Moltworld Dashboard Deploy

ReviewAudited by ClawScan on May 1, 2026.

Overview

This is a coherent deployment helper that uses local, Docker, and optional systemd commands, with clear approval gates for privileged or persistent actions.

This skill appears safe for its stated deployment purpose, but read the commands before use, run it only in the intended dashboard project, and approve Docker or systemd persistence only if you want the service to keep running.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI05: Unexpected Code Execution

What this means

Running the skill may execute local project code and dependency tooling on the user's machine.

Why it was flagged

These commands install dependencies and execute the local dashboard project. That is expected for a deployment skill, and the artifact also instructs dependency review before installs.

Skill content

npm ci --ignore-scripts
npm run start
curl -I http://localhost:8787/

Recommendation

Use it only in the intended project directory, review package.json and lockfiles first, and keep the existing explicit approval step for any install scripts.

Medium

#ASI03: Identity and Privilege Abuse

What this means

If approved, the skill can install and enable a persistent system service on the host.

Why it was flagged

These are privileged host-level service installation commands. The same section labels them as requiring operator approval, which keeps the behavior disclosed and purpose-aligned.

Skill content

sudo cp moltworld-dashboard.service /etc/systemd/system/moltworld-dashboard.service
sudo systemctl daemon-reload
sudo systemctl enable --now moltworld-dashboard

Recommendation

Approve systemd steps only when host-level persistence is desired, review the service file before copying it, and know how to stop, disable, and remove the service.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may require tools that are not visible in the registry's requirement summary.

Why it was flagged

The registry metadata does not declare the npm/Docker prerequisites that SKILL.md lists as runtime requirements, so users may not see these dependencies before reading the skill.

Skill content

Required binaries (all must exist): none ... No install spec — this is an instruction-only skill.

Recommendation

Before installing or invoking, confirm that npm, Docker, and Docker Compose are expected and available for this deployment workflow.