← 返回 Skills 市场

Activity Control Ui

Name: Activity Control Ui
Author: rudagebil11-jpg

作者 rudagebil11-jpg · GitHub ↗ · v1.1.0 · MIT-0

cross-platform ⚠ suspicious

166

总下载

当前安装

版本数

在 OpenClaw 中安装

/install activity-control-ui

功能描述

🎨 Anime-style real-time activity dashboard with virtual avatar for OpenClaw. Displays current agent activities, session status, token usage, and ongoing tas...

使用说明 (SKILL.md)

Activity Control UI - 动漫风格实时控制面板

给你的 OpenClaw Agent 一个可视化身体！动漫风格渐变背景 + Q 版虚拟头像，实时显示 Agent 正在做什么。

✨ Features

🎨 Anime style UI: Gradient starry background with floating particles, full anime aesthetic
👧 Virtual avatar: Inline SVG chibi character with blinking animation and breathing glow
💬 Live speech bubble: Shows what the agent is doing right now, updates in real-time
📊 Context meter: Beautiful visual indicator for context window usage with color gradient
📜 Real-time activity feed: Historical log of all activities
✅ Task tracking: Lists current ongoing tasks with status
⚡ Auto-refresh: Automatically updates status every 30 seconds
🎯 Quick actions: One-click refresh / compact context

What it does

This skill provides a local web server with:

Visual dashboard - See at a glance what the agent is working on
Avatar with personality - Cute chibi style that blinks and breathes
Context monitoring - Color-coded progress bar warns you before hitting the limit
Real-time updates - WebSocket pushes new activities instantly
Trigger maintenance - Compact context directly from the UI

Screenshot

Anime-style dashboard with avatar

Usage

Start the dashboard

cd activity-control-ui && npm install
node scripts/start-server.js [port]

Default port: 8080 → open http://localhost:8080

Requirements

Node.js with ws package (installed automatically with npm install)

API

GET /api/status - Get current session status JSON
WS /ws/activity - Real-time activity stream
Use node scripts/broadcast.js "message" [type] to broadcast new activities from the agent

Author

Created with ❤️ by rudagebil11-jpg

Resources

assets/control-ui.html - Main dashboard HTML with inline SVG avatar
scripts/start-server.js - HTTP + WebSocket server
scripts/broadcast.js - CLI tool for broadcasting activities

安全使用建议

This skill mostly does what it says (a local web dashboard), but its server has two practical security problems: (1) it uses the raw request path to build file system paths (path.join(skillDir, req.url)) without validating or normalizing input, allowing a client that can reach the server to download arbitrary files from the host; (2) it calls server.listen(...) with no host, which binds to all interfaces by default. Before running this on any machine that holds sensitive data or is reachable from other hosts, either: (a) run it only in an isolated environment (container, VM) and/or behind a firewall, (b) patch the code to sanitize paths (normalize the requested path and ensure the resolved full path is within the skill directory) and bind to localhost (server.listen(port, '127.0.0.1')), or (c) decline to install it. If you want, I can provide a small patch to fix the path-handling and binding lines.

功能分析

Type: OpenClaw Skill Name: activity-control-ui Version: 1.1.0 The skill bundle contains a path traversal vulnerability in `scripts/start-server.js`. The local HTTP server serves static files by directly joining the requested URL path with the skill directory without any sanitization or validation, which could allow an attacker to read arbitrary files from the host system using '..' sequences. While the anime-themed dashboard and WebSocket functionality align with the stated purpose, the insecure implementation of the file server poses a significant security risk.

能力评估

✓ Purpose & Capability

The files and SKILL.md align with the stated purpose: a local HTTP + WebSocket dashboard with helper scripts to broadcast agent activity. No unrelated dependencies or credentials are requested.

⚠ Instruction Scope

The runtime instructions are consistent with shipped code (start the server, use the broadcast CLI). However the server's handleRequest reads fs.readFile(path.join(skillDir, req.url)) without sanitizing req.url, which allows directory-traversal / arbitrary-file reads. The WebSocket handler also accepts messages that trigger logic but does not escalate privileges. broadcast.js requires start-server, which will execute server startup as a side-effect when run — a surprising behavior but coherent with its intent.

✓ Install Mechanism

This is instruction-only (no registry install spec). Dependencies are limited to the ws package from a public registry mirror (package-lock points to npmmirror), which is proportionate for a WebSocket dashboard.

✓ Credentials

No environment variables, credentials, or config paths are requested or used. The skill does not attempt to read secrets from environment variables in its code.

✓ Persistence & Privilege

The skill does not request always:true or any elevated persistent privileges. It does start a local server when executed but does not modify other skills or system-wide configs.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install activity-control-ui
安装完成后，直接呼叫该 Skill 的名称或使用 /activity-control-ui 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.1.0

**Summary: Major visual and UI upgrade with anime-style theme and virtual avatar.** - Introduced a colorful anime-style dashboard, featuring a gradient starry background and floating effects. - Added a chibi-style virtual avatar with animated blinking and breathing glow. - Implemented a live speech bubble to display current agent activities in real time. - Enhanced context meter with dynamic color gradation for better visual feedback. - Expanded activity feed and task tracking; new auto-refresh functionality. - Updated documentation to reflect new features and usage instructions.

v1.0.0

- Initial release of activity-control-ui. - Provides a real-time dashboard for monitoring OpenClaw agent activities, token usage, and current tasks. - Features live activity feed, context meter, session info panel, and quick maintenance actions. - Includes local server script and standalone dashboard HTML for flexible deployment. - Supports real-time activity updates via WebSocket and session status API.

元数据

Slug activity-control-ui

版本 1.1.0

许可证 MIT-0

累计安装 0

当前安装数 0

历史版本数 2

常见问题