healthcheck

Audit/harden OpenClaw hosts: SSH, firewall, updates, exposure, backups, disk encryption, gateway security.

← IdentitàDi default (OpenClaw)v—sola lettura

da chi viene · l'abbiamo controllata

❔ da accertare
⚪ mai vettata — nessuno l'ha ancora guardata; non vuol dire che sia a posto

dove sta

C:\Users\Ettore\AppData\Roaming\npm\node_modules\openclaw\skills\healthcheck\SKILL.md

C:\Users\Ettore\AppData\Roaming\npm\node_modules\openclaw\skills\healthcheck

SKILL.md

name: healthcheck
description: "Audit/harden OpenClaw hosts: SSH, firewall, updates, exposure, backups, disk encryption, gateway security."

OpenClaw host healthcheck

Goal: assess host risk, run read-only checks, then propose staged hardening without breaking access.

Rules

Ask before state-changing actions.
Do not change SSH/firewall/remote access until access path is confirmed.
Prefer reversible steps and rollback notes.
Never claim OpenClaw manages OS firewall, SSH, or updates.
If identity/role unknown, recommend only.
User choices: numbered list.
Never print secrets.

Context to infer first

OS/version, container vs host.
Privilege level.
Access path: local, SSH, RDP, tailnet.
Network exposure: public IP, reverse proxy, tunnel, LAN only.
OpenClaw gateway status, bind, auth.
Backup status.
Disk encryption.
Automatic security updates.
Usage mode: personal workstation, local assistant box, remote server, other.

Ask only for missing facts. Simple phrasing preferred.

Read-only checks

Ask once for permission to run read-only checks. Then run relevant commands.

Common:

openclaw security audit --deep
openclaw gateway status --deep
openclaw doctor

macOS:

sw_vers
lsof -nP -iTCP -sTCP:LISTEN
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
pfctl -s info
tmutil status
fdesetup status
softwareupdate --schedule

Linux:

cat /etc/os-release
ss -ltnup || ss -ltnp
ufw status || firewall-cmd --state || nft list ruleset
systemctl status ssh sshd
lsblk -f

Windows:

systeminfo
Get-NetFirewallProfile
Get-BitLockerVolume

Risk profile

After context is known, ask desired posture:

Convenience: local/private, minimal prompts.
Balanced: secure defaults, low friction.
Strict: remote/public/sensitive data, more lock-down.

Report shape

Current posture: one paragraph.
Findings: severity + evidence + why it matters.
Recommended plan: staged, reversible.
Commands: read-only first; write actions only after approval.
Gaps: what could not be checked.

Hardening menu

Offer only relevant items:

Bind gateway to loopback/LAN/tailnet intentionally.
Require auth for remote access.
Close public ports or restrict by firewall.
Enable OS security updates.
Enable disk encryption.
Verify backups and restore path.
Disable password SSH or require keys/MFA where appropriate.
Add scheduled openclaw security audit --deep.

Confirm exact action before applying.

peso

1032token · Opus 52537 caratteri

Conteggio esatto dall'endpoint Anthropic count_tokens (gratuito, solo rate-limited), envelope del messaggio già sottratto. I caratteri sono un dato locale, servono da riscontro.

modifica

Questa skill è in sola lettura: sono file del pacchetto npm: un aggiornamento di openclaw le riscrive. Per lavorarci sopra si copia la cartella nello workspace di un agente e si modifica lì.

file accessori · 1

SKILL.md2.5 kB

storico · 0 backup

nessuna modifica fatta da qui: nessun backup

commit sul file

questo workspace non è un repo git

Scrittura consentita solo dentro le cartelle skills\ dei workspace del registro e solo sul file SKILL.md (deroga alla stanza Identità autorizzata da Ettore il 2026-08-10). Ogni salvataggio crea prima un backup datato; nessun file viene mai cancellato.