Dashboard Builder

Dashboard Builder is the construction kit for your entire NormieClaw setup. It reads skill specifications and scaffolds a complete, working Next.js dashboard...

This package appears to be a legitimate dashboard scaffolder, but take these precautions before running anything: 1) The package's registry metadata omits requirements that the scripts actually need — ensure you have Node.js/npm and python3 available. 2) Do not run scripts that push database migrations against a production Supabase project. Create a throwaway/test Supabase project and use a short-lived service-role key if you need to exercise 'run-migrations' or 'db push'. 3) Review the generated SQL migration files (supabase/migrations/) and the generated app files before executing any push or deploy commands. 4) Be aware the scripts may scan the filesystem to locate the skill package (they run find across $PWD/$HOME and in some samples even /); run in a constrained environment (container, VM, or a dedicated dev machine) if you are uncomfortable with broad filesystem operations. 5) Confirm .env.local is in .gitignore and never commit SUPABASE_SERVICE_ROLE_KEY. 6) Prefer the provided dry-run options (where applicable) and step through 'add-skill' and migration generation manually. 7) If anything is unclear or you need to deploy for production, rotate keys after testing and conduct a code review of manifest parsing and migration generation. If you want, I can list the exact places to inspect in the templates/scripts or suggest safer commands to run first (dry-run checks, open generated SQL) before any network-facing operations.

Type: OpenClaw Skill Name: normieclaw-dashboard-builder Version: 1.0.3 The NormieClaw Dashboard Builder is a comprehensive meta-skill designed to scaffold and manage a Next.js 14 and Supabase-based personal dashboard. The bundle includes shell scripts (scaffold-project.sh, add-skill.sh, run-migrations.sh) and React templates that automate project initialization, database migration generation, and skill registration. While the skill possesses high-privilege capabilities (filesystem write and shell execution), its behavior is strictly aligned with its stated purpose. Significant effort is evident in the security architecture, including mandatory Row Level Security (RLS) patterns, explicit warnings against secret exposure, and robust prompt injection defenses within SKILL.md and SECURITY.md. No indicators of data exfiltration, malicious backdoors, or intentional self-exploitation were identified.