mcpField
H
healthcheck

healthcheck

github.com/openclawSecurity393.3k5.6k installsUpdated today
Repository

About healthcheck

An OpenClaw host healthcheck skill that assesses risks with read-only checks, then proposes staged, reversible hardening. It is for users reviewing host and gateway security before making changes.

Key features

  1. 01Gather host and network context
  2. 02Run read-only security checks
  3. 03Report findings by severity
  4. 04Plan staged hardening steps
  5. 05Require approval before changes

Use cases

  1. 01Review host and gateway security posture
  2. 02Assess remote access and network exposure
  3. 03Plan reversible security improvements

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/openclaw/openclaw --skill healthcheck

After installing, type/healthcheckin Claude Code to confirm it loaded.

Details

From the project README

OpenClaw host healthcheck

Goal: assess host risk, run read-only checks, then propose staged hardening without breaking access.

Rules

  • Ask before state-changing actions.
  • Do not change SSH/firewall/remote access until access path is confirmed.
  • Prefer reversible steps and rollback notes.
  • Never claim OpenClaw manages OS firewall, SSH, or updates.
  • If identity/role unknown, recommend only.
  • User choices: numbered list.
  • Never print secrets.

Context to infer first

  • OS/version, container vs host.
  • Privilege level.
  • Access path: local, SSH, RDP, tailnet.
  • Network exposure: public IP, reverse proxy, tunnel, LAN only.
  • OpenClaw gateway status, bind, auth.
  • Backup status.
  • Disk encryption.
  • Automatic security updates.
  • Usage mode: personal workstation, local assistant box, remote server, other.

Ask only for missing facts. Simple phrasing preferred.

Read-only checks

Ask once for permission to run read-only checks. Then run relevant commands.

Common:

openclaw security audit --deep
openclaw gateway status --deep
openclaw doctor --lint

doctor --lint can exit 1 for findings: read the report and continue the remaining checks. Ordinary doctor and doctor --non-interactive can copy legacy config and migrate state without --fix; reserve repairs for explicit approval. Read-only checks exclude config/service repairs and state migrations, but may produce incidental logs or cache bookkeeping.

macOS:

sw_vers
lsof -nP -iTCP -sTCP:LISTEN
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
pfctl -s info
tmutil status
fdesetup status
softwareupdate --schedule

Linux:

cat /etc/os-release
ss -ltnup || ss -ltnp
ufw status || firewall-cmd --state || nft list ruleset
systemctl status ssh sshd
lsblk -f

Windows:

systeminfo
Get-NetFirewallProfile
Get-BitLockerVolume

Risk profile

After context is known, ask desired posture:

  1. Convenience: local/private, minimal prompts.
  2. Balanced: secure defaults, low friction.
  3. Strict: remote/public/sensitive data, more lock-down.

Report shape

  • Current posture: one paragraph.
  • Findings: severity + evidence + why it matters.
  • Recommended plan: staged, reversible.
  • Commands: read-only first; write actions only after approval.
  • Gaps: what could not be checked.

Hardening menu

Offer only relevant items:

  • Bind gateway to loopback/LAN/tailnet intentionally.
  • Require auth for remote access.
  • Close public ports or restrict by firewall.
  • Enable OS security updates.
  • Enable disk encryption.
  • Verify backups and restore path.
  • Disable password SSH or require keys/MFA where appropriate.
  • Add scheduled openclaw security audit --deep.

Confirm exact action before applying.

Comments

Markdown supported