Security audit
Security checks for vulnerabilities and agentic risk
This monitoring skill is mostly coherent, but it asks for shell execution and includes an unconstrained custom command check plus broad activation language that deserve review before use.
Install only if you are comfortable with a monitoring skill that can run shell commands and make outbound HTTP requests. Prefer fixed http, ssl, process, disk, and port checks; avoid custom commands unless you review them first, and configure webhooks or push tokens only for destinations you trust.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"api_prod": {
"description": "生产 API 健康检查",
"checks": [
{"type": "http", "target": "https://api.example.com/health"}
],
"interval": "5m",
"alert_on": "change",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"api_prod": {
"description": "生产 API 健康检查",
"checks": [
{"type": "http", "target": "https://api.example.com/health"}
],
"interval": "5m",
"alert_on": "change",
The trigger conditions include broad operational tasks such as system monitoring, log analysis, operations alerting, and deployment management, which exceed the narrowly described monitoring functionality. In an agent router, overly broad activation can cause this skill to be selected for unrelated tasks and then invoke exec-backed commands in contexts the user did not specifically intend.
The skill explicitly advertises a custom check type whose tool requirement is '用户指定' and elsewhere declares exec access, effectively expanding the skill from fixed monitoring primitives into arbitrary command execution. In an agent context, this can be abused to run unreviewed shell commands on the host, exfiltrate data, or modify the system well beyond the stated monitoring scope.
The skill documents webhook alert delivery that posts monitoring status data to an external URL, but it does not prominently warn users that operational metadata will leave the local environment. This creates a data egress risk because monitor names, failure states, timestamps, endpoints, and potentially internal service information may be transmitted to third-party infrastructure.
This example performs an outbound curl -X POST to a webhook endpoint, which is a real external transmission path. In the context of a monitoring skill, such egress is expected functionality, but it is still security-relevant because it can leak service health data and internal naming details to external systems if used without clear consent.
# Webhook 告警示例
curl -X POST https://hooks.example.com/alert \
-H "Content-Type: application/json" \
-d '{
"monitor": "my_website",
The manifest description speaks generally about monitoring workflows and configuration guidance, while the core capabilities emphasize local checks and webhook-style alerts. L238 adds support for Pushover-style push services via environment variables, which is an extra integration capability not declared in the manifest's stated scope.
No suspicious patterns detected.