Is darkstards9/grafana-plugin safe?
Yes. darkstards9/grafana-plugin is safe to install. Oathe's behavioral security audit gave the grafana-plugin skill by darkstards9 a trust score of 92/100 with 4 findings, none critical or high.
https://github.com/openclaw/skills/tree/main/skills/darkstards9/grafana-plugin
Is darkstards9/grafana-plugin safe to install?
This Grafana plugin skill appears legitimate and safe, implementing read-only access to Grafana dashboards as advertised. While it requires sensitive credentials and can access monitoring data, this is necessary for its intended functionality and no malicious behavior was detected.
What security issues were found in darkstards9/grafana-plugin?
Category Scores
Findings (4)
MEDIUM Requires sensitive Grafana credentials -10 ▶
The skill requires GRAFANA_URL, GRAFANA_USER, and GRAFANA_PASSWORD environment variables to authenticate with Grafana instances. While legitimate for the skill's purpose, these credentials provide access to potentially sensitive monitoring data.
LOW Access to monitoring data -5 ▶
The skill can read all dashboards and panel data that the provided Grafana user has access to, which may include sensitive infrastructure metrics and monitoring data.
LOW Contains executable JavaScript code -10 ▶
The skill includes JavaScript code that registers tools and makes HTTP requests. The code appears benign and implements standard plugin functionality.
INFO Standard plugin functionality -15 ▶
The skill implements exactly what it advertises - read-only access to Grafana dashboards and panels through standard HTTP API calls with proper authentication.
Should I install darkstards9/grafana-plugin?
Oathe's verdict for darkstards9/grafana-plugin is SAFE with a trust score of 92/100. Recommendation: Install.