Rollbar

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A broader token could let the agent view multiple projects or change Rollbar item status if the user grants write scope.

Why it was flagged

The skill requires a Rollbar access token and supports both narrower project tokens and broader account/write-scoped tokens.

Skill content
Use a token with `read` scope for monitoring; add `write` scope only if you need to resolve/mute items... account tokens grant broader access
Recommendation

Use a project-level read token for monitoring, add write scope only when you intentionally want status changes, and avoid account-level tokens unless multi-project access is necessary.

What this means

Accidental or overly broad use of write commands could mark active errors as resolved or muted, reducing alert visibility.

Why it was flagged

The helper script performs Rollbar API PATCH requests for item status changes such as resolve, mute, and activate.

Skill content
api_patch "item/$ITEM_ID" '{"status":"resolved"}'
Recommendation

Treat resolve, mute, and activate as approval-worthy actions, and prefer read-only tokens when using the skill only for monitoring.

NoteHigh Confidence
ASI10: Rogue Agents
What this means

If enabled, the agent will periodically query Rollbar and surface error data on the configured schedule.

Why it was flagged

The skill suggests user-configured periodic monitoring, which is disclosed and alert-focused rather than hidden persistence.

Skill content
To get automatic alerts for new critical/error items, set up a cron job in OpenClaw... Recommended schedule: every 30–60 minutes during work hours.
Recommendation

Use cron only when desired, keep the schedule limited, and run scheduled monitoring with a read-only token where possible.