OpenClaw Hardening

Secure an OpenClaw server with host hardening, chainwatch runtime safety, pastewatch secret redaction, and noisepan+entropia news intelligence. Use when sett...

This SKILL.md is coherent with a hardening tool, but it asks you to perform high‑privilege, persistent changes and to install third‑party binaries via curl/untar without integrity checks. Before running these instructions: 1) Review the upstream repositories (ppiankov/chainwatch and pastewatch) and their release artifacts; verify checksums/signatures when available. 2) Avoid piping unknown scripts into sudo — download and inspect them first. 3) Audit the systemd unit and binary contents you will install. 4) Backup configuration and test in a nonproduction instance. 5) Confirm you trust the maintainer and that the tool’s behavior (intercepting all LLM API traffic and accessing local config.env) is acceptable for your environment. 6) Prefer package manager installs or signed releases where possible, and consider limiting scope (non‑root, containerized testing) until you’ve validated behavior.

Type: OpenClaw Skill Name: openclaw-hardening Version: 2.1.0 The skill bundle performs extensive system-level modifications, including SSH hardening, firewall configuration, and the installation of multiple third-party security tools (chainwatch, pastewatch, noisepan) via high-risk methods like 'curl | bash' and direct binary downloads from GitHub (github.com/ppiankov). While these tools are presented as hardening measures, they implement a non-bypassable intercept proxy for LLM traffic and kernel-level monitoring (eBPF), granting the tools significant control over the environment and sensitive API communications. The combination of high-privilege operations and reliance on unverified remote binaries in SKILL.md constitutes a significant security risk despite the stated protective intent.