ThingsBot
v0.1.0Manage ThingsBoard devices, dashboards, telemetry, and users via the ThingsBoard REST API.
⭐ 6· 1.8k·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match required binaries (curl, jq) and environment variables (TB_URL, TB_USERNAME, TB_PASSWORD). All declared requirements are appropriate for a REST-API-based ThingsBoard administration skill.
Instruction Scope
SKILL.md stays within ThingsBoard admin scope (login, devices, telemetry, dashboards, users). It instructs storing server info in credentials.json (a sample file is included). Two items to note: (1) SKILL.md references TB_REFRESH_TOKEN for token refresh but TB_REFRESH_TOKEN is not declared in requires.env (minor inconsistency); (2) many commands are administrative and destructive (DELETE endpoints, making dashboards public) — appropriate for the purpose but they require you to supply properly scoped credentials to avoid unintended changes.
Install Mechanism
Instruction-only skill with no install spec and no code files. This is low-risk: nothing is downloaded or written by an installer.
Credentials
Declared env vars (TB_URL, TB_USERNAME, TB_PASSWORD) are proportionate to the stated functionality. No unrelated credentials or high-privilege services are requested. The included credentials.json contains sample/local credentials — treat as example only and replace with appropriate credentials.
Persistence & Privilege
always is false and the skill does not request system config paths or global changes. disable-model-invocation is false (normal), so the agent could call the skill autonomously if allowed by policy — this is expected for functional skills.
Assessment
This skill is coherent for managing ThingsBoard via its REST API, but take these precautions before installing:
- Do not provide production/admin credentials to the skill unless you trust the environment and the skill source; create a limited user with only the permissions needed (read/list vs. create/delete) where possible.
- Replace the included sample credentials.json with your own config (the provided file contains example local credentials only).
- Note the SKILL.md references a TB_REFRESH_TOKEN variable not declared in the requirements — expect to obtain/store refresh tokens at runtime if you need refresh functionality.
- Understand that many example commands are destructive (DELETE, making dashboards public); verify commands before running and confirm TB_URL points to the intended server.
- Because this is instruction-only (no installer), review the SKILL.md before use; it runs curl commands leveraging whatever credentials you provide. If you want stricter control, run the commands manually or provide a low-privilege account to the skill.Like a lobster shell, security has layers — review code before you run it.
latestvk97awjfvfsrcz6bx8kaf2xgne580a1zs
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📊 Clawdis
Binsjq, curl
EnvTB_URL, TB_USERNAME, TB_PASSWORD