Server Monitor Collector

Collect server monitoring data (Zabbix / Prometheus / Alibaba / Tencent / Huawei Cloud), generate CSV/XLSX reports and send via email or Feishu.

Security Scan

The package mostly does what it claims (collect monitoring data and generate/send reports) but contains multiple incoherences and risky defaults — hardcoded endpoints/credentials, undeclared required environment variables, and absolute /root paths — so you should not run it without careful review and cleanup.

Purpose & Capability

Functionality (Zabbix, Prometheus, Alibaba/Tencent/Huawei, email/Feishu) aligns with the description, but the skill metadata declares no required env vars while the scripts clearly expect many secret credentials. Additionally several scripts contain hardcoded default credentials/endpoints (e.g., ZABBIX_URL pointing to zabbix.ops.qiyujoy.com and default ZABBIX_PASSWORD), which is inconsistent with a skill that should only contact user-configured systems.

Instruction Scope

SKILL.md instructs using ~/.hermes/.env and scheduling the main cron; the bundled scripts read environment variables and will auto-detect sources. However code also reads/writes absolute paths under /root/.hermes, and several files contain hardcoded FEISHU_CHAT_ID and default cloud keys/endpoints. The runtime instructions therefore permit (and the code will perform) network calls and potential data disclosure to defaults if the user does not explicitly set their own env vars — broader scope than the metadata indicates.

Install Mechanism

There is no external download — all scripts and reference files are bundled (file installs). That lowers install risk. The scripts require common Python libraries (openpyxl, pandas, httpx, aliyun SDK optionally) which the SKILL.md documents; no opaque remote installers or URL downloads were used. Still, the package includes multiple fairly large scripts with embedded defaults that should be reviewed.

Credentials

Metadata declared no required environment variables, but the skill actually expects many secrets (ZABBIX_URL/TOKEN or user/password, ALIBABA_ACCESS_KEY_ID/SECRET, TENCENT_SECRET_ID/KEY, HUAWEI_ACCESS_KEY/SECRET, SMTP_* , FEISHU_CHAT_ID, etc.) communicated via ~/.hermes/.env or loaded via dotenv. Worse, default secret-like values and keys are present in code (e.g., Alibaba/Alibaba LTAI and SK defaults, Zabbix default password, FEISHU_CHAT_ID), which is disproportionate and risky because missing user config causes the scripts to use those defaults and reach external endpoints.

Persistence & Privilege

The skill does not request 'always: true' and can be invoked by the user, but several scripts use absolute paths under /root (e.g., /root/.hermes/cron/output/* and /root/.hermes/.env). This implies the code expects to run as root or will write to root-owned locations, which is surprising and raises privilege/persistence concerns (unexpected file writes, need to run as root, or failure with possibly inconsistent behavior). The scripts also provide a 'hermes cron create' example which would schedule recurring runs — normal for cron but combine with hardcoded defaults increases blast radius.

scan_findings_in_context

Collect server or cloud VM monitoring data, generate formatted Excel reports, and optionally send summaries via email or Feishu/Lark.

Supported Data Sources

Source	Auth	Notes
Zabbix	User/Pass or API Token	Host groups, memory, CPU, disk
Prometheus	URL only	PromQL queries
Alibaba Cloud CMS	AccessKey/SecretKey	ECS, RDS, SLB, EIP metrics
Tencent Cloud CAM	SecretID/Key	TC3-HMAC-SHA256 signature
Huawei Cloud IAM	AccessKey/SecretKey	IAM Token auth

Data sources are auto-detected from .env — configure credentials for any combination and they will all be collected.

Setup

1. Configure Environment

Create/edit ~/.hermes/.env. Only configure the sources you need:

# --- Zabbix (pick one auth method) ---
ZABBIX_URL=https://zabbix.example.com/api_jsonrpc.php
ZABBIX_USER=Admin
ZABBIX_PASSWORD=your_password
# ZABBIX_TOKEN=your_api_token  # optional, takes priority over password

# --- Alibaba Cloud ---
ALIBABA_ACCESS_KEY_ID=your_key_id
ALIBABA_ACCESS_KEY_SECRET=your_secret
ALIBABA_REGION=cn-hangzhou
# ALIBABA_METRICS=CPUUtilization,MemoryUtilization,InternetInRate  # optional

# --- Tencent Cloud ---
TENCENT_SECRET_ID=your_secret_id
TENCENT_SECRET_KEY=your_secret_key
TENCENT_REGION=ap-shanghai

# --- Huawei Cloud ---
HUAWEI_ACCESS_KEY=your_access_key
HUAWEI_SECRET_KEY=your_secret_key
HUAWEI_REGION=cn-east-3

# --- Notifications ---
FEISHU_CHAT_ID=oc_xxxx         # optional
SMTP_HOST=smtp.example.com      # optional, omit to skip email
SMTP_PORT=465
SMTP_FROM=[e-mail]
SMTP_TOKEN=your_token
TARGET_EMAIL=[e-mail]

# --- Report options ---
# TOPN: show top N hosts by memory+CPU score, 0=off (default: 50)
TOPN=50

2. Install Dependencies

Zabbix / Prometheus — no extra deps:

python3 zabbix_cron.py

Alibaba Cloud — needs SDK (use uv since venv has no pip):

uv run --with aliyun-python-sdk-core --with aliyun-python-sdk-cms \
  python3 cloud_monitor.py

Tencent / Huawei — pure Python, only httpx needed:

uv run --with httpx python3 cloud_monitor.py

3. Run Once (Manual Test)

python3 zabbix_cron.py

Expected output:

• ~/.hermes/cron/output/zabbix_monitor.csv
• ~/.hermes/cron/output/zabbix_monitor.xlsx (one sheet per host group + overview + TOP sheet)

4. Schedule Daily Report

hermes cron create \
  --name "Daily Server Health Report" \
  --script zabbix_cron.py \
  --schedule "30 9 * * *"

Output Format

CSV

• UTF-8-BOM encoding — opens correctly in Windows Excel without garbled characters
• Columns: 主机组, 主机名, IP, 内存可用(GB), 内存总量(GB), 内存占用率(%), CPU占用率(%)

XLSX

• 总览 sheet: summary table with host group stats and alarm counts
• Group sheets: one per host group, sorted by memory usage descending
• TOP50(内存+CPU) sheet: top 50 hosts across all groups by combined memory+CPU score
• Cell coloring: 🔴 ≥80% red, 🟠 ≥60% orange, 🟡 ≥40% yellow

Auto-Detection Logic

Scripts detect which sources to use based on which env vars are set:

Env var present	Data source used
ZABBIX_URL	Zabbix API
ALIBABA_ACCESS_KEY_ID	Alibaba Cloud CMS (SDK)
TENCENT_SECRET_ID	Tencent Cloud CAM (TC3签名)
HUAWEI_ACCESS_KEY	Huawei Cloud IAM (Token)
PROMETHEUS_URL	Prometheus PromQL

Zabbix Host Group Exclusion

These groups are excluded by default (set in EXCLUDE_GROUPS in script):

• Templates* — template groups
• Discovered hosts — Zabbix auto-discovery

Key Zabbix Item Keys

Key	Description
vm.memory.size[available]	Memory available (bytes)
vm.memory.size[total]	Memory total (bytes)
system.cpu.util	CPU utilization (%)
vfs.fs.size[/,pused]	Root disk usage (%)

Alarm Thresholds

Metric	Warning	Alarm
Memory usage	≥40% yellow	≥60% orange, ≥80% red
CPU usage	≥40% yellow	≥60% orange, ≥80% red

Feishu Message Format

Markdown card sent to FEISHU_CHAT_ID containing:

• Report timestamp, total hosts, group count
• Top 20 hosts with memory ≥60% or CPU ≥60%
• Color-coded: 🔴≥80%, 🟠≥60%, 🟡≥40%

Email Format

• Subject: 服务器监控报告 YYYY-MM-DD HH:MM
• Body: HTML summary matching the Feishu card
• Attachment: zabbix_monitor.xlsx

References

• references/zabbix-config.md — Zabbix API details, item keys, auth options
• references/notification-config.md — Feishu and email SMTP setup, common providers
• references/cloud-config.md — Alibaba / Tencent / Huawei API endpoints, namespaces, SDK usage

Guardrails

• Never hardcode credentials — always use ~/.hermes/.env
• Never print full credentials in logs or chat
• Never place scripts in web-accessible directories
• If Zabbix host has no Agent — memory metrics show N/A, CPU still works
• Alibaba Cloud MemoryUtilization requires Cloud Monitor Agent installed on ECS instance