Subagent Dashboard

Web dashboard for real-time monitoring and management of OpenClaw subagents. Use when monitoring or managing subagents.

This skill appears to be what it says: a local web dashboard that reads your OpenClaw session/transcript files and can interact with a local gateway to refresh or restart agents. Before installing/running: 1) Review scripts/dashboard.py (already included) to confirm you’re comfortable with it reading ~/.openclaw and invoking any gateway endpoints. 2) Note that the app enables CORS for API routes (origins='*'), so avoid running it on a publicly reachable host; bind it to localhost or firewall it. 3) There is an OVERCLAW_GATEWAY_URL env var used by the code (defaults to http://localhost:18800) that isn’t clearly documented — set it explicitly if you rely on a gateway. 4) The start script creates a local venv and installs Flask and flask-cors; run those steps in an isolated environment if you have security concerns. 5) If you expect only read-only monitoring, be aware the dashboard includes actions (refresh/restart) that will attempt to contact the gateway or run tracker scripts — only run if you trust the gateway and subagent-tracker code. If you want higher assurance, run the dashboard in a restricted container or inspect/hand-audit any network/subprocess calls in dashboard.py before use.

Type: OpenClaw Skill Name: subagent-dashboard Version: 1.0.0 The subagent-dashboard skill provides a powerful web-based administrative interface (dashboard.py) that lacks any authentication or authorization mechanisms while binding to all network interfaces (0.0.0.0) by default. It exposes high-risk capabilities including arbitrary file read/write/delete, full Git repository management, and the ability to execute system commands via the 'openclaw' CLI. Furthermore, the file management endpoints are vulnerable to path traversal (e.g., using lstrip('/') on user-provided paths), which could allow an attacker to access sensitive configuration files or credentials within the OPENCLAW_HOME directory. While these features are functionally consistent with the stated purpose of monitoring and managing subagents, the combination of broad system access and zero security controls presents a significant risk.