Shadow AI Monitor

Shadow AI Monitor - Enterprise-grade dashboard for tracking employee AI tool usage, data exposure risks, and PIPEDA compliance. Generates professional HTML d...

This skill appears to do what it says: generate demo events and produce a local HTML dashboard. Before installing or running it with real data, consider the following: 1) The example cron payload mentions sending WhatsApp notifications, but the skill provides no messaging integration or credentials—do not assume notifications are implemented; adding them will require secure handling of messaging API keys. 2) The generated HTML loads Chart.js from a CDN when opened in a browser; if you need an air-gapped or fully controlled environment, host the library locally or remove the external script. 3) The demo generator creates realistic-seeming events (employee IDs, data categories). If you replace demo data with real telemetry, ensure you have legal basis and employee/client consent before processing or storing personal data. 4) Review the two script files yourself (they are short and readable) before running and run them in an isolated workspace if you are unsure. 5) Source metadata is 'unknown' and author is generic—if you plan to use in production, obtain provenance/maintenance information and confirm licensing. Overall, no signs of data exfiltration or hidden behavior in the provided files, but exercise caution when integrating notification channels or using real-sensitive data.

Type: OpenClaw Skill Name: shadow-ai-monitor Version: 1.0.0 The OpenClaw skill 'shadow-ai-monitor' is designed to generate local HTML dashboards for AI tool usage and compliance. All scripts (`generate_demo_data.js`, `generate_dashboard.js`) perform local file I/O operations (reading/writing JSON and HTML) and calculations without any network requests, external API calls, or execution of arbitrary commands. The `SKILL.md` instructions for the AI agent are aligned with the skill's stated purpose, instructing it to run the local scripts and send a WhatsApp notification with metrics, which is a legitimate use of agent capabilities. While the generated HTML dashboard loads Chart.js from a CDN, this is a standard web development practice for static pages and not a malicious action performed by the skill's Node.js code itself. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or harmful prompt injection.