Mission control dashboard for OpenClaw - real-time session monitoring, LLM usage tracking, cost intelligence, and system vitals. View all your AI agents in o...
Security Analysis
medium confidenceThe package implements a local dashboard (server + static frontend) that matches its name/description; it requires Node.js and reads your OpenClaw workspace (memory/state) which is coherent with a monitoring dashboard but has obvious privacy implications you should understand before running it.
The name/description (Command Center, session/LLM/cost/vitals dashboard) aligns with the code and files provided: a Node.js server (lib/server.js), frontend assets, docs, and optional integration adapters. There are no unexpected cloud-provider credentials or unrelated binaries requested.
Runtime instructions simply run node lib/server.js and explain optional env vars (OPENCLAW_WORKSPACE, DASHBOARD_AUTH_MODE, DASHBOARD_TOKEN). The server auto-detects and reads workspace paths (memory/, state/, logs/) and exposes a memory/browser panel — this is expected for the dashboard but means it will read local files that may contain sensitive data (API keys, tokens, private conversation transcripts). The SKILL.md does not claim any external telemetry, but the repo contains optional integration adapters (linear, slack, discord) which, if enabled in config, will contact external services.
Install is low-risk: the skill is shipped as source code and the declared install action runs node lib/server.js. There are install/setup scripts present in the repo (setup.sh, install-system-deps.sh, pre-commit hooks) but none are forced by the SKILL.md install step; no arbitrary URL downloads or third-party package installation during skill install are declared.
The skill does not require any environment variables or credentials by default. It documents optional env vars for workspace override and auth modes (token/tailscale/cloudflare). Integration API keys (linear/slack/discord) appear in config as optional settings — these are proportionate to the stated features and are not required to run.
The skill does not request permanent registry-level privileges (always:false) and the provided install step does not modify system-wide settings. However the repo includes helper scripts and pre-commit hook instructions that, if executed by a user, will modify local git hooks or install system packages — these actions require explicit user invocation and should be reviewed before running.
Guidance
This skill appears to be what it says: a local Node.js dashboard that reads your OpenClaw workspace (memory/state) and serves a UI on localhost. Before installing or running it: 1) Review config/dashboard.json (or create a copy of dashboard.example.json) and verify integrations (linear/slack/discord) and analytics are disabled unless you intend to enable them. 2) Be aware that the dashboard can read memory and state files which may contain API keys or private transcripts — do not expose the server to the public internet unless you configure a secure auth mode (tailscale/cloudflare/token) and an allowlist. 3) Inspect lib/server.js (or search the repo for outbound network calls like fetch/axios/http.request) if you need to verify there is no hidden telemetry. 4) Do not run setup scripts (install-system-deps.sh, setup.sh, or pre-commit installation) without reviewing them; they may change git hooks or install system packages. 5) For maximum safety, run the server on an isolated host or a local-only environment, bind to 127.0.0.1, and restrict PORT/allowed IPs until you are comfortable. If you want a deeper review, provide lib/server.js for targeted inspection of API routes, auth handling, and any external requests.
Latest Release
v1.4.1
- Minor version update with dependency changes and localization improvements. - Updated npm dependencies for improved stability and security. - Enhanced English and Chinese locale files for more complete translations. - Small code adjustments in server.js and vitals.js for consistency. - No changes to user-facing features or API.
More by @jontsai
Published by @jontsai on ClawHub
