360 Secure SkillHub
360 安全技能中心

OpenClaw VPS Security Preflight

只读 OpenClaw VPS 安全预检：确认目标为已授权 Linux 主机后运行捆绑脚本，检查网关暴露、认证、RPC 健康、服务监管、防火墙与 SSH 配置、安全更新、时间同步、备份与回滚就绪，汇总 PASS/WARN/FAIL/INFO；不修改配置，修复需人工批准，并限制输出敏感信息、不自动安装。

tinyopsstudio
tinyopsstudio
热度 15.15
最近更新 2026-07-20 01:05:06
分类：安全依赖：代码执行 / 读写文件应用场景：DevOps / 自动化脚本 / 报告撰写

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add vps-security-preflight
Metadata
name
openclaw-vps-security-preflight
description
Run and interpret a read-only OpenClaw security preflight on an authorized Linux VPS. Use when an operator asks to audit gateway exposure, authentication, RPC health, service supervision, firewall and SSH posture, security updates, time sync, backup readiness, rollback readiness, or deployment acceptance before connecting real accounts or data.

OpenClaw VPS Security Preflight

Use the bundled audit script instead of recreating host checks. It reads local state, runs official OpenClaw status and security commands, and makes no configuration changes.

Workflow

  1. Confirm the target is an authorized Linux VPS. If authorization is unclear, ask before running checks.

  2. Run the default audit:

    bash <skill-directory>/scripts/openclaw-vps-preflight.sh

  3. For a deployment acceptance or CI check, run strict mode:

    NO_COLOR=1 bash <skill-directory>/scripts/openclaw-vps-preflight.sh --strict

  4. Report the summary counts and every non-pass result. Prioritize failures, then warnings, then informational checks that still need manual evidence.

  5. Recommend the smallest reversible remediation for each issue. Get explicit approval before changing configuration, installing packages, opening ports, restarting services, or modifying authentication.

Output Safety

  • Never print gateway tokens, passwords, private keys, environment values, or full configuration files.
  • Do not use --show-audit unless the operator explicitly requests raw deep-audit output. Review and redact that output before sharing it.
  • Do not upload audit output, add telemetry, or send host details to an external service.
  • Do not weaken authentication, expose the Gateway publicly, or change firewall rules as part of the audit.
  • Do not install or update OpenClaw automatically when the CLI is missing or incompatible.

Interpretation

  • PASS: the narrow check succeeded. It is not proof of whole-system security.
  • WARN: review or manual verification is required before production use.
  • FAIL: treat as a release blocker until remediated or explicitly accepted by the operator.
  • INFO: the script cannot verify this control automatically; request operating evidence.
  • --strict: returns nonzero when any warning or failure exists.

Limits

This is a conservative preflight for one trusted operator, not a penetration test, certification, warranty, or guarantee. Backup freshness, restore tests, provider spend limits, and rollback evidence remain manual controls. Compare recommendations with the current OpenClaw security documentation.

The source and issue tracker are in the TinyOps preflight repository. Optional operator resources are the free browser checklist, the $29 editable deployment kit, and the $450 fixed-scope setup service. These are not required to run the bundled audit.