healthcheck
steipete/clawdis
Audit and harden OpenClaw hosts: SSH, firewall, updates, encryption, backups, and gateway security.
What is healthcheck?
Assesses host security posture through read-only checks, then proposes staged, reversible hardening steps. Use this to identify and fix configuration gaps in SSH, firewall rules, OS updates, disk encryption, backups, and OpenClaw gateway exposure without breaking existing access.
- Runs read-only security audits on OpenClaw hosts and OS configuration
- Detects SSH, firewall, update, encryption, and backup status across Linux, macOS, and Windows
- Profiles network exposure: public IP, reverse proxy, tunnel, or LAN-only
- Assesses OpenClaw gateway binding, authentication, and access paths
- Proposes staged, reversible hardening actions with rollback notes
- Offers risk postures (Convenience, Balanced, Strict) matched to usage mode
How to install healthcheck
npx skills add https://github.com/steipete/clawdis --skill healthcheckHow to use healthcheck
- 1.Answer initial context questions: OS, privilege level, access path, network exposure, and usage mode
- 2.Grant permission to run read-only security checks
- 3.Review the current posture report and findings with severity levels
- 4.Select desired risk posture: Convenience, Balanced, or Strict
- 5.Choose hardening actions from the staged menu
- 6.Confirm exact commands before applying state-changing actions
- 7.Monitor and verify changes; use rollback notes if needed
Use cases
- Harden a newly deployed OpenClaw host before exposing to remote access
- Audit an existing server to close SSH or firewall gaps without downtime
- Verify backup and disk encryption status before storing sensitive data
- Assess and restrict OpenClaw gateway exposure on a shared network
- Plan security updates and MFA rollout with staged, reversible steps
- System administrators managing OpenClaw deployments
- DevOps engineers hardening remote servers
- Security-conscious users securing personal or team workstations
- Teams moving from local to remote or public-facing OpenClaw instances
healthcheck FAQ
No. It only runs read-only checks first. Any state-changing action requires your explicit confirmation of the exact command.
The skill will ask only for missing facts in simple terms. It will recommend read-only checks first and defer write actions until context is clear.
Both. The skill detects your usage mode (personal workstation, local assistant box, remote server, etc.) and tailors checks and recommendations accordingly.
The report includes a Gaps section listing what could not be checked. You can investigate those manually or provide additional context.
It audits both OpenClaw (gateway, security audit, doctor) and the underlying OS (SSH, firewall, updates, encryption, backups). It never claims to manage OS-level features—only to assess and recommend.
Full instructions (SKILL.md)
Source of truth, from steipete/clawdis.
name: healthcheck description: "Audit/harden OpenClaw hosts: SSH, firewall, updates, exposure, backups, disk encryption, gateway security."
OpenClaw host healthcheck
Goal: assess host risk, run read-only checks, then propose staged hardening without breaking access.
Rules
- Ask before state-changing actions.
- Do not change SSH/firewall/remote access until access path is confirmed.
- Prefer reversible steps and rollback notes.
- Never claim OpenClaw manages OS firewall, SSH, or updates.
- If identity/role unknown, recommend only.
- User choices: numbered list.
- Never print secrets.
Context to infer first
- OS/version, container vs host.
- Privilege level.
- Access path: local, SSH, RDP, tailnet.
- Network exposure: public IP, reverse proxy, tunnel, LAN only.
- OpenClaw gateway status, bind, auth.
- Backup status.
- Disk encryption.
- Automatic security updates.
- Usage mode: personal workstation, local assistant box, remote server, other.
Ask only for missing facts. Simple phrasing preferred.
Read-only checks
Ask once for permission to run read-only checks. Then run relevant commands.
Common:
openclaw security audit --deep
openclaw gateway status --deep
openclaw doctor
macOS:
sw_vers
lsof -nP -iTCP -sTCP:LISTEN
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
pfctl -s info
tmutil status
fdesetup status
softwareupdate --schedule
Linux:
cat /etc/os-release
ss -ltnup || ss -ltnp
ufw status || firewall-cmd --state || nft list ruleset
systemctl status ssh sshd
lsblk -f
Windows:
systeminfo
Get-NetFirewallProfile
Get-BitLockerVolume
Risk profile
After context is known, ask desired posture:
- Convenience: local/private, minimal prompts.
- Balanced: secure defaults, low friction.
- Strict: remote/public/sensitive data, more lock-down.
Report shape
- Current posture: one paragraph.
- Findings: severity + evidence + why it matters.
- Recommended plan: staged, reversible.
- Commands: read-only first; write actions only after approval.
- Gaps: what could not be checked.
Hardening menu
Offer only relevant items:
- Bind gateway to loopback/LAN/tailnet intentionally.
- Require auth for remote access.
- Close public ports or restrict by firewall.
- Enable OS security updates.
- Enable disk encryption.
- Verify backups and restore path.
- Disable password SSH or require keys/MFA where appropriate.
- Add scheduled
openclaw security audit --deep.
Confirm exact action before applying.
Related skills
More from steipete/clawdis and the wider catalog.
himalaya
IMAP/SMTP email CLI for listing, reading, searching, composing, and organizing messages from the shell.
imsg
iMessage/SMS CLI for listing chats, history, and sending messages via Messages.app
mcporter
List, configure, and call MCP servers/tools via HTTP or stdio with mcporter.
model-usage
Summarize CodexBar local cost logs by model for Codex or Claude usage tracking.
nano-pdf
Edit PDFs with natural-language instructions via CLI.
notion
Notion CLI/API for pages, Markdown content, data sources, files, comments, search, Workers, and raw API calls.