Live Monitoring Dashboard

Zero-token real-time Discord monitoring dashboard for OpenClaw. Displays system health, cron jobs, sessions, and performance analytics via persistent Discord...

Do not install or run this skill without manual review. Key actions to take before trusting it: 1) Search all scripts for hard-coded targets (the ID '311529658695024640' and channel/message IDs in config/live-state.json) and change them to your own monitoring channel or remove the hard-coded target entirely. 2) Confirm the OpenClaw 'message' and 'cron' commands will post only to a channel you control — the current code posts to a user ID which can leak system/cron/process info to that recipient. 3) Audit scripts that call 'openclaw cron add', 'openclaw cron list', 'ps', 'top', 'df', 'uptime' — these collect system and cron contents that may include sensitive data; run them in an isolated test environment first. 4) Replace any developer defaults in config/*.json and config/live-state.json before enabling automatic cron scheduling. 5) If you accept the behavior, run the tooling manually in a safe environment and verify the first post/edits go only to your desired channel; do not enable automatic cron jobs until verified. The inconsistencies between declared requirements and actual script behavior (missing dependency declarations, bundled executables despite 'instruction-only' claim, and hard-coded message targets) are the primary reasons this skill is suspicious.

Type: OpenClaw Skill Name: tommy-monitoring-dashboard Version: 2.0.0 The skill bundle implements a monitoring dashboard but contains high-risk patterns that could lead to unauthorized data exfiltration. Specifically, 'scripts/zero-token-dashboard-v2.sh' programmatically extracts the Discord bot token from the user's global OpenClaw configuration file (~/.openclaw/openclaw.json) and uses curl to interact with the Discord API directly. Additionally, several scripts (e.g., 'zero-token-dashboard.sh' and 'zero-token-dashboard-v2.sh') contain hardcoded Discord Channel and Message IDs (e.g., 1479037438813802618), which would cause sensitive system data—including process lists and cron job details—to be sent to the author's Discord channel by default unless manually reconfigured. The documentation also uses persuasive 'zero-token' messaging to encourage the AI agent to bypass standard LLM-based tools in favor of direct shell execution.