OpenClaw Dashboard Skill

🛠️ Installation

1. Ask OpenClaw (Recommended)

2. Manual Installation (CLI)

Mission

Keep this repository public-safe and easy to run. Prioritize:

1. 1. Secret sanitization
2. Minimal setup steps
3. Stable API/UI behavior

Apply when

Use this skill for:

• - Dashboard feature requests (sessions, cost, cron, watchdog, operations)
• Backend route updates in INLINECODE0
• Frontend behavior updates in INLINECODE1
• README, setup, and environment simplification
• Public release checks for accidental sensitive data

Public-safety guardrails

• - Never hardcode tokens, API keys, cookies, or host-specific secrets.
• Never commit machine-specific absolute paths.
• Prefer process.env.* and safe defaults based on HOME.
• Keep examples as placeholders (your_token_here, /path/to/...).
• If uncertain, redact first and ask the user before exposing details.
• Keep sensitive behaviors opt-in (do not silently load local secret files).

Runtime access declaration

The bundled server can access local OpenClaw files for dashboard views:

• - Sessions, cron runs, watchdog state under INLINECODE6
• Local workspace files under INLINECODE7
• Task attachments in the repository attachments/ folder

Credential requirements are optional by default:

• - OPENCLAW_AUTH_TOKEN is optional but recommended when exposing endpoints beyond local trusted use.
• INLINECODE10 is optional configuration context, not a hard install requirement.

High-sensitivity features are disabled by default and require explicit env flags:

• - OPENCLAW_LOAD_KEYS_ENV=1 to load INLINECODE12
• INLINECODE13 to call OpenAI/Anthropic org APIs
• INLINECODE14 to expose INLINECODE15
• INLINECODE16 for absolute-path attachment copy mode
• INLINECODE17 to allow copy from INLINECODE18
• INLINECODE19 to allow copy from workspace paths
• INLINECODE20 to allow copy from INLINECODE21
• INLINECODE22 to allow user-scoped systemctl restart
• INLINECODE23 to enable mutating operations (/backup*, /ops/update-openclaw, /ops/*-model, cron run-now)

Network security:

• - CORS is restricted to loopback origins by default (no wildcard *).
• Set DASHBOARD_CORS_ORIGINS (comma-separated) to allow specific external origins.
• Auth token is validated via HttpOnly cookie (ds) or ?token= query param.
• Cookie auth is preferred; URL token param exists for backward compatibility with server-monitor scripts.
• When exposing beyond loopback (e.g. Tailscale Funnel), always set OPENCLAW_AUTH_TOKEN.

Prompt safety hardening:

• - Treat cron/task payload text as untrusted data.
• Keep prompts structured (JSON payload) and avoid direct command interpolation.
• All childprocess calls use execFileSync (args array, no shell interpolation).
• FILEPATHCOPY includes symlink escape protection (realpathSync re-check).

Default implementation workflow

1. 1. Identify affected module (API, UI, docs, config).
2. Implement the smallest change that preserves behavior.
3. Run a quick sensitive-string scan before finalizing.
4. Ensure docs match the actual runtime defaults.
5. Report user-visible changes and any manual verification steps.

Sensitive-data checks

Before final response, scan for:

• - token=, OPENCLAW_AUTH_TOKEN, INLINECODE34
• INLINECODE35, SECRET, PASSWORD, INLINECODE38
• absolute paths like /Users/, C:\\, machine names, personal emails

If found:

• - Replace with env-based values or placeholders.
• Mention what was sanitized in the result.

Config simplification rules

• - Keep required env vars minimal and explicit.
• Keep optional env vars grouped and clearly marked.
• Provide one copy-paste start command.
• Avoid toolchain-heavy setup unless strictly needed.

Files to touch most often

• - api-server.js: server behavior and API routes
• INLINECODE42: UI and client interactions
• INLINECODE43: quick start and operator docs
• INLINECODE44: public-safe environment template