360 Secure SkillHub
360 安全技能中心

ground-control

Ground Control 是面向 OpenClaw 的升级后校验技能：依据运维维护的模型、cron 与通道 ground truth，分五阶段检查配置完整性、供应商可用性、cron 任务、会话冒烟测试与通道连通性，默认只报告；任何配置或 cron 修复都需运维显式批准后执行。敏感配置即时脱敏，不做凭证明文比对或持久化。

jonathanjing
jonathanjing
热度 57.36
最近更新 2026-08-04 00:56:49
分类：自动化依赖：代码执行 / MCP 服务 / 第三方 API应用场景：DevOps / 工作流 / 报告撰写

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add ground-control
Metadata
name
ground-control
description
Verify OpenClaw after upgrades against an operator-maintained model, cron, and channel ground truth. Use for report-only config integrity, provider liveness, cron integrity, session smoke tests, and channel checks; require explicit approval before applying repairs.
metadata
{"openclaw":{"version":"0.3.6","emoji":"🛰️","homepage":"https://clawhub.ai/jonathanjing/ground-control","requires":{"bins":["openclaw"]}}}

ground-control

Post-upgrade verification for OpenClaw. Keeps your system honest after every upgrade.

🛠️ Installation

1. Ask OpenClaw (Recommended)

Tell OpenClaw: "Install the ground-control skill." Installation does not authorize runtime config or cron changes.

2. Manual Installation (CLI)

If you prefer the terminal, run:

openclaw skills install @jonathanjing/ground-control

Permissions & Privileges

This skill requires the following OpenClaw capabilities:

  • gateway config.get — read current config (all phases)
  • gateway config.patch — apply an operator-approved config repair (Phase 1 only)
  • cron list / cron update — verify cron jobs and apply operator-approved repairs (Phase 3)
  • sessions_spawn — smoke test sessions (Phase 2, 4, 5)
  • message send — channel liveness test + summary report (Phase 5)

Change-control behavior: Every run is report-only by default. Present a redacted repair plan and obtain explicit operator approval immediately before any gateway config.patch or cron update.

Security & Redaction: This skill enforces a Zero-Secret Logging protocol.

  • Immediate Redaction: Sensitive nodes (auth, plugins) are stripped from memory after fetching runtime config.
  • Redacted Drift: Mismatches in sensitive fields are reported as [REDACTED_SENSITIVE_MISMATCH].
  • Functional Validation: API keys are tested through functional calls (Phase 2), never through literal comparison.
  • No Persistence: Literal credentials are never written to memory/ files or messaging channels.

Environment variables: None.

When to use

  • After running openclaw update or npm install -g openclaw@latest
  • When you suspect config drift (model changed, cron broken, channel down)
  • Periodic health check via /verify command

Setup

  1. Copy {baseDir}/templates/MODEL_GROUND_TRUTH.md to your workspace root
  2. Fill in your actual config values (models, cron jobs, channels)
  3. (Optional) For large configs, split into refs/ground-truth/*.md sub-files
  4. Add the GROUND_TRUTH sync rule to your AGENTS.md (see README)
  5. Run /verify to test

Files

  • {baseDir}/templates/MODEL_GROUND_TRUTH.md — Ground truth template (copy to workspace root)
  • {baseDir}/scripts/post-upgrade-verify.md — Agent execution prompt for 5-phase verification
  • {baseDir}/scripts/UPGRADE_SOP.md — Upgrade standard operating procedure