Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Dashboard Manager2
v1.0.0Gère en temps réel la lecture, mise à jour et synchronisation du fichier data.json du dashboard Jarvis, incluant notes, tâches, logs et statistiques.
⭐ 0· 626·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
SKILL.md and skill.json state the skill reads/writes D:\Projets\ClaudBot\Jarvis_Dashboard\data.json and requires file permissions, but index.js does not read or write that file—instead it issues HTTP calls to a local server at http://localhost:8009. Declared node dependencies ('fs' and 'path' with odd versions) are unnecessary for the provided code. The requested permissions and capabilities (file access, system writes) are disproportionate to what the code actually does.
Instruction Scope
The runtime instructions describe a background loop, auto-sync heartbeat every 2s, and direct file manipulation of data.json; the implementation exports only a set of API wrapper functions and contains no loop, no file I/O, and no heartbeat logic. SKILL.md therefore instructs operators to grant file permissions and to verify a specific local path that the code itself never touches—this mismatch expands the skill's effective scope if users follow the doc.
Install Mechanism
No install spec is provided (instruction-only with a code file). That minimizes disk-write risk from an installer; the only files are the skill bundle itself. No external downloads or extract steps are present.
Credentials
The skill requests file read/write permission to a specific Windows path in skill.json and SKILL.md but the code performs network calls to localhost instead and doesn't use environment variables or credentials. This asks for elevated local file access without code justification. The declared dependencies ('fs','path') and their placeholder versions are odd but not directly harmful—still they appear unnecessary.
Persistence & Privilege
The skill is not always-enabled and does not request system-wide or other-skills configuration changes. It exports functions for on-demand use; nothing in the bundle shows it self-enabling or persisting beyond normal skill files.
What to consider before installing
Do not install immediately — ask the author to explain the mismatches before granting permissions. Specifically:
- Confirm whether the skill is supposed to access data.json directly or proxy everything through a local HTTP service. The code suggests the latter; SKILL.md and skill.json suggest the former.
- If the skill truly needs file access, require a clear justification and consider limiting the allowed path (or providing a copy of the file) rather than granting write access to your real dashboard file.
- Verify the local HTTP server the skill talks to (http://localhost:8009): inspect its code, endpoints, and whether it could exfiltrate data or perform unexpected actions.
- Ask the developer to remove unnecessary file permissions and unused dependencies, or update the code and documentation so they match (either implement file I/O as documented or remove file-related claims).
- If you lack the ability to audit the local server, run the skill in an isolated environment (VM/container) and monitor network and file activity before enabling it in production.
These inconsistencies look like sloppy packaging or version drift rather than obviously malicious behavior, but they create risk because you might grant privileges that the code doesn't need or that could be abused by a separate local service the skill depends on.Like a lobster shell, security has layers — review code before you run it.
latestvk9711ydj6yt9c21xnntxs5tb6n811qn8
License
MIT-0
Free to use, modify, and redistribute. No attribution required.