Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
AWS CloudWatch
v0.0.1Query AWS CloudWatch metrics for ECS/EC2/RDS and return charts.
⭐ 0· 506·2 current·2 all-time
bydelberthh@delbertheihei
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill name/description (CloudWatch metrics for ECS/EC2/RDS) align with the included code and instructions. However the registry metadata lists no required binaries or env vars while the SKILL.md and the code clearly require the Node.js runtime and AWS credentials (AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY). This is an inconsistency in metadata (likely omission) rather than a functional mismatch.
Instruction Scope
SKILL.md explicitly instructs running the included Node CLI and lists the AWS credentials and optional region. The runtime instructions and the code both stay within the declared scope (build a SigV4-signed request to monitoring.<region>.amazonaws.com and parse CloudWatch GetMetricStatistics). The skill reads an optional config.json in its own directory; there are no instructions to read or transmit other system files or secrets beyond the AWS credentials required to call CloudWatch.
Install Mechanism
There is no install spec (instruction-only), and the code uses only built-in Node modules (crypto, https, fs, path, child_process). No external downloads or registry packages are pulled. However the package assumes Node.js is available despite 'required binaries' being declared none; that omission should be corrected in metadata.
Credentials
The skill legitimately needs AWS credentials to sign and call CloudWatch APIs. But the registry metadata incorrectly lists no required env vars while SKILL.md and the code require AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (and optionally AWS_REGION). This is a material documentation mismatch: the skill will fail or prompt for creds if they are not present. Requesting these two credentials is proportionate for the stated purpose, but the implementation uses raw long-lived credentials (environment variables) rather than, say, an assumed role or SDK credential chain — users should limit the IAM permissions and prefer short-lived credentials where possible.
Persistence & Privilege
The skill does not request persistent/always-on presence, does not modify other skills or global agent settings, and only reads/writes files in its own directory (optional config.json). It spawns the included CLI locally via child_process, which is expected given the wrapper script.
Assessment
This skill appears to do exactly what it claims: call CloudWatch GetMetricStatistics and summarize datapoints. Before installing, note three practical points: (1) Metadata omissions — the registry incorrectly omits Node.js and AWS env vars; you must have Node.js available and set AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY (or otherwise supply credentials) for it to work. (2) Credentials — the skill uses raw credentials to sign requests. Use least-privilege credentials (policy scoped to CloudWatch Read/GetMetricStatistics and any required resource access), prefer short-lived credentials or an instance/role where possible, and avoid exposing long-lived root credentials. (3) Source trust — the skill's source/homepage is unknown. The code is short and readable (no obfuscated network endpoints), but if you plan to run it in production, review the code yourself or run it in an isolated environment. If you want tighter security, require the author to declare required binaries/env vars in metadata and to provide a verifiable source URL or package repository.Like a lobster shell, security has layers — review code before you run it.
latestvk97ezm0kzwwra5jnq1m67gk5x5821s8y
License
MIT-0
Free to use, modify, and redistribute. No attribution required.