Security + Network Hardening

Audit first, then harden with explicit approval. Keep this file short; read the references when needed.

Core rules

• Start read-only unless the user explicitly asks for fixes.
• Require confirmation before any state-changing action.
• Preserve current management access; do not break SSH/RDP/VNC.
• Prefer exact findings over generic advice.
• After workspace edits, commit them.

Read-only baseline

Run:

uname -a
cat /etc/os-release
id
ss -ltnup 2>/dev/null || ss -ltnp 2>/dev/null
openclaw security audit --deep
openclaw update status
openclaw status --deep

If firewall state matters, also run:

ufw status verbose || true
firewall-cmd --state 2>/dev/null || true
nft list ruleset 2>/dev/null || true

Priorities

Check for these first:

1. elevated wildcard access in tools.elevated.allowFrom.*
2. writable credentials directories
3. missing gateway auth rate limiting
4. broad or unclear listening ports
5. metrics endpoints exposed too widely
6. ineffective custom gateway.nodes.denyCommands
7. workspace skill symlink escapes

Fix patterns

Read these only when relevant:

• UFW/firewall workflow: references/ufw-playbook.md
• OpenClaw config fixes: references/openclaw-fix-patterns.md

Artifact generation

When the user wants generated files, create:

• firewall-rules.md
• apply-firewall.sh
• scripts/rollback-firewall.sh
• scripts/verify-firewall.sh

Safe firewall order

1. Confirm allowed source subnet/IPs.
2. Add SSH rule first if SSH is in use.
3. Apply LAN-only and single-host rules.
4. Verify from expected clients.
5. Re-check ufw status verbose and ss -ltnp.

Verification

After fixes, verify with:

openclaw security audit --deep
openclaw gateway status
python3 -m json.tool ~/.openclaw/openclaw.json >/dev/null
sudo ufw status verbose
ss -ltnp

Success means:

• no critical audit findings
• no warning audit findings when practical
• gateway reachable

  發現更多技能外掛，請訪問7w4.net。

• required ports reachable only from approved sources

質量較好。這個 Skill 把安全審計和防火牆加固的流程梳理得很清晰，核心規則設計合理，文件結構簡潔易讀，指令碼工具也比較實用。不過缺少使用示例，對新手不太友好，遇到複雜問題可能不太好找到具體答案。整體來說是個靠譜的安全加固工具，適合有經驗的使用者使用。