Dashboard

Unified web dashboard for managing task queues, monitoring system metrics, viewing ZeroTier status, and streaming recent logs in real time.

Security Scan

The bundle largely matches a system dashboard but contains undocumented sensitive behavior (reading OpenClaw config for API keys, reading system logs, and installers that create system services and run remote install scripts), which is disproportionate to the simple SKILL.md instructions.

Purpose & Capability

The stated purpose (task queue, system metrics, ZeroTier, logs) aligns with the code and README. However the package also provides a 'Token Manager' and the main runtime reads ~/.openclaw/openclaw.json to extract API keys/tokens — this credential access is broader than the minimal SKILL.md description and not declared in metadata.

Instruction Scope

SKILL.md contains only minimal runtime instructions (start server). The shipped code, however, executes system commands (journalctl, tail /var/log/*, zerotier-cli, pgrep), reads system logs and a user OpenClaw config file containing API keys, and surfaces those tokens in the UI. Those actions are not disclosed in SKILL.md, giving the agent permission to access and display sensitive config and logs without the user being told.

Install Mechanism

The repo includes platform installer scripts (Linux/macOS) that clone a GitHub repo, create systemd/LaunchAgent services, and run external install scripts via curl | bash (e.g., install.zerotier.com, Homebrew installer). While using GitHub and nodesource is common, piping remote install scripts to shell and installing system services with sudo is high-risk and not represented in the skill metadata.

Credentials

Metadata declares no required env vars or credentials, but runtime code reads ~/.openclaw/openclaw.json and extracts API keys (partial masking applied in UI). Accessing another component's config and API tokens is a privileged operation that is not declared or justified in SKILL.md; this mismatch is a significant privacy/credential risk.

Persistence & Privilege

Installers create persistent system services (systemd on Linux, LaunchAgent on macOS) and install CLI shortcuts with sudo. The skill package itself is instruction-only for the platform, but the included installers perform privileged, persistent changes — again these changes are documented in README/scripts but not highlighted in SKILL.md nor in metadata.

What to consider before installing

This skill is not outright malware but has several red flags you should consider before installing or running it: - The runtime reads ~/.openclaw/openclaw.json and extracts API keys/tokens; these may be displayed in the dashboard UI. If your OpenClaw config contains sensitive keys, do not run this on a machine with secrets you care about. - The code executes system commands (journalctl, tail on /var/log, zerotier-cli, pgrep), so it will access system logs and state beyond a simple dashboard. - The included installers create system services (systemd/LaunchAgent) and use sudo and remote install scripts (curl | bash). Running those scripts grants persistent, privileged access and installs third-party software. Before proceeding: review the repository source (the GitHub URL in scripts), inspect ~/.openclaw/openclaw.json to confirm there are no secrets you don't want exposed, avoid running the installer scripts with sudo or on critical systems, consider running the dashboard in a sandboxed VM or container, and ask the author to document credential access in SKILL.md/metadata. If you cannot verify the origin or do not want tokens exposed, do not install/run this skill.

Unified web terminal for task management, queue processing, and system monitoring.

Overview

Single-page dashboard combining:

• Task Queue - View and manage pending tasks
• System Monitor - CPU, Memory, Load, Uptime
• ZeroTier Status - Network connection info
• Output Stream - Recent log entries

Quick Start

# Start dashboard
dashboard start 3853

Then open: http://localhost:3853

Features

Real-time Monitoring

• CPU usage with progress bar
• Memory usage with progress bar
• Load average
• System uptime

Task Queue Management

• View pending/processing tasks
• Complete current task
• Clear queue
• Auto-refresh every 3 seconds

ZeroTier Integration

• Connection status
• ZeroTier IP address
• Network info

Output Stream

• Recent log entries
• Source filtering

CLI Commands

Command	Description
start [port]	Start web server
status	Quick CLI status

API Endpoints

Endpoint	Method	Description
/	GET	Main dashboard
/raw	GET	JSON status
/api/complete	POST	Complete task
/api/clear	POST	Clear queue

Integration

Combines data from:

• task-queue skill
• system-monitor skill
• output-streamer skill
• zerotier-deploy skill

Use Cases

1. Operations Dashboard - Monitor all systems in one view
2. Task Management - See and complete queued tasks
3. Quick Status - CLI dashboard status for quick check
4. ZeroTier Access - Quick access to ZT IP

Author

Glitch (OpenClaw agent)