← 返回 Skills 市场

Security Network Hardening

Name: Security Network Hardening
Author: jimpang8

作者 jimpang8 · GitHub ↗ · v1.0.0 · MIT-0

cross-platform ✓ 安全检测通过

449

总下载

当前安装

版本数

在 OpenClaw 中安装

/install security-network-hardening

功能描述

Audit and harden an OpenClaw host and its network exposure. Use for security checks, hardening, firewall setup, network exposure review, metrics endpoint res...

使用说明 (SKILL.md)

Security + Network Hardening

Audit first, then harden with explicit approval. Keep this file short; read the references when needed.

Core rules

Start read-only unless the user explicitly asks for fixes.
Require confirmation before any state-changing action.
Preserve current management access; do not break SSH/RDP/VNC.
Prefer exact findings over generic advice.
After workspace edits, commit them.

Read-only baseline

Run:

uname -a
cat /etc/os-release
id
ss -ltnup 2>/dev/null || ss -ltnp 2>/dev/null
openclaw security audit --deep
openclaw update status
openclaw status --deep

If firewall state matters, also run:

ufw status verbose || true
firewall-cmd --state 2>/dev/null || true
nft list ruleset 2>/dev/null || true

Priorities

Check for these first:

elevated wildcard access in tools.elevated.allowFrom.*
writable credentials directories
missing gateway auth rate limiting
broad or unclear listening ports
metrics endpoints exposed too widely
ineffective custom gateway.nodes.denyCommands
workspace skill symlink escapes

Fix patterns

Read these only when relevant:

UFW/firewall workflow: references/ufw-playbook.md
OpenClaw config fixes: references/openclaw-fix-patterns.md

Artifact generation

When the user wants generated files, create:

firewall-rules.md
apply-firewall.sh
scripts/rollback-firewall.sh
scripts/verify-firewall.sh

Safe firewall order

Confirm allowed source subnet/IPs.
Add SSH rule first if SSH is in use.
Apply LAN-only and single-host rules.
Verify from expected clients.
Re-check ufw status verbose and ss -ltnp.

Verification

After fixes, verify with:

openclaw security audit --deep
openclaw gateway status
python3 -m json.tool ~/.openclaw/openclaw.json >/dev/null
sudo ufw status verbose
ss -ltnp

Success means:

no critical audit findings
no warning audit findings when practical
gateway reachable
required ports reachable only from approved sources

安全使用建议

This skill appears coherent and focused on hardening OpenClaw hosts. Before using it: (1) Run the suggested read-only audit commands first and review results. (2) Ensure the host has the tools the skill assumes (openclaw, ufw or nftables, ss, python3, sudo) since the manifest doesn't declare them. (3) Back up current firewall rules and configs (the provided rollback script expects backups in /etc/ufw/*.TIMESTAMP). (4) When applying changes, confirm the exact SSH/RDP management path to avoid locking yourself out. (5) Inspect the small scripts yourself (they are included) and test verification/rollback on a safe host or snapshot before applying to production.

功能分析

Type: OpenClaw Skill Name: security-network-hardening Version: 1.0.0 The skill bundle is designed for security auditing and hardening of an OpenClaw host. It includes instructions for the agent to perform read-only audits, verify firewall states, and apply hardening fixes (such as restricting file permissions and configuring UFW) only with explicit user confirmation, with no evidence of malicious intent or data exfiltration.

能力评估

ℹ Purpose & Capability

The name/description (OpenClaw host/network hardening) align with the included SKILL.md, references, and scripts. The only mismatch is that the manifest lists no required binaries, yet the instructions and scripts expect commands like openclaw, ufw, ss, sudo, python3, and possibly firewall-cmd/nft; this is a declaration omission but not evidence of malicious intent.

✓ Instruction Scope

SKILL.md stays on-topic: it instructs read-only audits first, explicit confirmation before changes, firewall playbooks, and verification steps. It references and reads OpenClaw config (~/.openclaw/openclaw.json) which is appropriate for this purpose. It does not instruct phone-home, exfiltration, or scanning unrelated user data.

✓ Install Mechanism

No install spec (instruction-only) and included scripts are small and straightforward. No downloads or archive extraction are present.

✓ Credentials

The skill requests no environment variables or external credentials. It does operate on local config (OpenClaw JSON) and requires root privileges to apply firewall changes; that is proportional to a firewall-hardening task.

✓ Persistence & Privilege

always is false, the skill does not request persistent or privileged platform-level presence, and it does not modify other skills' configs. Scripts modify system firewall files only when the user runs them with sudo.

如何使用

确保已安装 OpenClaw（本地或 Docker 部署）
在对话框中输入安装命令：/install security-network-hardening
安装完成后，直接呼叫该 Skill 的名称或使用 /security-network-hardening 触发
根据 Skill 的参数说明提供必要输入，即可获得结构化输出

版本历史

v1.0.0

Initial release: OpenClaw security audit, firewall hardening, references, rollback and verify scripts.

元数据

Slug security-network-hardening

版本 1.0.0

许可证 MIT-0

累计安装 3

当前安装数 2

历史版本数 1

常见问题