Usage Visualizer

Advanced usage statistics and high-fidelity visual reporting for OpenClaw. 100% local processing. Audit-verified privacy (No credentials stored).

This skill is internally consistent with its stated purpose and appears to only read local OpenClaw/Clawdbot session logs, store aggregates in a local SQLite DB, and render images via a headless browser. Before installing, consider: 1) The install step invokes pip and will download packages from PyPI (network activity during install). 2) The rendering dependency (html2image) requires Chromium; ensure you trust/verify the Chromium binary and/or the system package source. 3) The skill reads files under ~/.openclaw and ~/.clawdbot—confirm you are comfortable with local session logs being parsed and stored in the skill's workspace. 4) The skill's package.json references a GitHub repo but the registry source is 'unknown'—if provenance matters, manually review the upstream repository for additional context. If any of those points are unacceptable, review the code locally (it is included) before running, or run it in a restricted environment.

Type: OpenClaw Skill Name: usage-visualizer Version: 1.1.3 The skill is classified as suspicious due to a potential arbitrary file write vulnerability in `scripts/generate_report_image.py` if the `--output` argument were user-controlled, and the heavy dependency on Chromium for image rendering, which significantly expands the attack surface. While the agent's execution flow (via `scripts/run_usage_report.py`) mitigates the arbitrary file write by constraining output to `OPENCLAW_WORKSPACE` or the project root, and the HTML content for rendering is generated locally without external network calls, these factors introduce meaningful risks. There is no evidence of intentional malicious behavior like data exfiltration or persistence.