zabbix

name	zabbix
description	Read Zabbix monitoring state, inspect monitored hosts, summarize current or recent problems, and prepare guarded incident-response context without exposing Zabbix credentials.
user-invocable	true
requires	{"bins":["node"]}
credentials	[{"id":"ZABBIX_API_TOKEN","kind":"bearer","required":true,"secret_ref":{"source":"store","id":"ZABBIX_API_TOKEN"},"scope":"https://<zabbix-frontend>/api_jsonrpc.php Authorization bearer","how_to_obtain":"Create a Zabbix API token in the Zabbix frontend. Set\n`ZABBIX_API_TOKEN` through browser admin at\n`/admin/secrets`; if browser admin is unavailable,\nuse `/secret set ZABBIX_API_TOKEN \"<token>\"` in browser `/chat` or TUI;\nlocal console fallback:\n`hybridclaw secret set ZABBIX_API_TOKEN \"<token>\"`.\n"}]
metadata	{"hybridclaw":{"category":"production-ops","short_description":"Zabbix monitoring reads for incident triage.","tags":["zabbix","monitoring","incident-response","production","r21"],"related_roadmap":["R21","R32","R33"],"issue":1045,"stakes_tiers":{"green":"[Truncated]","amber":"[Truncated]","red":"[Truncated]"},"escalation":{"writes":"confirm-each","route":"f14"},"cost_measurement":{"system":"UsageTotals","sub_limit_key":"zabbix"}}}

Zabbix

Use this skill for Zabbix production monitoring reads: API health checks, monitored host inventory, current or recent problems, problem-state triggers by severity, and concise incident summaries that can feed R29 cards. Zabbix tells us what is broken; local or SSH maintenance skills investigate and remediate on the affected host.

This v1 skill is read-only. Do not acknowledge, suppress, close, update, or delete Zabbix objects through this skill. If a later task adds write operations, each write must be amber/red, require an exact operator grant through F8/F14, and include the Zabbix event id and action in the approval text.

Credential Rules

Set or update the API token in this order:

1. Browser admin: open the active HybridClaw admin URL ending in /admin/secrets and set ZABBIX_API_TOKEN.
2. Browser /chat or TUI fallback: /secret set ZABBIX_API_TOKEN "<zabbix-api-token>".
3. Local console fallback:

hybridclaw secret set ZABBIX_API_TOKEN "<zabbix-api-token>"

For live calls, run the helper to build a gateway http_request payload and pass only the emitted httpRequest object to the built-in http_request tool. The helper sets bearerSecretName: "ZABBIX_API_TOKEN" for authenticated Zabbix methods so the gateway injects the bearer token server-side. It never prints Authorization headers, token values, usernames, passwords, or Zabbix session tokens.

When a terminal-side live smoke test is needed, pass --live to the same http-request command. It posts the same httpRequest object to the HybridClaw gateway /api/http/request route and stops after the first Zabbix 401/403 response. Set HYBRIDCLAW_GATEWAY_URL and HYBRIDCLAW_GATEWAY_TOKEN only for gateway access; do not store those as Zabbix credentials.

Do not call Zabbix with curl when the gateway http_request tool is available. Do not ask the user to paste a Zabbix API token, username/password, or session token into chat.

If the operator has a tenant-specific frontend path, pass it with --base-url or set ZABBIX_BASE_URL in the runtime environment. The helper accepts both https://zabbix.example.com/zabbix and https://zabbix.example.com/zabbix/api_jsonrpc.php and normalizes both to the JSON-RPC endpoint. HTTPS is required by default. Use only for a trusted local or private Zabbix frontend where plaintext HTTP is an intentional operator choice.