{"id":46463257,"url":"https://github.com/piti/openclaw-security-dashboard","last_synced_at":"2026-03-06T04:01:06.654Z","repository":{"id":341945615,"uuid":"1172117223","full_name":"piti/openclaw-security-dashboard","owner":"piti","description":"Open-source security dashboard for OpenClaw deployments. Scans gateway exposure, malicious skills, config hardening, identity integrity, and more.","archived":false,"fork":false,"pushed_at":"2026-03-04T05:09:08.000Z","size":59,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-03-04T06:06:51.122Z","etag":null,"topics":["dashboard","ioc","open-source","openclaw","security","threat-intelligence"],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/piti.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-03-04T00:45:44.000Z","updated_at":"2026-03-04T05:09:11.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/piti/openclaw-security-dashboard","commit_stats":null,"previous_names":["piti/openclaw-security-dashboard"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/piti/openclaw-security-dashboard","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/piti%2Fopenclaw-security-dashboard","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/piti%2Fopenclaw-security-dashboard/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/piti%2Fopenclaw-security-dashboard/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/piti%2Fopenclaw-security-dashboard/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/piti","download_url":"https://codeload.github.com/piti/openclaw-security-dashboard/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/piti%2Fopenclaw-security-dashboard/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30161345,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-05T22:39:40.138Z","status":"online","status_checked_at":"2026-03-06T02:00:08.268Z","response_time":250,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dashboard","ioc","open-source","openclaw","security","threat-intelligence"],"created_at":"2026-03-06T04:00:39.460Z","updated_at":"2026-03-06T04:01:06.639Z","avatar_url":"https://github.com/piti.png","language":"JavaScript","funding_links":[],"categories":["Security \u0026 Hardening"],"sub_categories":["Security Tools"],"readme":"# openclaw-security-dashboard\n\n![npm version](https://img.shields.io/npm/v/openclaw-security-dashboard?color=%23FF9F2E\u0026style=flat-square)\n![npm downloads](https://img.shields.io/npm/dw/openclaw-security-dashboard?color=%23FF9F2E\u0026style=flat-square)\n![license](https://img.shields.io/npm/l/openclaw-security-dashboard?color=%2322c55e\u0026style=flat-square)\n\n\u003e Every OpenClaw dashboard shows what your agent *can* do.\n\u003e This one shows what it *shouldn't* be doing.\n\n\u003c!-- TODO: screenshot --\u003e\n\n## Install \u0026 Run\n\n**Install permanently (recommended):**\n```bash\nnpm install -g openclaw-security-dashboard\nopenclaw-security-dashboard install\n```\nDashboard runs at http://localhost:7177, starts on login, re-scans every 30 minutes.\n\n**Quick scan (one-off):**\n```bash\nnpx openclaw-security-dashboard@latest\n```\n\n**Auto-fix:**\n```bash\nopenclaw-security-dashboard --fix       # installed globally\nnpx openclaw-security-dashboard --fix   # or via npx\n```\n\nZero dependencies. Zero network calls. Everything stays on your machine.\n\n**Management commands:**\n```bash\nopenclaw-security-dashboard status      # check if running, current grade\nopenclaw-security-dashboard uninstall   # stop and remove service\n```\n\n### Or clone for development\n\n```bash\ngit clone https://github.com/piti/openclaw-security-dashboard.git\ncd openclaw-security-dashboard\nnode server.js\n```\n\n## Auto-Fix\n\n```bash\n# Scan, fix what's fixable, show before/after\nnpx openclaw-security-dashboard --fix\n\n# Fix + JSON output (for CI/CD)\nnpx openclaw-security-dashboard --fix --json\n```\n\nCreates a timestamped backup before touching anything. Fixes mechanical issues automatically:\n\n- Gateway bound to 0.0.0.0 → rebound to 127.0.0.1\n- Weak file permissions → set to 600\n- authBypass enabled → disabled\n- Missing safeBins allowlist → added (11 safe commands)\n- Plaintext API keys → replaced with env var references\n\nAfter fixing, re-scans and shows your new grade. Typical improvement: F → C in seconds.\n\nIssues requiring human judgment (skill selection, identity files, network config) are left as findings with remediation guidance.\n\nThe browser dashboard also has an **Auto-Fix button** with a confirmation modal — click it to see exactly what will change, then apply with one click.\n\n## CLI Flags \u0026 Subcommands\n\n```bash\n# Subcommands\nopenclaw-security-dashboard install          # install as background service\nopenclaw-security-dashboard uninstall        # stop and remove service\nopenclaw-security-dashboard status           # check if running + current grade\n\n# Flags\nopenclaw-security-dashboard --fix            # scan + auto-fix\nopenclaw-security-dashboard --json           # JSON output + exit (for CI/CD)\nopenclaw-security-dashboard --no-browser     # start server without opening browser\nopenclaw-security-dashboard --watch          # re-scan periodically (default: 30m)\nopenclaw-security-dashboard --watch-interval 15  # custom watch interval (minutes)\nopenclaw-security-dashboard --fix --json     # fix + JSON output\n```\n\nExit codes for `--json`: 0 (grade A/B), 1 (grade C/D), 2 (grade F).\n\n## Background Service\n\n`openclaw-security-dashboard install` sets up a persistent background service:\n\n- **macOS:** LaunchAgent at `~/Library/LaunchAgents/io.bulwarkai.dashboard.plist` — starts on login, restarts on crash\n- **Linux:** systemd user service at `~/.config/systemd/user/openclaw-security-dashboard.service`\n- **Windows:** Not yet supported (use `npx` in a terminal)\n\nThe service re-scans every 30 minutes and tracks grade history:\n- Logs: `~/.openclaw/.dashboard-logs/dashboard.log`\n- Grade history: `~/.openclaw/.dashboard-logs/grade-history.jsonl`\n\nThe `status` command also checks npm for newer versions and prompts to update.\n\n## Security \u0026 Permissions\n\nThis tool requires two system capabilities that security scanners like [Socket.dev](https://socket.dev) will flag:\n\n**Shell access** — The scanner inspects your OpenClaw installation by running read-only system commands (`grep`, `stat`, `ls`, `crontab -l`, `lsof`). The `--fix` flag also runs `chmod` and file operations to apply security fixes. All commands target only your `~/.openclaw/` directory.\n\n**Network access** — The web dashboard UI runs a local HTTP server on `localhost:7177`. This server **only binds to loopback** (127.0.0.1) and **never makes outbound network connections**. No data leaves your machine. No telemetry. No phone-home.\n\nYou can verify this yourself:\n```bash\n# Check what the server listens on\nlsof -iTCP:7177 -sTCP:LISTEN\n# Verify no outbound connections\nlsof -i -P | grep openclaw\n```\n\n## What It Checks\n\n**Gateway Security** — Bind address, auth enforcement, TLS, port exposure, CVE version check\n\n**Skill Supply Chain** — 102+ named IOCs, 21 pattern rules, C2 IP detection, exfil domain detection, publisher blacklist, reverse shell detection\n\n**Config Hardening** — File permissions, plaintext secrets, sandbox settings\n\n**Identity Integrity** — SOUL.md tampering detection, prompt injection scanning, SHA-256 hash baselines\n\n**Persistence \u0026 Cron** — LaunchAgents, hooks, MCP server version pinning\n\n**Session Analysis** — Injection attempts, credential leaks in session logs\n\n## API Integration\n\nWhen running as a service (`openclaw-security-dashboard install`), the dashboard exposes a JSON API on `localhost:7177`.\n\n### Get current security status\n\n```bash\ncurl http://localhost:7177/api/status\n```\n\nReturns:\n\n```json\n{\n  \"dashboard_version\": \"1.4.2\",\n  \"scan_date\": \"2026-03-05T12:00:00Z\",\n  \"openclaw_version\": \"2026.3.2\",\n  \"grade\": \"B\",\n  \"score\": 72,\n  \"grade_color\": \"#3b82f6\",\n  \"credential_level\": {\n    \"level\": \"L3\",\n    \"label\": \"Credentials directory\"\n  },\n  \"summary\": {\n    \"critical\": 0,\n    \"high\": 1,\n    \"medium\": 1,\n    \"low\": 1,\n    \"total\": 3\n  },\n  \"panels\": {\n    \"gateway\": { \"status\": \"green\" },\n    \"skills\": { \"status\": \"green\" },\n    \"config\": { \"status\": \"amber\" },\n    \"identity\": { \"status\": \"green\" },\n    \"persistence\": { \"status\": \"green\" },\n    \"sessions\": { \"status\": \"green\" },\n    \"mcp\": { \"status\": \"green\" }\n  }\n}\n```\n\n### Trigger a rescan\n\n```bash\ncurl http://localhost:7177/api/scan\n```\n\n### Apply auto-fixes\n\n```bash\ncurl -X POST http://localhost:7177/api/fix\n```\n\n### Embed in your dashboard\n\n```javascript\n// Fetch security grade for your OpenClaw dashboard\nconst res = await fetch('http://localhost:7177/api/status');\nconst { grade, score, grade_color, summary } = await res.json();\n\n// Display a security badge\nconsole.log(`Security: ${grade} (${score}/100)`);\n```\n\nThe API only binds to loopback (127.0.0.1). No authentication required for local access. No data leaves your machine.\n\n## Security Grade\n\nYour deployment gets a letter grade (A+ through F) based on weighted findings.\nThe grade is designed to be screenshot-friendly — share your score.\n\n| Severity | Score Impact |\n|----------|-------------|\n| CRITICAL | -25 each |\n| HIGH | -15 each |\n| MEDIUM | -5 each |\n| LOW | -2 each |\n\n## Integration with Other Dashboards\n\nopenclaw-security-dashboard works alongside Mission Control, TenacitOS, ClawDeck,\nand any other OpenClaw dashboard. Three integration methods:\n\n### Automatic (zero config)\nEvery scan writes `~/.openclaw/.security-status.json` with your grade, score,\nand panel statuses. Any dashboard that reads `~/.openclaw/` can display this data.\n\n### Embed Widget\nDrop this into any dashboard:\n```html\n\u003ciframe src=\"http://localhost:7177/embed\" width=\"320\" height=\"130\" frameborder=\"0\"\u003e\u003c/iframe\u003e\n```\nSupports `?theme=light` for light-themed dashboards.\n\n### JSON API\nFetch security data from your dashboard's code:\n```javascript\nconst res = await fetch('http://localhost:7177/api/status');\nconst { grade, score, panels } = await res.json();\n```\n\nCORS is enabled on all endpoints.\n\n## IOC Database\n\nThis project maintains an open-source database of known malicious OpenClaw skills,\npublishers, C2 domains, and credential patterns. Sources include Koi Security,\nAntiy CERT, Snyk, Bitdefender, and BulwarkAI's ongoing monitoring.\n\n**1,184+ known malicious skills** across 16 categories.\n\nThe IOC database is MIT licensed. Use it in your own projects.\n\n## API\n\n`GET /api/status` returns JSON with your security grade, score, and panel statuses.\n\n`GET /api/scan` triggers a fresh scan and returns results.\n\n`POST /api/fix` applies auto-fixes and returns before/after comparison with backup path.\n\n`GET /api/fixable` returns the count and list of auto-fixable findings (read-only).\n\n`GET /api/baseline/accept` updates the identity file baseline to current hashes.\n\n## Configuration\n\n```bash\n# Custom port\nSECURITY_DASHBOARD_PORT=8080 npx openclaw-security-dashboard\n\n# Custom OpenClaw directory\nOPENCLAW_DIR=/path/to/.openclaw npx openclaw-security-dashboard\n```\n\n## FAQ\n\n**Does this replace `openclaw security audit`?**\nNo. The built-in audit is good but misses ~40% of the threat surface. This dashboard\ncovers the gap: multi-directory skill scanning, IOC cross-reference, identity integrity,\npersistence detection, and session analysis.\n\n**Does this send data anywhere?**\nNo. Everything runs locally. Zero network calls. Your config never leaves your machine.\n\n**Can I use the IOC database in my own project?**\nYes. MIT licensed. Credit appreciated.\n\n**How do I update?**\n`npm update -g openclaw-security-dashboard` — the service picks up the new version on next restart.\n\n**How do I check if it's running?**\n`openclaw-security-dashboard status` — shows grade, watch interval, next scan, and version.\n\n**Where are the logs?**\n`~/.openclaw/.dashboard-logs/dashboard.log` — grade history in `grade-history.jsonl` in the same directory.\n\n**I found a false positive / want to report a malicious skill.**\nOpen an issue or PR. See [CONTRIBUTING.md](CONTRIBUTING.md).\n\n## Contributing\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for how to:\n- Report new malicious skills\n- Report false positives\n- Add new security checks\n- Improve the dashboard UI\n\n## About\n\nBuilt by [BulwarkAI](https://bulwarkai.io) — security hardening for OpenClaw deployments.\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpiti%2Fopenclaw-security-dashboard","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpiti%2Fopenclaw-security-dashboard","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpiti%2Fopenclaw-security-dashboard/lists"}