Security Dashboard

Real-time security monitoring dashboard for OpenClaw and Linux server infrastructure. Monitors gateway status, network security, public exposure, system updates, SSH access, TLS certificates, and resource usage.

Before installing, review the included files (scripts/install.sh and server.js) yourself or on a test machine. Specific checks: - Inspect /etc/sudoers.d/openclaw-dashboard the installer creates. The rule uses wildcards (e.g., 'journalctl *') — consider narrowing this to only the journalctl invocations needed (for example '-u sshd' or specific time ranges) to avoid exposing unrelated logs. - Prefer running as the dedicated user but give that user a real home or adjust server.js to read the OpenClaw config via a configurable path (do not rely on /nonexistent HOME). If you must run as root, be aware of the higher risk. - Confirm the service runs with the intended hardened systemd flags (NoNewPrivileges, ProtectSystem, ReadWritePaths limited to skill directory). Don’t change these without understanding the consequences. - Audit server.js for any commands that call sudo or parse files (fs.readFileSync and many execSync calls). Ensure they only access the data you want monitored and do not transmit data externally (there are no outgoing network calls in the code provided, but review future updates). - Consider running the dashboard in an isolated environment (container or VM) first to validate behavior and to avoid exposing sensitive host logs or files. - If you accept the install, restrict the sudoers entries to the minimal commands and arguments required and verify file ownership/permissions for the OpenClaw config the dashboard needs to read. If you want, I can produce a tightened sudoers snippet and a checklist of the least-privileged commands the dashboard needs, or point out exact lines in server.js that would need modification to make the service run under a non-login dedicated user.

Type: OpenClaw Skill Name: security-dashboard Version: 1.2.1 The OpenClaw Security Dashboard skill is designed for system monitoring and incorporates significant security hardening measures. The `scripts/install.sh` creates a dedicated, restricted user with limited sudo privileges for specific monitoring commands (e.g., `systemctl`, `ufw`, `fail2ban-client`) and applies strong systemd hardening (`NoNewPrivileges`, `ProtectSystem`, `ProtectHome`). The `server.js` uses `execSync` to gather system metrics, but commands are hardcoded or derived from trusted sources, and no user input is directly executed. There is no evidence of data exfiltration to external endpoints, malicious execution, persistence mechanisms beyond a legitimate systemd service, or prompt injection attempts in `SKILL.md` or `README.md`.