Security Dashboard

Before installing, review the included files (scripts/install.sh and server.js) yourself or on a test machine. Specific checks: - Inspect /etc/sudoers.d/openclaw-dashboard the installer creates. The rule uses wildcards (e.g., 'journalctl *') — consider narrowing this to only the journalctl invocations needed (for example '-u sshd' or specific time ranges) to avoid exposing unrelated logs. - Prefer running as the dedicated user but give that user a real home or adjust server.js to read the OpenClaw config via a configurable path (do not rely on /nonexistent HOME). If you must run as root, be aware of the higher risk. - Confirm the service runs with the intended hardened systemd flags (NoNewPrivileges, ProtectSystem, ReadWritePaths limited to skill directory). Don’t change these without understanding the consequences. - Audit server.js for any commands that call sudo or parse files (fs.readFileSync and many execSync calls). Ensure they only access the data you want monitored and do not transmit data externally (there are no outgoing network calls in the code provided, but review future updates). - Consider running the dashboard in an isolated environment (container or VM) first to validate behavior and to avoid exposing sensitive host logs or files. - If you accept the install, restrict the sudoers entries to the minimal commands and arguments required and verify file ownership/permissions for the OpenClaw config the dashboard needs to read. If you want, I can produce a tightened sudoers snippet and a checklist of the least-privileged commands the dashboard needs, or point out exact lines in server.js that would need modification to make the service run under a non-login dedicated user.