OpenClaw Admin Main

Provides a web interface to monitor OpenClaw nodes, manage agent configurations, oversee resource usage, security policies, and review system logs.

This package appears to implement what it claims (a web admin UI plus a Node.js backend), but the registry metadata and SKILL.md do not fully describe how to install, run, or supply credentials. Before installing or running: 1) Treat the source as untrusted until you verify origin—the Homepage is missing and owner is unknown. 2) Inspect server/index.js and server/gateway.js to confirm there are no hardcoded remote endpoints or telemetry/exfil behavior. 3) Do not provide production OpenClaw tokens or passwords until you run it in an isolated test VM or container. 4) Expect to run: npm install, npm run build, and npm run start (or node --env-file=.env server/index.js) and to supply env vars (OPENCLAW_WS_URL, OPENCLAW_AUTH_TOKEN or OPENCLAW_AUTH_PASSWORD, PORT). 5) Restrict network access (firewall, bind to localhost) and review .env.example to understand which secrets the app will read. 6) Consider running npm audit, verifying dependency integrity, and running the server in a sandbox/container with limited filesystem and network privileges. If you want, share server/index.js and server/gateway.js contents and I can point out specific lines to review for sensitive operations or hidden endpoints.

Type: OpenClaw Skill Name: openclaw-admin-main Version: 0.2.8 The bundle provides a legitimate administrative dashboard for OpenClaw, offering features such as remote terminal access via 'node-pty', file system management, and system monitoring. High-risk capabilities, including the ability to execute shell commands for NPM updates and spawning VNC sessions for remote desktop access (found in 'server/index.js'), are clearly aligned with the tool's stated purpose as an administrative interface. While some endpoints exhibit potential vulnerabilities like weak input sanitization in the media and update handlers, there is no evidence of intentional malice, obfuscation, or unauthorized data exfiltration. The inclusion of 'ssh2' and 'better-sqlite3' supports the documented management and logging features.