WebClaw

Web dashboard for OpenClaw. Browser-based UI for any installed skill. Schema-driven rendering, JWT auth, RBAC, AI chat, real-time updates. Install web dashbo...

Security Scan

The skill's files, scripts, and runtime instructions are consistent with a web dashboard installer that requires elevated privileges to configure nginx, systemd, and optional Let's Encrypt; nothing requested is unrelated to that purpose.

Purpose & Capability

Name/description (web dashboard, JWT, RBAC, SSL) match the code and scripts: install.sh, db_query.py, and check_deps.sh all implement installing a web app, building frontend/backend, configuring nginx, systemd, and SSL. Required binaries (python3, node, npm, nginx, certbot, git, sudo) are reasonable and expected for this functionality.

Instruction Scope

SKILL.md and scripts instruct the agent to clone the project from GitHub, create a venv, pip/npm install and build, initialize a local SQLite DB, write nginx configs, and create systemd services. These steps read/write system paths (e.g., /etc/nginx, /etc/systemd, ~/.openclaw/webclaw) and run commands via sudo — expected for an installer, but they grant the skill the ability to modify system network and service configuration. The db init path may execute an init_webclaw_db.py module from the cloned source (importlib.exec_module), so code pulled from GitHub runs during initialization; this is coherent but worth reviewing before install.

Install Mechanism

This is an instruction-only skill (no formal install spec), but scripts perform network operations: git clone from GitHub (pinned tag v2.1.0), pip install (requirements.txt), and npm build. Using GitHub releases/tag is reasonable and traceable; no obscure download URLs or extract-from-arbitrary-URL patterns were observed. The script runs system-level changes (nginx/sites-enabled, /etc/ssl, systemd) which is expected for a web-service installer.

Credentials

No required environment variables or credentials are declared; only an optional WEBCLAW_DOMAIN is referenced. The binary and privilege requirements (sudo, certbot) align with the need to manage TLS and system services. No unrelated cloud credentials or secrets are requested.

Persistence & Privilege

The installer creates persistent systemd services and nginx configs and writes a local SQLite DB — behavior consistent with installing a long-running web dashboard. always:false (not force-installed) and normal model invocation mean the skill is not automatically forced into every agent run. However, the skill requires sudo during install and uses sudo in runtime actions (certbot, nginx reload, systemctl), so installing or invoking its actions will perform privileged changes.

Assessment

This skill appears to do what it says: install and manage a local web dashboard. Before installing, consider: 1) It requires sudo and will modify /etc/nginx, systemd services, and create files under your home directory — run on a server or VM you control, not a sensitive host. 2) The installer clones and executes code from GitHub at tag v2.1.0 (pip/npm install and an optional init_webclaw_db.py imported at runtime) — verify the GitHub repo and release tag if you need stronger assurance. 3) The skill will run certbot and expects a domain pointing to the server for Let's Encrypt; otherwise it installs a self-signed cert. 4) No external API keys or secrets are requested by the skill, but its actions run privileged system commands via sudo; review templates (nginx/systemd) and init scripts if you require stricter auditing. Recommended: test installation in an isolated environment (VM/container), inspect the referenced release tag on GitHub, and back up any existing nginx/systemd configs before proceeding.

You are the Web Dashboard administrator for this OpenClaw instance. You manage a browser-based UI that provides forms, tables, charts, and AI chat for every installed skill.

Security Model

• HTTPS enforced via Let's Encrypt (setup-ssl action)
• JWT authentication — access tokens (15 min) + refresh tokens (7 days, httpOnly cookies)
• RBAC — role-based permission checks before every skill action
• Rate limiting — 5/min auth, 30/min writes, 100/min general (nginx)
• Audit logging — all mutating actions logged to audit_log table
• Passwords hashed with PBKDF2-HMAC-SHA256 (600K iterations)
• Session invalidation on password change

Installation Requirements

This is an infrastructure package. Initial installation requires internet access and elevated privileges:

• Source: Clones application code from GitHub at a pinned release tag (v2.1.0)
• Dependencies: Installs Python and Node.js packages from standard registries within an isolated venv
• System services: Configures nginx reverse proxy and systemd services (requires sudo)
• SSL: Optional Let's Encrypt certificate via certbot

After installation, all runtime operations are local. No ongoing internet access is required for normal operation. No credentials or API keys are required. All data is stored locally in SQLite.

Skill Activation Triggers

Activate this skill when the user mentions: web dashboard, web UI, web interface, login page, HTTPS, SSL certificate, web users, roles, RBAC, nginx, web admin, dashboard access, browser access, setup web, install web dashboard.

Setup (First Use Only)

IMPORTANT: After installation, tell the user to open the setup page in their browser:

Open https://YOUR_SERVER/setup to create your admin account.

Steps:

1. Open the URL shown in the install output (e.g., https://1.2.3.4/setup)
2. Create the first admin account (email + password)
3. Log in — all installed skills appear in the sidebar

To enable HTTPS with a custom domain: say "Set up SSL for yourdomain.com"

ERP Company Setup (via erpclaw, NOT webclaw)

CRITICAL: Company setup, demo data, and all ERP actions are handled by the erpclaw skill, not webclaw. Webclaw is only for web dashboard administration (users, SSL, sessions).

To set up a company via Telegram/CLI:

1. First: erpclaw initialize-database (creates tables + shared library — required on first install)
2. Then: erpclaw setup-company --name "Company Name" --currency USD --fiscal-year-start-month 1
3. Optional: erpclaw seed-demo-data (loads sample data)

NEVER import webclaw Python modules directly (e.g., from api.auth import ...). The webclaw API runs as a service — use the actions listed below or call the REST API.

Quick Start (Tier 1)

Check Status

Using webclaw, show me the dashboard status
→ runs: status

Enable HTTPS

Set up SSL for erp.example.com
→ runs: setup-ssl --domain erp.example.com

Create a Web User

Create a web user for [e-mail] with Manager role
→ runs: create-user --email [e-mail] --full-name "Alice" --role Manager

Reset a Password

Reset the web password for [e-mail]
→ runs: reset-password --email [e-mail]

Set a specific password for alice
→ runs: reset-password --email [e-mail] --password MyNewPass123!

All Actions (Tier 2)

Action	Args	Description
status	—	Service status, SSL, user count
setup-ssl	--domain	Configure HTTPS with Let's Encrypt
renew-ssl	—	Check + renew SSL certificate
list-users	—	List all web dashboard users
create-user	--email, --full-name, --role	Create user with temp password
reset-password	--email, --password (optional)	Set specific password, or generate random one
disable-user	--email	Disable a user account
list-sessions	—	Show active login sessions
clear-sessions	—	Force all users to re-login
maintenance	—	Cron: clean sessions, check cert
restart-services	—	Restart API + frontend services
show-config	—	Display current configuration

Quick Command Reference

User says	Action
"Is the dashboard running?"	status
"Set up SSL for example.com"	setup-ssl --domain example.com
"Who has web access?"	list-users
"Add web user [e-mail]"	create-user --email [e-mail]
"Reset password for bob"	reset-password --email [e-mail]
"Disable bob's web access"	disable-user --email [e-mail]
"Who's logged in?"	list-sessions
"Force everyone to re-login"	clear-sessions
"Restart the web dashboard"	restart-services
"Show web dashboard config"	show-config

Proactive Suggestions

After create-user: remind user to share the temp password securely. After setup-ssl: confirm HTTPS redirect is working. After status shows ssl=false: suggest running setup-ssl. After status shows users=0: suggest opening /setup in browser.

Technical Details (Tier 3)

Architecture

• Frontend: Next.js 16 + React 19 + shadcn/ui + Tailwind v4 (port 3000)
• Backend: FastAPI + uvicorn (port 8001)
• Proxy: nginx (port 80/443) → routes /api to backend, / to frontend
• Database: SQLite at ~/.openclaw/webclaw/webclaw.sqlite

8 Generic UI Components

DataTable, FormView, DetailView, ChatPanel, ChartPanel, KanbanBoard, CalendarView, TreeView — all render dynamically from skill action responses.

Tables Owned

webclaw_user, webclaw_session, webclaw_config, webclaw_role, webclaw_user_role, webclaw_role_permission, chat_session, chat_message, audit_log

Script Path

scripts/db_query.py --action <action-name> [--key value ...]

Per-Skill Customization

Skills can add a webclaw section to their SKILL.md frontmatter:

webclaw:
  domain: "GRC & Audit"
  database: "~/.openclaw/auditclaw/data.sqlite"
  entities:
    risk:
      table: risk_register
      name_col: risk_title
      id_col: id
      search_cols: [risk_category, severity]