by 安全扫描
OpenClaw
安全
high confidenceThe skill is internally consistent: it implements a CLI helper and SKILL.md for calling a MeshMonitor REST API and only requires the base URL and bearer token the user supplies.
评估建议
This skill appears to do what it claims: it is a helper for calling a MeshMonitor instance and includes a CLI script that issues authenticated HTTP requests to whatever base URL you provide. Before installing or running it: (1) only supply base URLs and tokens for servers you trust — the helper will send whatever data the MeshMonitor API exposes to that endpoint; (2) be aware the tool can perform writes (send-message), so avoid giving it privileged tokens unless you intend to allow writes; (3) k...详细分析 ▾
✓ 用途与能力
Name, description, SKILL.md, reference notes, and the included Python helper all align with a MeshMonitor REST API integration. The script implements the documented read and write endpoints (including send-message), which matches the stated capabilities.
✓ 指令范围
Runtime instructions are scoped to discovering docs, testing bearer auth, and calling API endpoints. They do not instruct the agent to read unrelated local files, environment variables, or system configuration. The docs explicitly advise conservative read-first probing and to request fresh tokens on auth failure.
✓ 安装机制
No install spec is provided (instruction-only plus an included helper script). Nothing is downloaded or written during install by the skill metadata, so there is minimal install-time risk.
✓ 凭证需求
The skill requests no environment variables or credentials in metadata; it expects the user to provide a base URL and bearer token at runtime, which is appropriate and proportional for an API integration. The included script accepts a token argument rather than reading unexpected secrets from the environment.
✓ 持久化与权限
The skill is not always-enabled and has no special persistence or system-wide changes. It does include functionality that can perform write actions (send-message/POST /messages) which is consistent with the documented capabilities; autonomous invocation is enabled by default but not combined with other concerning privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/4/1
Initial release: MeshMonitor API skill with endpoint discovery, node/channel/telemetry/message/traceroute/network/packet/solar support, message sending, and report helpers.
● 无害
安装命令
点击复制官方npx clawhub@latest install meshmonitor-api
镜像加速npx clawhub@latest install meshmonitor-api --registry https://cn.longxiaskill.com镜像同步中