Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Uptime Kuma

Interact with Uptime Kuma monitoring server. Use for checking monitor status, adding/removing monitors, pausing/resuming checks, viewing heartbeat history. Triggers on mentions of Uptime Kuma, server monitoring, uptime checks, or service health monitoring.

MIT-0 · Free to use, modify, and redistribute. No attribution required.
2 · 3.5k · 13 current installs · 13 all-time installs
byMortada Sarheed@mSarheed
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
Name/description (Uptime Kuma monitor management) align with included script and SKILL.md. The script uses the uptime-kuma-api library and exposes monitor/list/add/delete/pause/resume/heartbeats/notifications operations that are expected for this purpose.
Instruction Scope
SKILL.md and kuma.py stay within the stated scope: they require Uptime Kuma credentials and call the Uptime Kuma API. The instructions do not reference unrelated system files, directories, or external endpoints beyond the UPTIME_KUMA_URL provided by the user.
Install Mechanism
No install spec; SKILL.md asks the user to pip install uptime-kuma-api (a public PyPI package). This is a typical, proportionate install step for a Python wrapper. Recommend verifying the uptime-kuma-api package provenance before installing.
!
Credentials
SKILL.md and kuma.py require UPTIME_KUMA_URL, UPTIME_KUMA_USERNAME, and UPTIME_KUMA_PASSWORD — these are appropriate and expected. However, the registry metadata lists no required environment variables, creating an inconsistency: the runtime actually demands credentials even though the metadata doesn't declare them.
Persistence & Privilege
Skill is not always-enabled and does not request any special persistent platform privileges. It does not modify other skills or system-wide config. The skill can be invoked autonomously by the agent (platform default), which is expected for skills but should be considered when granting access to credentials.
Assessment
This skill appears to do what it says: manage Uptime Kuma via its API. Before installing, note: (1) the skill requires UPTIME_KUMA_URL, UPTIME_KUMA_USERNAME, and UPTIME_KUMA_PASSWORD at runtime even though the registry metadata didn't declare them — you'll need to provide these credentials. (2) It asks you to pip install the uptime-kuma-api package; verify that package on PyPI and your environment before installing. (3) Provide a least-privilege or dedicated Uptime Kuma account if possible, and ensure the UPTIME_KUMA_URL points only to servers you control (e.g., localhost or a known internal URL). (4) The skill's source/homepage is not provided in the registry; if provenance is important, ask the publisher for a homepage or inspect the included kuma.py (provided) and the uptime-kuma-api package source before use.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.0
Download zip
latestvk976j25ddy4rjz18j95mne638h7ztq8p

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Uptime Kuma Skill

Manage Uptime Kuma monitors via CLI wrapper around the Socket.IO API.

Setup

Requires uptime-kuma-api Python package:

pip install uptime-kuma-api

Environment variables (set in shell or Clawdbot config):

  • UPTIME_KUMA_URL - Server URL (e.g., http://localhost:3001)
  • UPTIME_KUMA_USERNAME - Login username
  • UPTIME_KUMA_PASSWORD - Login password

Usage

Script location: scripts/kuma.py

Commands

# Overall status summary
python scripts/kuma.py status

# List all monitors
python scripts/kuma.py list
python scripts/kuma.py list --json

# Get monitor details
python scripts/kuma.py get <id>

# Add monitors
python scripts/kuma.py add --name "My Site" --type http --url https://example.com
python scripts/kuma.py add --name "Server Ping" --type ping --hostname 192.168.1.1
python scripts/kuma.py add --name "SSH Port" --type port --hostname server.local --port 22

# Pause/resume monitors
python scripts/kuma.py pause <id>
python scripts/kuma.py resume <id>

# Delete monitor
python scripts/kuma.py delete <id>

# View heartbeat history
python scripts/kuma.py heartbeats <id> --hours 24

# List notification channels
python scripts/kuma.py notifications

Monitor Types

  • http - HTTP/HTTPS endpoint
  • ping - ICMP ping
  • port - TCP port check
  • keyword - HTTP + keyword search
  • dns - DNS resolution
  • docker - Docker container
  • push - Push-based (passive)
  • mysql, postgres, mongodb, redis - Database checks
  • mqtt - MQTT broker
  • group - Monitor group

Common Workflows

Check what's down:

python scripts/kuma.py status
python scripts/kuma.py list  # Look for 🔴

Add HTTP monitor with 30s interval:

python scripts/kuma.py add --name "API Health" --type http --url https://api.example.com/health --interval 30

Maintenance mode (pause all):

for id in $(python scripts/kuma.py list --json | jq -r '.[].id'); do
  python scripts/kuma.py pause $id
done

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…