name: security-network-hardening description: Audit and harden an OpenClaw host and its network exposure. Use for security checks, hardening, firewall setup, network exposure review, metrics endpoint restriction, OpenClaw gateway security fixes, or step-by-step remediation on a Linux host running OpenClaw.

Security + Network Hardening

Audit first, then harden with explicit approval. Keep this file short; read the references when needed.

Core rules

• Start read-only unless the user explicitly asks for fixes.
• Require confirmation before any state-changing action.
• Preserve current management access; do not break SSH/RDP/VNC.
• Prefer exact findings over generic advice.
• After workspace edits, commit them.

Read-only baseline

Run:

uname -a
cat /etc/os-release
id
ss -ltnup 2>/dev/null || ss -ltnp 2>/dev/null
openclaw security audit --deep
openclaw update status
openclaw status --deep

If firewall state matters, also run:

ufw status verbose || true
firewall-cmd --state 2>/dev/null || true
nft list ruleset 2>/dev/null || true

Priorities

Check for these first: 1. elevated wildcard access in tools.elevated.allowFrom.* 2. writable credentials directories 3. missing gateway auth rate limiting 4. broad or unclear listening ports 5. metrics endpoints exposed too widely 6. ineffective custom gateway.nodes.denyCommands 7. workspace skill symlink escapes

Fix patterns

Read these only when relevant: - UFW/firewall workflow: references/ufw-playbook.md - OpenClaw config fixes: references/openclaw-fix-patterns.md

Artifact generation

When the user wants generated files, create: - firewall-rules.md - apply-firewall.sh - scripts/rollback-firewall.sh - scripts/verify-firewall.sh

Safe firewall order

1. Confirm allowed source subnet/IPs.
2. Add SSH rule first if SSH is in use.

   7w4.net小蔥技能站收錄全網優質技能，值得收藏。

3. Apply LAN-only and single-host rules.
4. Verify from expected clients.
5. Re-check ufw status verbose and ss -ltnp.

Verification

After fixes, verify with:

openclaw security audit --deep
openclaw gateway status
python3 -m json.tool ~/.openclaw/openclaw.json >/dev/null
sudo ufw status verbose
ss -ltnp

Success means: - no critical audit findings - no warning audit findings when practical - gateway reachable - required ports reachable only from approved sources

質量較好。這個 Skill 把安全審計和防火牆加固的流程梳理得很清晰，核心規則設計合理，文件結構簡潔易讀，指令碼工具也比較實用。不過缺少使用示例，對新手不太友好，遇到複雜問題可能不太好找到具體答案。整體來說是個靠譜的安全加固工具，適合有經驗的使用者使用。