk usage with visual bars
  • 🎮 GPU monitoring (NVIDIA) — utilization + VRAM
  • 🌐 Gateway status + uptime
  • ⏰ Cron job status overview
  • 🤖 Model & quota tracking
  • 💻 Multi-machine support (SSH remote monitoring)
  • 📊 Beautiful terminal-style formatted output
  • 🔔 Alert thresholds (CPU>80%, Memory>85%, Disk>90%)

Usage

Just say any of these:

  • "system status" / "系统状态"
  • "monitor" / "监控"
  • "health check" / "健康检查"
  • "dashboard"

How It Works

When triggered, run the monitor script:

node <skill_dir>/monitor.js [--remote user@host] [--json] [--alert-only]

Options

  • --remote user@host — Monitor a remote machine via SSH
  • --json — Output raw JSON instead of formatted text
  • --alert-only — Only show items that need attention

Output Format

The script outputs a beautifully formatted system status card like:

🦞 OpenClaw System Status
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🖥️ CPU    ██░░░░░░░░  18%
💾 Memory ████░░░░░░  42%  6.8/16.0 GB
💿 Disk   █░░░░░░░░░   7%  14/228 GB
🌐 Gateway ● Running (pid 1234)
⏰ Crons   6/6 OK
🤖 Model   claude-opus-4-6 (yunyi)
💰 Quota   ████████████ 100% ⚠️
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Multi-Machine Example

# Local machine
node monitor.js

# Remote machine via SSH
node monitor.js --remote macmini2001-01@100.104.241.24

# Both machines
node monitor.js && node monitor.js --remote macmini2001-01@100.104.241.24

Integration

Add to your HEARTBEAT.md for periodic monitoring:

## System Monitor (every 30 min)
Run: node ~/.openclaw/workspace/skills/system-monitor-pro/monitor.js --alert-only
If alerts found → notify user

Requirements

  • Node.js 18+
  • macOS or Linux
  • SSH access for remote monitoring (optional)
  • nvidia-smi for GPU monitoring (optional)

Files

FileDescription
SKILL.mdThis file
monitor.jsMain monitoring script

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…