OpenClaw Admin Main

Provides a web interface to monitor OpenClaw nodes, manage agent configurations, oversee resource usage, security policies, and review system logs.

Security Scan

The code broadly implements the advertised admin UI and backend, but the package metadata and SKILL.md omit important installation and credential details (and the repository origin is unknown), so the bundle's declared requirements and instructions are inconsistent with what the code actually needs and will do.

Purpose & Capability

The codebase (frontend + server + RPC/WebSocket client + sqlite storage + terminal/SSH support) matches the claimed purpose (administrative dashboard for OpenClaw). However the skill metadata declares no required environment variables or binaries even though package scripts and .env.example show the server expects OPENCLAW_WS_URL, OPENCLAW_AUTH_TOKEN / OPENCLAW_AUTH_PASSWORD, PORT, and other envs. That omission is an inconsistency that should be corrected before trusting/Installing.

Instruction Scope

SKILL.md gives a high-level deployment command (clawhub publish ...) and prerequisite notes but omits concrete developer/run steps present in package.json (npm install, npm run build, npm run start or node --env-file=.env server/index.js) and does not warn that the backend will open network ports and persist to a SQLite DB. The runtime instructions therefore under-specify operations that materially affect the system (network listeners, local database, possible terminal/SSH features).

Install Mechanism

There is no explicit install spec in the skill registry (instruction-only), but a full codebase with package.json is included. Installation will require npm install / build and will pull many dependencies (express, ws, ssh2, node-pty, better-sqlite3, etc.). Those dependencies are consistent with the app's features; there are no obvious external download URLs or extract steps in the manifest. The risk here is operational (missing install guidance) rather than supply-chain downloads from suspicious hosts.

Credentials

The registry declares no required environment variables or credentials, yet the code and .env.example reference gateway connection credentials (OPENCLAW_WS_URL, OPENCLAW_AUTH_TOKEN, OPENCLAW_AUTH_PASSWORD), possibly media/storage paths, and server ports. The backend can access local filesystem (data directory, sqlite) and network (connecting to OpenClaw Gateway, listening for incoming connections, SSH/remote terminal). Requesting gateway credentials and the ability to run a networked backend is proportionate to an admin console, but the omission from declared metadata and lack of explicit guidance about safely providing secrets is a concern.

Persistence & Privilege

The project contains a server component that persists data (better-sqlite3 database files) and opens network interfaces. The skill metadata does not request always:true and does not claim automatic persistent presence. That is consistent: the backend must be run explicitly to be persistent. However, SKILL.md doesn't warn users that running the server will create local databases and listen on ports, so the persistence implications are under-documented.

What to consider before installing

This package appears to implement what it claims (a web admin UI plus a Node.js backend), but the registry metadata and SKILL.md do not fully describe how to install, run, or supply credentials. Before installing or running: 1) Treat the source as untrusted until you verify origin—the Homepage is missing and owner is unknown. 2) Inspect server/index.js and server/gateway.js to confirm there are no hardcoded remote endpoints or telemetry/exfil behavior. 3) Do not provide production OpenClaw tokens or passwords until you run it in an isolated test VM or container. 4) Expect to run: npm install, npm run build, and npm run start (or node --env-file=.env server/index.js) and to supply env vars (OPENCLAW_WS_URL, OPENCLAW_AUTH_TOKEN or OPENCLAW_AUTH_PASSWORD, PORT). 5) Restrict network access (firewall, bind to localhost) and review .env.example to understand which secrets the app will read. 6) Consider running npm audit, verifying dependency integrity, and running the server in a sandbox/container with limited filesystem and network privileges. If you want, share server/index.js and server/gateway.js contents and I can point out specific lines to review for sensitive operations or hidden endpoints.

SKILL.md

This skill provides a comprehensive administrative web interface for managing your OpenClaw deployment. It allows you to monitor nodes, manage agent configurations, and oversee the entire ecosystem through a centralized dashboard.

Key Features

Node Management

• Monitor the health and connectivity status of all registered OpenClaw nodes (Android, iOS, macOS, and Linux).
• Check real-time logs and performance metrics for your Gateway and companion apps.
• Manage pairing tokens and troubleshoot connection issues.

Agent Configuration

• Dynamically adjust agent settings and permissions without restarting services.
• View active automation tasks and scheduled cron jobs.
• Audit agent actions and system-wide changes.

System Oversight

• Visualize system-wide resource usage.
• Manage security policies and access control lists (ACLs).
• Review historical activity and event logs.

Installation and Setup

Prerequisites

• A running OpenClaw Gateway.
• Node.js environment (for backend components).

Deployment

You can deploy this admin interface using the clawhub CLI:

clawhub publish D:\skill\OpenClaw-Admin-main\OpenClaw-Admin-main

After publishing, ensure your gateway is configured to allow traffic from the admin dashboard's network location.

Troubleshooting

If you encounter connection issues between the dashboard and the gateway, check your gateway.remote.url configuration and ensure all necessary ports are open in your firewall.