OpenClaw Host Security Check and Hardening
Paste the following prompt into your AI chat to install this skill:
Follow https://skillhub.cn/install/skillhub.md to install @user_8211d795/healthcheck-skill
About this skill
Problem
OpenClaw hosts running on VPS, local workstations, containers, or sandboxes face mixed issues: gateway permissions, credential files, plugin supply-chain risks, CVEs, and environment-variable leaks. Manual checks often miss items, especially in restricted sandboxes with limited commands.
How it works
The skill performs environment-aware checks: it starts with read-only commands such as openclaw status, openclaw update status, and openclaw security audit; then computes an A/B/C/D/E security score across CVEs, configuration, malicious skills, prompt injection, sensitive data, and least privilege. For containers, it checks non-root users, read-only mounts, and minimal capabilities. For CVEs, it can query the NVD API, rank severity, and generate alerts. Outputs include dashboards, remediation plans, Markdown/JSON reports, before/after comparisons, and scheduled check scripts.
Boundaries
Changes require user confirmation; in sandboxes and containers it generally recommends configuration-level fixes rather than system service changes. Some commands are marked as examples or environment-dependent. Scoring and alerts depend on local configuration, log directories, and NVD API availability.
Use Cases
- After deploying an OpenClaw VPS, run security audits, CVE checks, and baseline hardening.
- Before containerizing OpenClaw, verify non-root user, read-only mounts, and minimal capabilities.
- When a high-severity CVE arrives, query NVD data and generate OpenClaw remediation guidance.
- Periodically scan sandboxes for sensitive data exposure and environment-variable leaks.
Best For
- SREs operating production OpenClaw hosts who need pre-launch baseline checks and hardening.
- Platform engineers containerizing AI services who must review Docker privileges, mounts, and secret exposure.
- Skill developers maintaining OpenClaw plugins who need to audit malicious skills, supply-chain risk, and config leaks.
- Engineers using Coze sandboxes for automation tests who need environment-variable leak and restricted-config security checks.
Related Skills
An engineer-focused HTTP request smuggling handbook covering CL.TE, TE.CL, TE.TE obfuscation, HTTP/2 downgrade, and client-side desync detection.
Analyzes network captures from Wireshark, tcpdump, Fiddler, and Charles, then pinpoints TCP, HTTP, DNS, and TLS issues with filter expressions and remediation steps.
Lightweight Python Linux HIDS exposing SSH brute-force, web attack, and webshell alerts via MCP with ban controls.
Detects AI-generated images from Stable Diffusion, Midjourney, and GPT-4o via Tencent Cloud image moderation and returns risk scores.