360 Secure SkillHub
360 安全技能中心

Li Sentry Check

这是一款只读型多平台服务器巡检工具，通过SSH密钥认证登录远程Linux主机，执行预定义只读命令，检查CPU、内存、磁盘等系统指标及服务、安全状态。支持basic/services/daily等检查组，适配nanobot、OpenClaw、Hermes代理。适用于服务器日常巡检、健康核查等场景，输入指定目标与检查组，输出带异常高亮的Markdown/JSON结构化报告，全程无系统修改操作。

43622283
43622283
热度 36.02
最近更新 2026-05-11 17:45:58
分类：数据依赖：代码执行 / 读写文件应用场景：报告撰写 / 数据处理 / 自动化脚本

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add li-sentry-check
Metadata
name
li_sentry_check
description
Multi-platform server inspection and health check skill. SSH into remote Linux servers using key-based authentication, run read-only inspection commands (CPU, memory, disk, network, services, security), and generate structured Markdown reports with anomaly highlighting. Use when the user asks to inspect servers, run health checks, check system metrics, perform 巡检/巡查, gather system status, or generate inspection reports. Compatible with nanobot, OpenClaw, and Hermes agent.

li_sentry_check

Multi-platform server inspection and health check via SSH.

Security Declaration

This skill is strictly read-only and does NOT:

  • ❌ Modify any server configuration
  • ❌ Install or remove software
  • ❌ Restart or stop services
  • ❌ Write to any file on the remote server
  • ❌ Exfiltrate data to external services
  • ❌ Access local files other than: references/targets.yaml, references/checks.yaml, and the SSH private key specified in keyPath
  • ❌ Make any network connections other than SSH to the target server specified in targets.yaml
  • ❌ Execute arbitrary commands — only commands from references/checks.yaml are allowed

This skill ONLY:

  • ✅ Reads system information via predefined read-only commands
  • ✅ Generates a local Markdown/JSON report
  • ✅ Connects to ONE remote server via SSH using the key specified in targets.yaml

Overview

Read-only inspection of remote Linux hosts over SSH using a dedicated key. Collects system metrics, service status, security events, and generates a structured Markdown report with anomaly highlighting.

Platform Support

Platform Script Runtime
OpenClaw scripts/inspect.mjs Node.js 24+
NanoBot scripts/inspect.py Python 3.10+
Hermes scripts/inspect.py Python 3.10+

Safety (Default Deny)

  • Only run commands defined in references/checks.yaml
  • No state-changing commands (no installs, no config edits, no restarts)
  • Only SSH key authentication (no passwords)
  • BatchMode=yes — non-interactive SSH only

Config

  • Targets: references/targets.yaml
  • Allowed checks: references/checks.yaml

How To Run

NanoBot / Hermes (Python)

python3 scripts/inspect.py --target bogon --checks daily

OpenClaw (Node.js)

node scripts/inspect.mjs --target bogon --checks daily

Options

Option Description Default
--target Target name from targets.yaml (required)
--checks Check group: basic, services, daily basic
--format Output format: markdown, json markdown
--output Write report to file instead of stdout stdout

Check Groups

Group Description
basic Hardware resources: CPU, memory, disk, network
services Service status and error logs (from targets.yaml)
daily Full inspection: basic + services + security + logs

Extending

  1. Add target: Edit references/targets.yaml
  2. Add checks: Edit references/checks.yaml
  3. Add check group: Define new group in checks.yaml

SSH Key Setup

# Generate key pair
ssh-keygen -t rsa -b 4096 -f ~/.ssh/li_sentry_check -N ""

# Copy to remote server
ssh-copy-id -i ~/.ssh/li_sentry_check.pub inspector@<SERVER_IP>

# Test connection
ssh -i ~/.ssh/li_sentry_check inspector@<SERVER_IP>

Security Best Practices

  • Key permissions: chmod 600 ~/.ssh/li_sentry_check
  • Host verification: For production, pre-populate known_hosts instead of accept-new
  • Service names: Only alphanumeric, hyphens, underscores allowed (validated before use)
  • Command allowlist: Never modify checks.yaml with state-changing commands
  • Report handling: Reports may contain system data — do not share publicly

Report Output

Reports are generated in Markdown format with:

  • Summary section: Overall health status, anomaly count
  • Anomaly section: ⚠️ Highlighted issues requiring attention
  • Normal section: Collapsible normal check results
  • Details: Full command output for each check

Architecture

li_sentry_check/
├── SKILL.md                  # This file
├── _meta.json                # Skill metadata
├── references/
│   ├── targets.yaml          # Target server configuration
│   └── checks.yaml           # Command allowlist
└── scripts/
    ├── inspect.mjs           # Node.js implementation (OpenClaw)
    └── inspect.py            # Python implementation (NanoBot/Hermes)