Healthcheck
- 3.3k installs
- 385k repo stars
- Updated August 3, 2026
- steipete/clawdis
healthcheck is an agent skill that audits OpenClaw host risk with read-only checks and proposes staged, reversible hardening for SSH, firewall, backups, and gateway security.
About
healthcheck is an agent skill for assessing and hardening machines running OpenClaw. It first infers OS, container vs host, privilege level, access path, network exposure, gateway bind and auth, backups, disk encryption, automatic updates, and usage mode, asking only for missing facts. After permission, it runs read-only checks such as openclaw security audit --deep, openclaw gateway status --deep, openclaw doctor, plus platform commands for listening ports, firewall state, SSH status, encryption, and scheduled updates on macOS, Linux, or Windows. The user then picks a risk posture from convenience, balanced, or strict. Reports summarize current posture, severity-ranked findings with evidence, a staged reversible plan, read-only commands first, and gaps where checks could not run. Hardening menu items cover gateway bind targets, remote auth, closing public ports, OS updates, disk encryption, backup verification, SSH key requirements, and scheduled deep audits. Rules require asking before state-changing actions, never claiming OpenClaw manages OS firewall or SSH, never printing secrets, and confirming exact actions before applying changes.
- Infers host context then runs read-only openclaw security audit, gateway status, and doctor checks.
- Includes macOS, Linux, and Windows command sets for ports, firewall, encryption, and updates.
- Offers convenience, balanced, or strict risk postures before recommending hardening steps.
- Requires approval before state-changing SSH, firewall, or remote access modifications.
- Never prints secrets and never claims OpenClaw manages OS firewall, SSH, or updates.
Healthcheck by the numbers
- 3,315 all-time installs (skills.sh)
- +160 installs in the week ending Aug 2, 2026 (Skillselion tracking)
- Ranked #183 of 2,203 Security skills by installs in the Skillselion catalog
- Security screen: MEDIUM risk (skills.sh audit)
- Data as of Aug 3, 2026 (Skillselion catalog sync)
healthcheck capabilities & compatibility
- Capabilities
- context inference · read only platform checks · risk posture selection · staged hardening recommendations
- Use cases
- security audit · devops
- Platforms
- macOS · Linux · Windows
What healthcheck says it does
Goal: assess host risk, run read-only checks, then propose staged hardening without breaking access.
Ask before state-changing actions.
Never claim OpenClaw manages OS firewall, SSH, or updates.
npx skills add https://github.com/steipete/clawdis --skill healthcheckAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 3.3k |
|---|---|
| repo stars | ★ 385k |
| Security audit | 1 / 3 scanners passed |
| Last updated | August 3, 2026 |
| Repository | steipete/clawdis ↗ |
How exposed is my OpenClaw host across SSH, firewall, backups, disk encryption, and gateway binding, and what reversible hardening steps should I take?
Audit and harden OpenClaw hosts with staged, reversible SSH, firewall, backup, and gateway security checks.
Who is it for?
Operators running OpenClaw on personal workstations, local assistant boxes, or remote servers who need a structured security audit.
Skip if: Skip when you only need application-level debugging without host hardening or lack permission to run read-only system checks.
When should I use this skill?
User asks to audit or harden an OpenClaw host, review SSH and firewall exposure, or run openclaw security audit workflows.
What you get
A severity-ranked posture report with evidence, staged hardening recommendations, and approved commands applied only after explicit confirmation.
- Security audit findings
- Numbered hardening recommendation list
- Rollback notes for proposed changes
Files
OpenClaw host healthcheck
Goal: assess host risk, run read-only checks, then propose staged hardening without breaking access.
Rules
- Ask before state-changing actions.
- Do not change SSH/firewall/remote access until access path is confirmed.
- Prefer reversible steps and rollback notes.
- Never claim OpenClaw manages OS firewall, SSH, or updates.
- If identity/role unknown, recommend only.
- User choices: numbered list.
- Never print secrets.
Context to infer first
- OS/version, container vs host.
- Privilege level.
- Access path: local, SSH, RDP, tailnet.
- Network exposure: public IP, reverse proxy, tunnel, LAN only.
- OpenClaw gateway status, bind, auth.
- Backup status.
- Disk encryption.
- Automatic security updates.
- Usage mode: personal workstation, local assistant box, remote server, other.
Ask only for missing facts. Simple phrasing preferred.
Read-only checks
Ask once for permission to run read-only checks. Then run relevant commands.
Common:
openclaw security audit --deep
openclaw gateway status --deep
openclaw doctormacOS:
sw_vers
lsof -nP -iTCP -sTCP:LISTEN
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
pfctl -s info
tmutil status
fdesetup status
softwareupdate --scheduleLinux:
cat /etc/os-release
ss -ltnup || ss -ltnp
ufw status || firewall-cmd --state || nft list ruleset
systemctl status ssh sshd
lsblk -fWindows:
systeminfo
Get-NetFirewallProfile
Get-BitLockerVolumeRisk profile
After context is known, ask desired posture:
1. Convenience: local/private, minimal prompts. 2. Balanced: secure defaults, low friction. 3. Strict: remote/public/sensitive data, more lock-down.
Report shape
- Current posture: one paragraph.
- Findings: severity + evidence + why it matters.
- Recommended plan: staged, reversible.
- Commands: read-only first; write actions only after approval.
- Gaps: what could not be checked.
Hardening menu
Offer only relevant items:
- Bind gateway to loopback/LAN/tailnet intentionally.
- Require auth for remote access.
- Close public ports or restrict by firewall.
- Enable OS security updates.
- Enable disk encryption.
- Verify backups and restore path.
- Disable password SSH or require keys/MFA where appropriate.
- Add scheduled
openclaw security audit --deep.
Confirm exact action before applying.
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85FAQ
Which OpenClaw commands run during read-only checks?
openclaw security audit --deep, openclaw gateway status --deep, and openclaw doctor, plus platform port and firewall commands.
When can the skill change SSH or firewall settings?
Only after access path is confirmed, the user approves, and the exact reversible action is confirmed before applying.
Is Healthcheck safe to install?
skills.sh reports 1 of 3 security scanners passed. Review the Security Audits panel on this page before installing in production.