DG-LAB

An OpenClaw plugin that controls DG-Lab V3 electrostimulation devices via WebSocket with AI-driven commands and emotion-triggered stimulation.

This plugin appears to do what it claims (control DG-Lab V3 devices over WebSocket, include an emotion engine that maps assistant replies to stimulation), but it can directly cause physical stimulation and requires opening a public port. Before installing: - Do not run the one-click curl|bash installer unless you audit the install script on GitHub first — prefer npm install or cloning the repo and reviewing the code. - Understand you must open/forward TCP port (default 18888) so devices can connect; restrict access (use firewall rules, VPN, or localhost-only with SSH tunnel) to avoid unauthorized binding. - The plugin can be invoked by the model (default platform behavior). If you plan to run agents autonomously, explicitly disable or restrict agent permissions for this plugin, or do not enable emotion mode (/dg_emotion) to avoid automatic triggers. - Set hardware safety limits in the DG-Lab App (the plugin's software limiter is not a safety substitute) and keep initial intensity very low when testing. - Review the repository/install script and the included JS files (server, protocol, pulselib, emotion) yourself or with someone technical to verify no unexpected remote endpoints or behaviors are present (the QR string references https://www.dungeon-lab.com for the app tag — expected for this ecosystem but note it is an external domain). If you are not comfortable auditing code or exposing a public WebSocket for a device that delivers electrical stimulation, do not install or run this plugin on a production/connected machine.

Type: OpenClaw Skill Name: openclaw-plugin-dg-lab Version: 1.0.3 The plugin provides functionality to control DG-Lab V3 e-stim hardware via a WebSocket server, which is a high-risk physical interaction capability. While it includes safety mechanisms like intensity limits and a rest timer, the `/dg_pulse load` command in `dist/index.js` is vulnerable to path traversal, allowing the reading of arbitrary files from the host system (e.g., via `../../` patterns). Additionally, the documentation encourages a high-risk installation method (`curl|bash`), and the 'Emotion Engine' in `dist/emotion.js` allows the AI to automatically trigger physical stimulation based on chat keywords without direct user confirmation for each event.