Opencron Skill Repo

Visual cron job dashboard for OpenClaw — live countdown timers, run history, calendar view

What to consider before installing: - Audit the dashboard HTML that will be fetched (cron-dashboard.html). If that template includes external scripts or trackers, they will run with access to the embedded cron data; either vendor a local copy of the template or inspect/strip remote scripts before serving. - The installer uses git to clone the repo but the skill metadata only lists python3 — ensure git is available and be aware the installer will clone a third‑party GitHub repository. - The skill writes to ~/.openclaw/canvas and (if present) /app/dist/control-ui. Confirm you want a third‑party skill to modify your gateway UI directory. - Serving the page is unauthenticated and the bridge port is exposed inside the container. Ensure network access to that port is appropriately restricted so untrusted clients cannot view embedded cron job/run data. - If you decide to install: consider running update_canvas.py once to fetch and inspect the generated cron.html locally (or use generate.py to produce a standalone HTML), and remove or sandbox any external resources (fonts, analytics, remote scripts) in the template. Also consider pinning the template to a specific vetted commit or embedding a vetted copy of the HTML in the skill bundle to avoid unexpected changes from upstream. Confidence notes: assessment is 'suspicious' because behavior is coherent with the described purpose, but the remote-template + embedded sensitive-data pattern and minor metadata/install mismatches increase risk. Additional evidence that would change the assessment: a vetted local copy of cron-dashboard.html bundled in the skill (no remote fetch) and an explicit declaration that the template contains no external scripts would reduce concern and could move this to 'benign.'

Type: OpenClaw Skill Name: opencron Version: 1.2.0 The skill implements a cron dashboard by fetching a remote HTML template from GitHub (raw.githubusercontent.com) and injecting local job data into it, which is then served via an unauthenticated HTTP server on port 18790 (serve.py) or written directly to the gateway's static UI directory (update_canvas.py). This architecture introduces a significant supply chain risk (RCE via remote template) and potential for unauthorized data exposure, as sensitive cron job details and run history are served without authentication. While these behaviors are high-risk, they appear to be functional components of the dashboard rather than intentional malware.