OpenClaw Deck

Multi-column chat deck UI for OpenClaw agents. Launch a local web interface to manage and chat with multiple agents side-by-side.

Security Scan

The skill is a local web UI (OpenClaw Deck) that runs a Vite dev server and connects to a local OpenClaw Gateway via WebSocket; its code and runtime instructions are coherent with that purpose.

Purpose & Capability

Name/description match the included frontend code and the declared requirements (node, npm). The files implement a browser UI that connects to a Gateway WebSocket. Required binaries (node, npm) and optional env vars (VITE_GATEWAY_URL / VITE_GATEWAY_TOKEN) are appropriate and expected.

Instruction Scope

SKILL.md instructs the agent to run `npm install` (if node_modules missing) and `npm run dev` in the skill directory and to point the user at http://localhost:5173. Those steps are within scope for launching a local frontend. The code references import.meta.env and URL params for gateway URL/token (expected). Be aware the UI will fetch Google Fonts (fonts.googleapis.com) when loaded in the browser and will attempt WebSocket connections to the configured gateway URL (default ws://127.0.0.1:18789).

Install Mechanism

This is an instruction-only install spec but includes package.json and package-lock.json. Running `npm install` will fetch many packages from the npm registry (package-lock is present). This is expected for a modern frontend but carries the usual supply-chain risk (packages may run lifecycle scripts). There is no download-from-arbitrary-URL or extract step in the skill manifest.

Credentials

No credentials are required by the skill. The optional VITE_GATEWAY_URL and VITE_GATEWAY_TOKEN (used to configure the Gateway connection) are proportionate to the purpose. The code does not request unrelated env vars or other service credentials.

Persistence & Privilege

The skill does not request always:true or elevated persistence. It runs a local dev server and does not attempt to modify other skills or system-wide configuration. Autonomous invocation (disable-model-invocation:false) is the platform default and is not combined with other red flags.

Assessment

This skill appears to do exactly what it says: start a local Vite dev server hosting a deck UI that connects to a local OpenClaw Gateway. Before you install/run it, consider: (1) npm install will fetch packages from the public registry — review package-lock.json or run in an isolated environment if you are cautious, since npm packages can include install scripts; (2) the web UI will load Google Fonts (external network call) and will open WebSocket connections to the gateway URL you supply (default ws://127.0.0.1:18789) — do not pass secrets in the browser URL (token in the query string can be exposed in history); (3) verify you actually want a dev server bound to localhost:5173 on your machine; (4) if you need higher assurance, inspect src/lib/store.ts and other omitted files or run npm install in a sandbox/VM. Overall the skill is internally consistent with its description.

Launch the OpenClaw Deck — a multi-column web UI for chatting with OpenClaw agents side-by-side.

What this skill does

When invoked, install dependencies (if needed) and start the Vite dev server for the deck UI. The deck connects to the local OpenClaw Gateway via WebSocket proxy.

Instructions

1. Check if node_modules exists in the skill's base directory. If not, run npm install in {baseDir}.
2. Start the dev server by running npm run dev in {baseDir}.
3. Tell the user the deck is available at http://localhost:5173.
4. Mention available keyboard shortcuts:
   • Tab / Shift+Tab — move focus between agent column inputs
   • Cmd+1–9 — jump to a specific column by number
   • Cmd+K — open the Add Agent modal

Requirements

• The OpenClaw Gateway must be running on ws://127.0.0.1:18789 (default), or the user must set VITE_GATEWAY_URL in .env.
• Node.js and npm must be installed.