Opencron Skill Repo

Visual cron job dashboard for OpenClaw — live countdown timers, run history, calendar view

This skill appears to implement the dashboard it describes, but there are clear inconsistencies and a real risk of leaking your gateway token. Things to consider before installing: - The SKILL.md and scripts use OPENCLAW_GATEWAY_TOKEN and CANVAS_PORT but the registry metadata does not declare these env vars — confirm where that token comes from and whether you are comfortable it will be placed into URLs. - The instructions explicitly tell the agent to build a public URL containing the gateway token and to fetch the public IP via an external service (ifconfig.me). Embedding a token in a query string makes it visible to anyone who can see logs, browser history, reverse proxies, or referer headers — avoid this unless the token is disposable or you control access carefully. - The included installer runs git (not declared) and executes Python scripts that read files under ~/.openclaw. Only install from a source you trust; review the repo contents locally before running the installer. - If you want this functionality but not the token-exposure behavior: modify update_canvas.py / SKILL.md to avoid putting the gateway token in client-side URLs. Instead, require server-side token validation (proxy the token check in nginx) or use short-lived access links. If you do proceed, run the install in an isolated environment, inspect and possibly harden the nginx reverse-proxy configuration (don’t accept tokens in query strings, enforce POST-only where appropriate, restrict what /runs/ exposes), and declare any environment variables/config paths in the skill metadata so the behavior matches what is advertised.

Type: OpenClaw Skill Name: opencron-skill-repo Version: 1.0.1 The skill bundle provides a legitimate-looking cron dashboard but includes instructions in SKILL.md that direct the AI agent to leak the sensitive OPENCLAW_GATEWAY_TOKEN by appending it to the chat output after every cron job. While intended for user convenience, this exposes authentication credentials in chat logs. Additionally, update_canvas.py fetches a remote HTML template from GitHub (raw.githubusercontent.com/firstfloris/opencron/master/cron-dashboard.html), creating a remote dependency that could be used to deliver malicious frontend code or perform XSS.