OpenClaw Dashboard

A real-time monitoring dashboard for OpenClaw agents. Track agents, sub-agents, cron jobs, costs, project progress, and session replay — all in one dark-mode...

This dashboard appears to be what it claims — a local UI that reads your OpenClaw installation under ~/.openclaw and serves a web interface. Before installing/running it: - Understand what will be read: sessions, logs, workspace files (SOUL.md, MEMORY.md, IDENTIY.md), auth-profiles.json, cron runs — these can include private conversation data and stored API keys. - Run it locally only: bind the Express server to localhost (127.0.0.1) or run behind an authenticated reverse proxy if you need remote access. By default Express will listen on all interfaces, which could expose data if your machine is network-accessible. - Audit secrets: check ~/.openclaw/auth-profiles.json and other files for credentials you don’t want to expose; remove or rotate tokens if needed before running. - Install in an isolated environment: consider a dedicated user account, container, or VM to reduce blast radius from npm dependency risks. The package-lock is large (many deps) — npm install will pull many packages. - Optional: inspect server.js endpoints (e.g., /api/*) to confirm they only serve read-only data you expect and do not provide write, shell-exec, or remote-forwarding functionality. If you need, I can: (a) highlight exact paths the server reads, (b) show the Express routes present in server.js, or (c) suggest a one-line change to bind the server to 127.0.0.1.

Type: OpenClaw Skill Name: oc-dashboard Version: 1.2.0 The openclaw-dashboard skill bundle provides a local web-based monitoring interface for OpenClaw agents. The Express server (server.js) reads agent configurations, session history, and memory files from the user's ~/.openclaw directory to display real-time activity, costs, and logs. The code includes appropriate security measures, such as path traversal checks in the /api/session and /api/memory/file endpoints, and there is no evidence of data exfiltration or malicious intent. While the server binds to all network interfaces (0.0.0.0) without authentication, this is a common configuration for local development tools and aligns with the stated purpose of the skill.