healthcheck
openclaw/openclaw
Audit and harden OpenClaw hosts: SSH, firewall, updates, encryption, backups, and gateway security.
What is healthcheck?
Assess host risk and propose staged hardening for OpenClaw deployments. Runs read-only security checks to identify exposure, then recommends reversible improvements to SSH, firewall, updates, disk encryption, backups, and gateway configuration without breaking access.
- Audits OS and OpenClaw security posture with read-only checks
- Identifies SSH, firewall, network exposure, and backup risks
- Proposes staged, reversible hardening steps with rollback notes
- Adapts recommendations to usage mode: workstation, local box, remote server
- Confirms exact actions before applying state changes
- Checks disk encryption, automatic updates, and gateway authentication status
How to install healthcheck
npx skills add https://github.com/openclaw/openclaw --skill healthcheck- OpenClaw installed and accessible
- Sufficient privilege to run audit commands (read-only checks may require sudo/admin)
- Access to the host via local, SSH, RDP, or tailnet connection
How to use healthcheck
- 1.Run the skill and provide context: OS, privilege level, access path, and network exposure
- 2.Choose desired security posture: Convenience, Balanced, or Strict
- 3.Approve read-only checks to gather current state
- 4.Review the risk report and recommended hardening plan
- 5.Select and confirm each hardening action before it is applied
- 6.Monitor logs and test access paths after changes
Use cases
- Harden a newly deployed OpenClaw host before production use
- Audit an existing remote server for security gaps and exposure
- Verify backup and disk encryption status on a local assistant box
- Restrict gateway access to loopback or tailnet after initial setup
- Enable SSH key-only auth and OS security updates with staged rollout
- System administrators managing OpenClaw deployments
- DevOps engineers hardening remote servers
- Security-conscious users securing local or remote OpenClaw instances
- Teams deploying OpenClaw in sensitive or public environments
healthcheck FAQ
No. The skill asks for permission before any state-changing actions and confirms exact commands before applying them. Read-only checks run first to assess risk.
No. The skill audits and recommends hardening steps, but you or your OS manage SSH, firewall, and updates. The skill guides you through safe, reversible changes.
The skill asks only for missing facts using simple phrasing. It will infer context from your answers and recommend only actions appropriate to your role and environment.
Yes. The skill prefers reversible steps and provides rollback notes for each recommendation so you can undo changes if needed.
Yes. The skill runs OS-specific read-only checks (firewall status, disk encryption, updates, SSH) and adapts recommendations to your platform.
Full instructions (SKILL.md)
Source of truth, from openclaw/openclaw.
name: healthcheck description: "Audit/harden OpenClaw hosts: SSH, firewall, updates, exposure, backups, disk encryption, gateway security."
OpenClaw host healthcheck
Goal: assess host risk, run read-only checks, then propose staged hardening without breaking access.
Rules
- Ask before state-changing actions.
- Do not change SSH/firewall/remote access until access path is confirmed.
- Prefer reversible steps and rollback notes.
- Never claim OpenClaw manages OS firewall, SSH, or updates.
- If identity/role unknown, recommend only.
- User choices: numbered list.
- Never print secrets.
Context to infer first
- OS/version, container vs host.
- Privilege level.
- Access path: local, SSH, RDP, tailnet.
- Network exposure: public IP, reverse proxy, tunnel, LAN only.
- OpenClaw gateway status, bind, auth.
- Backup status.
- Disk encryption.
- Automatic security updates.
- Usage mode: personal workstation, local assistant box, remote server, other.
Ask only for missing facts. Simple phrasing preferred.
Read-only checks
Ask once for permission to run read-only checks. Then run relevant commands.
Common:
openclaw security audit --deep
openclaw gateway status --deep
openclaw doctor --lint
doctor --lint can exit 1 for findings: read the report and continue the remaining checks. Ordinary doctor and doctor --non-interactive can copy legacy config and migrate state without --fix; reserve repairs for explicit approval. Read-only checks exclude config/service repairs and state migrations, but may produce incidental logs or cache bookkeeping.
macOS:
sw_vers
lsof -nP -iTCP -sTCP:LISTEN
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
pfctl -s info
tmutil status
fdesetup status
softwareupdate --schedule
Linux:
cat /etc/os-release
ss -ltnup || ss -ltnp
ufw status || firewall-cmd --state || nft list ruleset
systemctl status ssh sshd
lsblk -f
Windows:
systeminfo
Get-NetFirewallProfile
Get-BitLockerVolume
Risk profile
After context is known, ask desired posture:
- Convenience: local/private, minimal prompts.
- Balanced: secure defaults, low friction.
- Strict: remote/public/sensitive data, more lock-down.
Report shape
- Current posture: one paragraph.
- Findings: severity + evidence + why it matters.
- Recommended plan: staged, reversible.
- Commands: read-only first; write actions only after approval.
- Gaps: what could not be checked.
Hardening menu
Offer only relevant items:
- Bind gateway to loopback/LAN/tailnet intentionally.
- Require auth for remote access.
- Close public ports or restrict by firewall.
- Enable OS security updates.
- Enable disk encryption.
- Verify backups and restore path.
- Disable password SSH or require keys/MFA where appropriate.
- Add scheduled
openclaw security audit --deep.
Confirm exact action before applying.
Related skills
More from openclaw/openclaw and the wider catalog.
himalaya
CLI for IMAP/SMTP email operations: list, read, search, compose, reply, forward, organize.
imsg
Send iMessages, SMS, and manage group chats from OpenClaw agents using the imsg CLI.
mcporter
List, configure, authenticate, call, and inspect MCP servers/tools over HTTP or stdio.
model-usage
Summarize CodexBar local cost logs by model for Codex or Claude usage tracking.
nano-pdf
Edit PDFs with natural-language instructions via CLI.
notion
Official Notion CLI for pages, databases, files, search, and raw API calls.