Canvas

What to consider before installing/using this skill: - Missing install/dependency information: The SKILL.md references Node components (chokidar, WebSocket injection) and CLI tools (openclaw, tailscale, jq, curl, lsof) but does not declare or provide installation steps. Ask the author for a clear install spec and list of required binaries and packages. - Remote code execution risk: The 'eval' action runs arbitrary JavaScript inside connected devices' WebViews. Only use this on fully trusted nodes and personnel. Confirm whether there are any access controls, auth, or allowlists for eval and remote actions. - Network exposure: Binding to LAN or Tailscale exposes the HTTP server to other hosts. Prefer 'loopback' during development, and secure production hosts (firewalls, TLS, authentication) if you must use lan/tailnet. - Live-reload and file watching: The host watches a local directory and injects a WebSocket client into HTML. Ensure only trusted HTML/JS files are placed in the canvas root to avoid serving/executing untrusted code on nodes. - Configuration review: Before enabling, inspect ~/.openclaw/openclaw.json and file/directory permissions. If you must run any server binaries, review their source and installation artifacts. - When in doubt: request from the skill author (or registry owner) a) an install spec, b) a list of runtime dependencies and versions, c) documentation of security controls around eval/navigation, and d) whether the canvas host supports auth/TLS or an allowlist for node connections.