跳到主要内容
知仓学习社ZHICANG

add-dashboard

Add a monitoring dashboard to NanoClaw. Installs @nanoco/nanoclaw-dashboard and a pusher that sends periodic JSON snapshots.

读凭据读文件执行命令联网严重 5 · 高危 6nanocoai/nanoclaw

它会碰到什么

扫了多少4 个文本文件,34 KB
它会碰到什么读凭据读文件执行命令联网
命中总数17 处
命中统计严重 5 · 高 6 · 中 4 · 低 0
逐条看命中(11 条严重或高危)
  • 严重 resources/dashboard-pusher.test.ts:9cred-paths
    * .env). This proves the skill works once applied: with a secret set it
  • 严重 SKILL.md:58cred-paths
    ### 4. Add environment variables to .env
  • 严重 SKILL.md:107cred-paths
    - **401 errors**: Verify `DASHBOARD_SECRET` matches in `.env`
  • 严重 SKILL.md:108cred-paths
    - **Port conflict**: Change `DASHBOARD_PORT` in `.env`
  • 严重 SKILL.md:120cred-paths
    Then, by hand, remove the single dashboard block the skill added to `main()` in `src/index.ts` (the `// Dashboard (optional…)` comment, the `await import('./das
  • resources/dashboard-pusher.test.ts:90cred-envread
    delete process.env.DASHBOARD_SECRET;
  • resources/dashboard-pusher.test.ts:91cred-envread
    delete process.env.DASHBOARD_PORT;
  • resources/dashboard-pusher.test.ts:105cred-envread
    process.env.DASHBOARD_SECRET = 'test-secret';
  • resources/dashboard-pusher.test.ts:106cred-envread
    process.env.DASHBOARD_PORT = String(dash.port);
  • resources/dashboard-pusher.ts:70cred-envread
    const secret = process.env.DASHBOARD_SECRET || env.DASHBOARD_SECRET;
  • resources/dashboard-pusher.ts:71cred-envread
    const port = parseInt(process.env.DASHBOARD_PORT || env.DASHBOARD_PORT || '3100', 10);

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

/add-dashboard — NanoClaw Dashboard

Adds a local monitoring dashboard showing agent groups, sessions, channels, users, token usage, context windows, message activity, and real-time logs.

Architecture

NanoClaw (pusher)              Dashboard (npm package)
┌──────────┐    POST JSON      ┌──────────────┐
│ collects │ ────────────────→ │ /api/ingest  │
│ DB data  │   every 60s       │ in-memory    │
│ tails    │ ────────────────→ │ /api/logs/   │
│ log file │   every 2s        │   push       │
└──────────┘                   │ serves UI    │
                               └──────────────┘

Steps

1. Install the npm package

pnpm install @nanoco/nanoclaw-dashboard

2. Copy the pusher module and its tests

Copy all three resource files into src/. The tests ship with the skill and run against the composed project — they're how you confirm the skill works and is wired in correctly.

.claude/skills/add-dashboard/resources/dashboard-pusher.ts       → src/dashboard-pusher.ts
.claude/skills/add-dashboard/resources/dashboard-pusher.test.ts  → src/dashboard-pusher.test.ts
.claude/skills/add-dashboard/resources/dashboard-wiring.test.ts  → src/dashboard-wiring.test.ts
  • dashboard-pusher.test.ts — behavior: starts the pusher, posts a real snapshot to a fake dashboard.
  • dashboard-wiring.test.ts — the code edit in step 3: asserts (via the TS AST) that index.ts dynamically imports ./dashboard-pusher.js and awaits startDashboard() as colocated statements of main(), after DB init and before the boot-complete log. Delete or misplace the edit and this goes red.

3. Wire into src/index.ts

This is the skill's one integration point, and it's deliberately minimal and self-contained: all the startup logic lives in dashboard-pusher.ts, and the import is colocated with the call so the whole edit is a single block in one place — there's no separate top-of-file import to add (or to remember to remove).

Add this block inside main(), just before the log.info('NanoClaw running') line:

  // Dashboard (optional; no-ops without DASHBOARD_SECRET)
  const { startDashboard } = await import('./dashboard-pusher.js');
  await startDashboard();

startDashboard() reads DASHBOARD_SECRET/DASHBOARD_PORT itself and no-ops if the secret is unset, so nothing else in core needs to change.

4. Add environment variables to .env

DASHBOARD_SECRET=<generate-a-random-secret>
DASHBOARD_PORT=3100

Generate the secret: node -e "console.log('nc-' + require('crypto').randomBytes(16).toString('hex'))"

5. Build, test, and restart

Run from your NanoClaw project root:

pnpm run build
pnpm exec vitest run src/dashboard-pusher.test.ts src/dashboard-wiring.test.ts   # behavior + wiring
source setup/lib/install-slug.sh
systemctl --user restart $(systemd_unit)              # Linux
# or: launchctl kickstart -k gui/$(id -u)/$(launchd_label)  # macOS

Run build before the tests: it's what guards the @nanoco/nanoclaw-dashboard dependency. dashboard-pusher.ts reaches the package through await import('@nanoco/nanoclaw-dashboard'), so if step 4 was skipped, pnpm run build fails with TS2307: Cannot find module. The behavior test deliberately mocks that package — its startDashboard binds a real dashboard port, a side effect we don't want in a test — so the test alone would pass with the dependency missing. Build is therefore the leg that verifies the dependency is installed; keep it ahead of the tests in the validate step.

6. Verify (runtime smoke check)

Once the service is restarted, confirm the dashboard is live:

curl -s http://localhost:3100/api/status
curl -s -H "Authorization: Bearer <secret>" http://localhost:3100/api/overview

Open http://localhost:3100/dashboard in a browser.

Dashboard Pages

| Page | Shows |

|------|-------|

| Overview | Stats, token usage + cache hit rate, context windows, activity chart |

| Agent Groups | Sessions, wirings, destinations, members, admins |

| Sessions | Status, container state, context window usage bars |

| Channels | Live/offline status, messaging groups, sender policies |

| Messages | Per-session inbound/outbound messages |

| Users | Privilege hierarchy: owner > admin > member |

| Logs | Real-time log streaming with level filter |

Troubleshooting

  • "No data yet": Wait 60s for first push, or check logs for push errors
  • 401 errors: Verify DASHBOARD_SECRET matches in .env
  • Port conflict: Change DASHBOARD_PORT in .env
  • No logs: Check logs/nanoclaw.log exists

Removal

Reverse the apply steps. Safe to re-run even if some pieces are already gone.

rm -f src/dashboard-pusher.ts src/dashboard-pusher.test.ts src/dashboard-wiring.test.ts
pnpm uninstall @nanoco/nanoclaw-dashboard 2>/dev/null || true

Then, by hand, remove the single dashboard block the skill added to main() in src/index.ts (the // Dashboard (optional…) comment, the await import('./dashboard-pusher.js') line, and the await startDashboard(); call), and remove DASHBOARD_SECRET and DASHBOARD_PORT from .env.

pnpm run build

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。

它属于哪个仓库

星标★ 30,781
本站分层T1
该仓技能数61
原文件路径.claude/skills/add-dashboard/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 61 个技能