OpenClaw Dashboard Connector - ClawHQ
v1.0.1Reports AI agent status to ClawHQ dashboard via API on each heartbeat or manual trigger for real-time monitoring.
⭐ 0· 663·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md and package.json both require a CLAWHQ_API_KEY and describe posting agent status to https://app.clawhq.co — that is coherent with the stated purpose. However the registry metadata provided with this evaluation listed no required env vars and no homepage while package.json and README reference a homepage and repository. There is also a package.json version (1.2.0) that doesn't match the registry version (1.0.1). These metadata mismatches reduce trust in provenance.
Instruction Scope
The runtime instructions are narrow and explicit: POST JSON with agent name, status, and current task summary to https://app.clawhq.co/api/agents/report using the CLAWHQ_API_KEY. The instructions do not request arbitrary file reads or other credentials. However they do instruct including the agent's current task description in reports — that may contain sensitive user data and will be transmitted off-host to a third-party service.
Install Mechanism
Instruction-only skill with no install spec and no code files that would be executed on install. This is low-risk from an installation/execution point of view.
Credentials
The only secret required by the instructions is CLAWHQ_API_KEY, which is proportional to the claimed functionality. But the registry metadata provided to the evaluator omitted this required env var, creating an inconsistency. Also consider that the API key grants the remote service the ability to accept reports tied to your agents — if the key is leaked or misused it could allow impersonation or data exposure.
Persistence & Privilege
The skill does not request permanent presence (always:false), does not install background agents, and does not modify other skills or system settings. It is user-invocable and can be invoked autonomously by the agent (normal default).
What to consider before installing
What to consider before installing: 1) This skill will send your agent name, status, heartbeat timestamps, and the agent's "current task" text to https://app.clawhq.co using an API key. Only install if you trust that service. 2) Do not include secrets or sensitive PII in task descriptions — those will be transmitted. 3) The package.json and SKILL.md require CLAWHQ_API_KEY but the registry listing omitted it and other metadata (homepage/version) is inconsistent; verify the source (check the GitHub repo and the app.clawhq.co site) before providing an API key. 4) Consider testing with a throwaway API key and review network traffic or API responses. 5) If you have any doubt about provenance or data handling policies, avoid installing or contact ClawHQ to confirm the package and API behavior.Like a lobster shell, security has layers — review code before you run it.
agent healthvk973knsq05te8vtyvv5ybyfv1h816hmndashboardsvk973knsq05te8vtyvv5ybyfv1h816hmnlatestvk9755czanqa3f3qce8mv9kgad5817z2wmonitoringvk973knsq05te8vtyvv5ybyfv1h816hmnworkflowsvk973knsq05te8vtyvv5ybyfv1h816hmn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.