Mission control dashboard for OpenClaw - real-time session monitoring, LLM usage tracking, cost intelligence, and system vitals. View all your AI agents in o...

This package appears to be a legitimate local dashboard for OpenClaw, but take these precautions before installing or exposing it: - Run it locally first and keep it bound to localhost (default host: "localhost") until you've audited it. Check config/dashboard.example.json host/trustProxy settings. - Do not enable token/cloudflare/tailscale modes or change allowed IPs to non-restricted values until you understand the auth flow and have a strong token. If you enable remote access, require authentication and use network isolation (VPN) or a reverse proxy with strict access control. - The dashboard purposely reads your OpenClaw workspace (memory/, state/, logs/) and exposes a unified /api/state and a memory browser. If those files contain sensitive data, review lib/server.js and related code to confirm what is read and served and consider running the dashboard in an isolated VM/container. - Optional integrations (linear, slack, discord) are present in config; do not populate API keys for these services unless you trust the code and want those integrations. Verify where and how any keys are stored. - The repo contains helper scripts (install-system-deps.sh, setup.sh). Do not run them as root blindly — inspect them first; they may call package managers or require sudo for optional system tooling. - Confirm the claimed 'no external calls' by grepping the code for network APIs (http/https/fetch/request, outbound webhook URLs) before assuming zero telemetry. - If you need higher assurance, run the skill in a temporary VM or sandbox, audit lib/server.js and the API routes (public/js and src files) for data exfiltration behavior, and review package.json/package-lock.json for dependencies. If you want, I can (1) list files/functions that read workspace memory/state, (2) search the code for outbound network calls and where integrations are invoked, or (3) summarize what /api/state and /api/events expose from the code.

Type: OpenClaw Skill Name: command-center-1-4-1 Version: 1.0.0 The 'command-center' skill bundle is a comprehensive monitoring dashboard for the OpenClaw ecosystem. Security analysis of the source code (src/) and operational scripts (scripts/) reveals several proactive security measures, including path traversal protection in the static file server (src/index.js), the use of a restricted environment for CLI subprocesses to prevent secret leakage (src/openclaw.js), and an explicit allow-list for administrative actions (src/actions.js). The dashboard supports multiple secure authentication modes (Tailscale, Cloudflare Access, and Token-based) and adheres to a local-first privacy model. No evidence of data exfiltration, malicious persistence, or unauthorized remote execution was detected.