Openclaw Pixel Agents Dashboard

Real-time pixel art ops dashboard for OpenClaw deployments. Visualizes agent activity as character sprites in a shared office with live activity bubbles, har...

This package is internally consistent with its stated purpose, but review a few things before running it: 1) Inspect skill/scripts/setup.sh (it auto-discovers agents and writes config) so you know what filesystem paths it will access and what it will write. 2) Use environment variables or SSH key auth for gateway and remote access rather than putting passwords in dashboard.config.json. 3) The dashboard tails local JSONL session files (by default under ~/.openclaw/agents) — run it only on systems where you expect that data to be available and safe to display. 4) The 'ham radio' update-checker will contact update endpoints — if you need strict network controls, run the server in an isolated environment or block outbound requests. 5) As with any npm bundle, consider running in a dedicated user account or container the first time you try it, and audit network traffic if you have concerns about exterior communication.

Type: OpenClaw Skill Name: openclaw-pixel-agents-dashboard Version: 1.0.0 The skill bundle provides a legitimate-looking pixel art dashboard for OpenClaw, but it contains several high-risk implementation patterns that create a significant attack surface. Specifically, 'server/services.ts' and 'server/hardware.ts' use 'execSync' to execute shell commands (including 'systemctl' and 'ssh') constructed directly from unsanitized configuration values, which is a classic shell injection vulnerability. Furthermore, 'server/version.ts' includes functionality to perform global system modifications via 'npm update -g'. While these capabilities are aligned with the stated purpose of service management and hardware monitoring, the lack of input validation and the use of 'sshpass' for credential handling make the bundle highly risky for deployment in environments where the configuration file might be influenced by untrusted data.