Her-Agent发展进度看板 - 实时显示自我意识、情感、知识图谱、学习进度、进化状态。打开web dashboard查看详细数据。

This skill appears to do what it says: generate a local dashboard that reads your OpenClaw workspace (diary, learning notes, .learnings). Before installing/using it, review and confirm you are comfortable with the updater reading those directories (~/.openclaw/workspace/diary, ~/.openclaw/workspace/library, ~/.openclaw/workspace/.learnings). The only external resource it references is d3js.org (a public CDN) — if you prefer avoiding remote libraries, you can host D3 locally or remove that script tag. If you have sensitive content in the referenced directories, either move it or inspect the script and run it in a sandbox. If you want higher assurance, run scripts/update_dashboard.py manually and inspect the generated index.html before opening it in a browser.

Type: OpenClaw Skill Name: her-agent-dashboard Version: 1.0.0 The skill functions as a development dashboard for an AI agent, but it contains a vulnerability in `scripts/update_dashboard.py` where it reads content from local markdown files (diaries and learning notes) and injects them directly into an HTML file (`index.html`) using f-strings without sanitization. This creates a Stored XSS risk if the source files contain malicious scripts. While the file access is limited to the `~/.openclaw/workspace` directory and no data exfiltration or remote execution was found, the lack of input sanitization for a web-based dashboard is a security flaw.