Unifi Skill

This skill generally does what it claims (read-only UniFi monitoring), but there are several things to check before installing or running it: - Metadata mismatch: The registry claims no credentials are required, but the skill expects a credentials file (~/.openclaw/credentials/unifi.json) containing a UniFi username/password. Confirm you are comfortable storing a local UniFi account for this skill and that the registry/package owner should have declared this requirement. - Use a minimally privileged account: Create a dedicated local admin/read-only account for monitoring where possible. Do NOT use your Ubiquiti cloud account. If possible, create an account with the least privilege required. - Protect the credentials file: Ensure ~/.openclaw/credentials/unifi.json has restrictive file permissions (e.g., chmod 600) and is stored only on the machine running the skill. - Sensitive data persisted to disk: dashboard.sh writes dashboard_debug_dump.json containing aggregated API responses. Either remove or secure that file, run the script in a controlled directory, or set UNIFI_OUTPUT_FILE so you control where output is written. Review and delete any debug dumps before sharing or backing up the directory. - TLS verification disabled: The scripts use curl -k to bypass certificate checks (documented as because UniFi often uses self-signed certs). If possible, import or trust the gateway certificate and modify scripts to avoid -k to prevent man-in-the-middle risks. - Verify endpoints and scope: The skill claims GET-only usage and the references list only read endpoints, but some 'rest/*' endpoints expose firewall rules, port forwards, and other configuration data which may be sensitive. Confirm you are comfortable with the particular data these endpoints return. - Registry hygiene: Consider asking the skill author or registry maintainer to update the package metadata to declare the required credential/config path and any optional env vars, and to document the debug dump behavior and TLS choices. If you need a safer setup: run the scripts from an isolated admin machine, create a least-privileged local account, set proper file permissions, and remove or relocate dashboard_debug_dump.json after each run.