VictoriaMetrics
v1.1.0Query and manage VictoriaMetrics time-series database instances. Supports both single-node and cluster deployments with multi-tenancy. Use when the user asks...
⭐ 0· 96·0 current·0 all-time
byJames.Yang@yangjinzhao
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name, description, SKILL.md, reference docs, and included CLI implementation all align: this is a CLI for querying/managing VictoriaMetrics. Minor gap: the runtime instructions assume Node (invoke via `node scripts/cli.js`) but the registry metadata lists no required binaries/dependencies. Declaring Node.js as a required binary would be expected.
Instruction Scope
Runtime instructions and the CLI implementation stay within scope: they read a local config file, prompt for credentials, and make HTTP(S) requests to the user-provided VictoriaMetrics endpoints. There are no instructions to read unrelated system files, enumerate other services, or transmit data to unexpected external endpoints.
Install Mechanism
No install spec is provided (instruction-only with an included script). The code is shipped in the skill and will run when the user invokes the CLI with Node. There are no downloads from external URLs or archive extraction steps in the install metadata.
Credentials
The skill does not require any declared environment variables or secrets in registry metadata. It documents optional legacy env vars (VICTORIAMETRICS_URL, _USER, _PASSWORD) and supports per-instance credentials stored in the local config. The variables and file access it requests are proportional to its purpose.
Persistence & Privilege
always:false and the skill does not request permanent platform-wide privileges. It writes its own config file under the user's workspace (~/.openclaw/workspace/victoriametrics.json) which is expected behavior for a CLI; it does not attempt to modify other skills or global agent settings.
Assessment
This skill implements a local CLI that reads/writes a config file in your OpenClaw workspace and makes HTTP(S) requests to the VictoriaMetrics endpoints you configure. Before installing: (1) Be sure you have Node.js available (the SKILL.md uses `node scripts/cli.js`) — the skill metadata does not declare this dependency. (2) Store only credentials you trust in the config file; the CLI will save any username/password you enter to ~/.openclaw/workspace/victoriametrics.json by default. (3) Network calls go to the URLs you configure — do not point them to untrusted external endpoints. (4) If you need least privilege, consider running the tool in an environment with restricted network access or using instance-scoped credentials rather than exposing broad secrets. Overall the files and instructions are coherent with the stated purpose.Like a lobster shell, security has layers — review code before you run it.
latestvk973w7bsz9thz44ay2bk3y9ng5838kzz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.