Opencron Skill Repo

Visual cron job dashboard for OpenClaw — live countdown timers, run history, calendar view

Security Scan

The skill mostly does what it claims (serve a local cron dashboard), but it fetches remote HTML and injects sensitive local cron data into that template and has a few metadata/install inconsistencies — this combination could let remote content or a compromised template exfiltrate data.

Purpose & Capability

The skill's declared purpose (visual cron dashboard) matches the files and runtime behavior: it reads ~/.openclaw/cron/jobs.json and runs history and serves an embedded dashboard. However there are small inconsistencies: registry metadata lists only python3 as a required binary while the provided installer (bin/install.js) calls git to clone the repo. The skill also writes into /app/dist/control-ui (gateway UI dir) which is consistent with deploying a UI but is a privileged filesystem target and should be expected/approved before use.

Instruction Scope

Runtime instructions and code explicitly read job and run files from the user's home dir and embed them into HTML served on the local bridge port; this is expected for a dashboard. The concern is that the dashboard HTML is fetched from GitHub at runtime and then served with sensitive data embedded. If that template contains third-party scripts or is changed upstream, those scripts would run in the page context and could exfiltrate window.__OPENCRON_DATA / __OPENCRON_RUNS. The SKILL.md asserts 'no client-side fetch, no auth' — which is accurate for data fetches but increases risk because any external resources referenced by the template (fonts, scripts, analytics) will be loaded by clients and could observe or transmit the embedded data.

Install Mechanism

There is no formal install spec in the registry, but the package includes bin/install.js which clones a GitHub repo and runs a Python deploy script. Cloning from GitHub is a common install mechanism; fetches of raw.githubusercontent.com are also standard. Two issues: (1) install.js invokes 'git' but git is not declared in the skill's required binaries; (2) the code will fetch remote HTML at runtime (urllib requests), so the served UI depends on content fetched over the network — if that remote content is compromised it affects this skill.

Credentials

The skill requests no credentials or environment variables and only reads expected local files (~/.openclaw/cron/jobs.json and runs/*.jsonl). That read access is proportional to the stated purpose. It does, however, write files to ~/.openclaw/canvas and optionally to /app/dist/control-ui which may require filesystem privileges; no secrets are requested by the skill itself.

Persistence & Privilege

always:false and the skill does not request elevated agent privileges, but it does run a long‑running local HTTP server on the bridge port (18790) and can install a background sync (watch_sync.sh). It also writes into the gateway UI directory (/app/dist/control-ui) if present — this modifies other components' served UI and therefore should be permitted only if you trust the skill and the template it deploys. The skill does not autonomously request additional credentials, but autonomous invocation combined with remote template fetch increases blast radius if the fetched content is malicious.

What to consider before installing

What to consider before installing: - Audit the dashboard HTML that will be fetched (cron-dashboard.html). If that template includes external scripts or trackers, they will run with access to the embedded cron data; either vendor a local copy of the template or inspect/strip remote scripts before serving. - The installer uses git to clone the repo but the skill metadata only lists python3 — ensure git is available and be aware the installer will clone a third‑party GitHub repository. - The skill writes to ~/.openclaw/canvas and (if present) /app/dist/control-ui. Confirm you want a third‑party skill to modify your gateway UI directory. - Serving the page is unauthenticated and the bridge port is exposed inside the container. Ensure network access to that port is appropriately restricted so untrusted clients cannot view embedded cron job/run data. - If you decide to install: consider running update_canvas.py once to fetch and inspect the generated cron.html locally (or use generate.py to produce a standalone HTML), and remove or sandbox any external resources (fonts, analytics, remote scripts) in the template. Also consider pinning the template to a specific vetted commit or embedding a vetted copy of the HTML in the skill bundle to avoid unexpected changes from upstream. Confidence notes: assessment is 'suspicious' because behavior is coherent with the described purpose, but the remote-template + embedded sensitive-data pattern and minor metadata/install mismatches increase risk. Additional evidence that would change the assessment: a vetted local copy of cron-dashboard.html bundled in the skill (no remote fetch) and an explicit declaration that the template contains no external scripts would reduce concern and could move this to 'benign.'

OpenCron

A visual dashboard for your OpenClaw cron jobs.

Setup

1. Start the dashboard server

nohup python3 skills/opencron/serve.py --port 18790 &

Fetches the dashboard HTML from GitHub, reads live job data and run history from disk, and serves a complete page with data embedded — no client-side fetch, no auth.

Port 18790 (bridge port) is already exposed by every OpenClaw container.

2. Dashboard URL

http://localhost:18790/cron.html

The server re-reads job data on every page load, so the dashboard is always up to date.

After Every Cron Job Run

Always show the user the dashboard link after a cron job finishes:

See cron status on OpenCron: http://localhost:18790/cron.html

Rules:

• If the server isn't running, start it: nohup python3 skills/opencron/serve.py --port 18790 &
• This should be the last line of output after every cron job execution

Scripts

Script	What it does
serve.py	Dashboard server — embeds fresh data on every request
update_canvas.py	Fetch HTML from GitHub, embed data, deploy to gateway static dir
update_canvas.py --sync	Re-embed fresh data (used by watch_sync.sh)
watch_sync.sh	Background loop: re-embeds data every 30s
generate.py	Generate standalone HTML file with embedded data

Data Sources

• Jobs: ~/.openclaw/cron/jobs.json
• Runs: ~/.openclaw/cron/runs/<job-id>.jsonl