Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
OpenClaw Studio
v1.0.1Use when the user wants a local visual operations dashboard for OpenClaw, with a cute robot presentation, live status visibility, chat access, efficiency tre...
⭐ 0· 182·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name, README, SKILL.md, and launch scripts all describe a local-first dashboard with optional auto-heal and macOS launchd integration — this is coherent with the stated purpose. However, the package claims core runtime files like server.py, autoheal.py, and app_watchdog.py in SKILL.md and the plist scripts, but those Python files are not present in the file manifest. Also the manifest/offered OS restrictions do not reflect the clearly macOS-specific install scripts (launchd). These gaps reduce confidence.
Instruction Scope
The runtime instructions and provided scripts instruct the agent/user to install persistent launchd services and to run start/stop scripts that will execute Python server components. That is in-scope for a dashboard, but the instructions rely on runtime files that are missing from the bundle. The instructions also modify user LaunchAgents (install_launchd.sh), which changes per-user startup behavior — this is significant and should be accepted explicitly by the user only after inspecting the missing Python components.
Install Mechanism
There is no automated install spec (low risk from remote fetches). All install behavior is provided as local shell scripts which create plist files under $HOME/Library/LaunchAgents and call launchctl. No external downloads or obfuscated installers are used. That reduces supply-chain risk, but the scripts do write persistent system-level entries to the user's LaunchAgents directory.
Credentials
The skill does not declare any required environment variables or external credentials. The config.example.json includes a session_key and references to an OpenClaw home (~/.openclaw), which could be sensitive if populated with real session tokens — but these are local config examples, not required env vars. Overall requested secrets appear proportionate, but reviewers should treat any real session_key or local OpenClaw files as sensitive prior to installing.
Persistence & Privilege
install_launchd.sh creates three LaunchAgents (monitor, autoheal, watchdog) that are bootstrapped, enabled, and kickstarted and set to KeepAlive. That gives the package persistent per-user background processes. Persistent watchdog/auto-heal services are plausible for a monitoring tool, but this level of persistence and automatic startup is a meaningful privilege and should be accepted only after code review (particularly of the missing Python components referenced).
What to consider before installing
Before installing or running these scripts: (1) Do not run install_launchd.sh until you have inspected the runtime Python files (server.py, autoheal.py, app_watchdog.py). They are referenced by the launchd plists but are missing from the provided bundle — installing services that point to missing or unknown executables is risky. (2) If you find those Python files elsewhere, review them for network activity, credential handling, and what the auto-heal/watchdog actually do (restarts, external calls, file writes). (3) Expect the install scripts to create persistent per-user LaunchAgents that auto-start processes and write logs under the repo directory — only proceed if you trust the code. (4) The package appears macOS-specific; don’t attempt the launchd install on other OSes. (5) If you want to try the dashboard without persistence, run ./run_monitor.sh in a terminal first and confirm server.py behaviour and any network connections, then consider background/launchd install. If you cannot review the missing Python files, treat this package as untrusted.Like a lobster shell, security has layers — review code before you run it.
dashboardvk975tybnzzdpeb8yvepkfjvd5x82trn5latestvk975tybnzzdpeb8yvepkfjvd5x82trn5monitoringvk975tybnzzdpeb8yvepkfjvd5x82trn5openclawvk975tybnzzdpeb8yvepkfjvd5x82trn5roboticsvk975tybnzzdpeb8yvepkfjvd5x82trn5studiovk975tybnzzdpeb8yvepkfjvd5x82trn5
License
MIT-0
Free to use, modify, and redistribute. No attribution required.