Star Office UI Master

Star Office UI 一键化 Skill：帮主人快速部署像素办公室看板，支持多 Agent 加入、状态可视化、移动端查看与公网访问。

What to consider before installing/letting an agent run this Skill: - Missing declared secrets: The skill package metadata says 'no env required' but the instructions and backend code use GEMINI_API_KEY, GEMINI_MODEL, FLASK_SECRET_KEY (or STAR_OFFICE_SECRET) and ASSET_DRAWER_PASS. Treat any API keys or secret values as sensitive — don't paste them into UIs or files until you trust the code. Prefer creating and running in an isolated environment first. - Network fetch + execution: SKILL.md tells the agent/user to git clone a remote repo. That will fetch and run code from the network. If you don't trust the upstream repository, don't run the clone or run it only in a disposable VM/container. - Writes outside repo / persistence: The instructions explicitly create ../skills/gemini-image-generate and copy scripts there; the backend reads/writes parent-level memory/ and runtime-config.json and may create join-keys.json. This modifies the host/agent environment and could add persistent functionality to your agent. If you are uncomfortable, do not run those steps or run them in an isolated container. - Default credentials: The sidebar default password is 1234. If you run this service, set a strong ASSET_DRAWER_PASS and set a strong FLASK_SECRET_KEY before exposing the app. The code enforces stronger values in production mode — configure STAR_OFFICE_ENV/FLASK_ENV appropriately. - Cloud exposure: SKILL.md recommends Cloudflare Tunnel for quick public access. Consider the security implications: do not expose the service publicly without setting strong secrets and reviewing endpoints. - Inspect the code: Because the repo contains backend scripts that will be executed (app.py, scripts that may spawn subprocesses), review those files (especially any code that calls subprocess, writes files outside the project, or posts data externally) before running them. - Run in isolation: Best practice: run the whole stack inside a disposable VM, container, or sandboxed environment. Test smoke_test.py and health endpoints locally first. If you plan to allow other agents to join, review join-keys.json and the agent push logic to ensure no sensitive data is being shared. - If you want to use only the UI without persistence: you can run the backend locally and avoid the SKILL.md steps that copy files into ../skills or modify host-level directories. If you want, I can: (1) list all places in the repo that read/write parent directories or hard-coded absolute paths, (2) show the exact lines that create ../skills or reference GEMINI env vars, or (3) produce an isolated minimal run checklist (commands to run inside a container) to evaluate behavior safely.

Type: OpenClaw Skill Name: star-office-ui-master Version: 1.0.0 The skill bundle is a comprehensive pixel-art dashboard for visualizing AI agent statuses, supporting multi-agent collaboration, desktop pet modes (via Tauri/Electron), and AI-driven room decoration. Security-conscious features are prominent, such as 'memo_utils.py' which redacts PII (IPs, emails, paths) from logs, and 'scripts/security_check.py' which audits the environment for weak passwords or leaked API keys. While the backend ('backend/app.py') utilizes powerful system calls (subprocess, os.system) for image processing and process management, these are aligned with the stated purpose and include basic safeguards. The documentation ('SKILL.md', 'README.md') is transparent about configuration and security requirements, such as the need to change the default asset drawer password.