One-Click Task Dashboard

一键生成并常驻刷新任务数据大屏（index.html + data.json + 本地服务）。适合 OpenClaw + launchctl 自动化任务可视化与巡检。

This skill will create persistent launchd jobs (one to refresh the dashboard and one to run a local web server) and may read many files under your home directory to populate the dashboard. Before running it: 1) Inspect scripts in scripts/*.sh and build_dashboard.py yourself (notably build_dashboard.py contains hardcoded paths like /Users/dong/..., which may read unexpected files). 2) If you only want the dashboard, avoid running publish_to_clawhub.sh and do not run setup_publisher_retry.sh (those will call npx clawhub and may use your ClawHub auth to publish). 3) Consider running setup_dashboard.sh in a disposable account or VM first to see what data is collected and served. 4) If you proceed, check ~/Library/LaunchAgents for the created .plist files and remove/unload them with launchctl bootstrap/bootout if you want to uninstall. 5) If you have ClawHub credentials, do not run the publish/retry scripts unless you intend to publish — they will attempt automated publishing and retries using your CLI auth.

Type: OpenClaw Skill Name: one-click-task-dashboard Version: 1.0.0 The skill is classified as suspicious due to its use of powerful system capabilities and a notable vulnerability. It installs multiple LaunchAgents (`ai.x.task-dashboard-refresh`, `ai.x.task-dashboard-http`, `ai.x.publish-one-click-dashboard`) for persistence and scheduled execution (in `scripts/setup_dashboard.sh` and `scripts/setup_publisher_retry.sh`), which, while serving the stated purpose, is a high-risk capability often abused by malware. Furthermore, `scripts/build_dashboard.py` contains hardcoded user-specific paths (`/Users/dong/.openclaw/...`) for reading log files, posing a portability vulnerability and a privacy concern. The publishing scripts also rely on the external `rg` utility, which is a minor robustness flaw.