Health monitoring and cost optimization tool for OpenClaw skill ecosystems and power users managing multiple skills. Track all installed skills with real-tim...
Security Analysis
high confidenceThe skill's code, runtime instructions, and requested environment access are consistent with its stated purpose (scanning a skills directory, checking ClawHub for flags/updates, and tracking local usage/costs).
Name/description (health monitoring, cost tracking, security checks) match the files and behavior: scanner reads SKILL.md files under a skills directory, computes hashes, calls a ClawHub API for updates/flags, and stores local telemetry in ~/.nex-skillmon. Required binaries (python3) and the declared env vars (CLAWHUB_API_URL, SKILLS_BASE_DIR) are appropriate for the stated functionality.
Runtime instructions and CLI commands are focused on discovery, health checks, security scans, and cost reporting. The scanner will read all files under SKILLS_BASE_DIR and compute SHA256 hashes; it also makes outbound HTTP requests to CLAWHUB_API_URL for update/flag checks. These behaviors are expected for a monitoring tool, but users should be aware the skill will read the full contents of skill directories (file hashing) and send skill names to the configured ClawHub endpoint.
No external downloads or package installs are performed. setup.sh initializes a local SQLite DB, creates a ~/.nex-skillmon data directory and logs, and creates a symlink/wrapper in ~/.local/bin (or a Windows batch wrapper). The installer is local and idempotent; no network fetches or archives are pulled during setup.
Only CLAWHUB_API_URL and SKILLS_BASE_DIR are declared as required env vars; these are proportionate to checking a remote skill index and scanning a local skills directory. The skill does read other optional env vars (CURRENCY, LOG_LEVEL) but these are non-sensitive configuration values. The package does not request secret tokens, cloud keys, or unrelated credentials.
The skill stores persistent state under the user's home (~/.nex-skillmon) and creates a user-level symlink/wrapper in ~/.local/bin. always is false. This level of persistence is typical for a CLI monitoring tool; it does not modify other skills or system-wide settings beyond adding a user bin entry.
Guidance
This package appears to do what it says: it scans a local skills directory, records metadata and usage in ~/.nex-skillmon, computes SHA256 hashes of skill files, and calls the configured ClawHub API to check for flags/updates. Before installing: (1) verify SKILLS_BASE_DIR points only to the directory you intend scanned (avoid pointing it to sensitive system paths), (2) review the ClawHub endpoint you configure (CLAWHUB_API_URL) if you don't want skill names sent externally — you can disable remote checks by setting CLAWHUB_API_URL to empty as documented, (3) note the installer will create ~/.nex-skillmon and add a user-level executable link (~/.local/bin), and (4) review the provided source if you want to audit what is hashed/posted. If you want to limit exposure, run the tool in a contained environment (VM/container) or review/modify scanner.check_for_updates and check_security_flags to point to a trusted endpoint or disable them.
Latest Release
v1.0.0
Initial release
More by @nexaiguy
Published by @nexaiguy on ClawHub
