Neomano VPS Monitoring (DigitalOcean)

Monitor DigitalOcean VPS droplets by listing instances and fetching CPU, memory, disk, and bandwidth metrics with summaries using the DigitalOcean API.

Security Scan

The skill appears to do what it claims (query DigitalOcean API for droplets and monitoring metrics) and only needs a DigitalOcean API token and python3, though the registry metadata is missing those requirements.

Purpose & Capability

The SKILL.md and scripts implement DigitalOcean droplet listing and metric queries that match the skill description. However, the top-level registry 'Requirements' section listed no required env vars or binaries while the SKILL.md (and the script) require python3 and DIGITALOCEAN_TOKEN — an inconsistency to be aware of.

Instruction Scope

Runtime instructions only tell the agent to read DIGITALOCEAN_TOKEN and call the DigitalOcean API endpoints to list droplets and fetch metrics. The code does not read other files or env vars, nor does it send data to endpoints outside api.digitalocean.com.

Install Mechanism

There is no install spec (instruction-only style) and the included Python script runs in-place. No external binary downloads or archive extracts are used.

Credentials

The script requires a single credential (DIGITALOCEAN_TOKEN) which is appropriate for the stated purpose. The registry metadata failing to declare that requirement is an inconsistency; verify you provide a token with minimal necessary scope (read/monitoring-only) before use.

Persistence & Privilege

The skill is not always-enabled, does not request system-wide configuration changes, and does not modify other skills' configs. It runs only when invoked.

Assessment

This skill appears to be what it says: a Python helper that queries DigitalOcean's official API. Before installing: (1) Confirm the registry metadata mismatch — the skill requires python3 and DIGITALOCEAN_TOKEN even though the top-level listing omits them. (2) Create a DigitalOcean token scoped as narrowly as possible (read/monitoring only) and avoid reusing a high-privilege token. (3) Review the full script locally (you already have it) and run it in a test environment or sandbox first. (4) Prefer supplying the token via a controlled environment file (e.g., ~/.openclaw/.env) or CI secret store rather than pasting it into chat. (5) Rotate the token if you stop using the skill or if you share it with others.

Credentials

Set DIGITALOCEAN_TOKEN (recommended: ~/.openclaw/.env).

What it can do

• List droplets (/v2/droplets) and find a droplet by name.
• Fetch metrics (Monitoring API):
  • CPU: /v2/monitoring/metrics/droplet/cpu
  • Memory usage % (computed): memory_available + memory_total
  • Disk usage % (computed): filesystem_free + filesystem_size
  • Bandwidth: /v2/monitoring/metrics/droplet/bandwidth (requires direction=inbound|outbound)

Run

python3 {baseDir}/scripts/do_metrics.py droplets
python3 {baseDir}/scripts/do_metrics.py cpu --droplet "web-1" --minutes 60
python3 {baseDir}/scripts/do_metrics.py memory --droplet "web-1" --minutes 60
python3 {baseDir}/scripts/do_metrics.py bandwidth --droplet "web-1" --minutes 60

Notes:

• Output is JSON (raw time-series + a small computed summary).
• Requires that DigitalOcean Monitoring is enabled for the droplet.