openclaw menubar

Enable OpenClaw as a native macOS menu bar app with quick access popup. **macOS ONLY** - not compatible with Windows or Linux. Use when user asks to "enable menubar", "add menu bar", "run in menu bar", "make it accessible from menu bar", or wants quick OpenClaw access without opening full dashboard.

This package appears to do what it says: it installs an Electron menubar app that auto-discovers your local OpenClaw gateway and uses any token found in ~/.openclaw/openclaw.json to authenticate. Before installing: 1) Inspect package.json/package-lock.json for untrusted dependencies (npm install will fetch packages). 2) Review scripts/install.sh and scripts/start.sh to see what they run. 3) Be aware the app will read ~/.openclaw/openclaw.json (to extract gateway URL/token) and will save ~/.openclaw/menubar-config.json. 4) The app registers a custom protocol handler (openclawmenubar://) and a global shortcut — these are normal for UX but are persistent. 5) If you care about tight security, build/run the app in a disposable account or VM first, and verify the token handling and network endpoints are local (localhost/LAN). Finally, note the minor documentation inconsistency about cross-platform support (the code is macOS-focused); if you need non-macOS support, ask the maintainer for clarification.

Type: OpenClaw Skill Name: openclaw-menubar Version: 1.0.0 The skill is classified as suspicious due to insecure `webPreferences` in the Electron `main.js` file. Specifically, the main `BrowserWindow` is configured with `nodeIntegration: true`, `contextIsolation: false`, and `enableRemoteModule: true`. While the primary content (OpenClaw webchat) is loaded into a more securely sandboxed `BrowserView`, this configuration for the main window (which loads `index-webchat.html`) is a common Electron vulnerability pattern that could lead to remote code execution if an attacker could inject code into the main window's renderer process. Although the `index-webchat.html` is a simple local file, this setup is a significant security flaw. Other files like `renderer.js` and `simple-client.js` contain direct `child_process.execPromise` calls, but these appear to be dead code not used by the main application entry point.