/healthcheck

name: healthcheck
description: "Audit/harden OpenClaw hosts: SSH, firewall, updates, exposure, backups, disk encryption, gateway security."

OpenClaw host healthcheck

Goal: assess host risk, run read-only checks, then propose staged hardening without breaking access.

Rules

• Ask before state-changing actions.
• Do not change SSH/firewall/remote access until access path is confirmed.
• Prefer reversible steps and rollback notes.
• Never claim OpenClaw manages OS firewall, SSH, or updates.
• If identity/role unknown, recommend only.
• User choices: numbered list.
• Never print secrets.

Context to infer first

• OS/version, container vs host.
• Privilege level.
• Access path: local, SSH, RDP, tailnet.
• Network exposure: public IP, reverse proxy, tunnel, LAN only.
• OpenClaw gateway status, bind, auth.
• Backup status.
• Disk encryption.
• Automatic security updates.
• Usage mode: personal workstation, local assistant box, remote server, other.

Ask only for missing facts. Simple phrasing preferred.

Read-only checks

Ask once for permission to run read-only checks. Then run relevant commands.

Common:

openclaw security audit --deep
openclaw gateway status --deep
openclaw doctor --lint

`doctor --lint` can exit `1` for findings: read the report and continue the remaining checks. Ordinary `doctor` and `doctor --non-interactive` can copy legacy config and migrate state without `--fix`; reserve repairs for explicit approval. Read-only checks exclude config/service repairs and state migrations, but may produce incidental logs or cache bookkeeping.

macOS:

sw_vers
lsof -nP -iTCP -sTCP:LISTEN
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
pfctl -s info
tmutil status
fdesetup status
softwareupdate --schedule

Linux:

cat /etc/os-release
ss -ltnup || ss -ltnp
ufw status || firewall-cmd --state || nft list ruleset
systemctl status ssh sshd
lsblk -f

Windows:

systeminfo
Get-NetFirewallProfile
Get-BitLockerVolume

Risk profile

After context is known, ask desired posture:

1. Convenience: local/private, minimal prompts. 2. Balanced: secure defaults, low friction. 3. Strict: remote/public/sensitive data, more lock-down.

Report shape

• Current posture: one paragraph.
• Findings: severity + evidence + why it matters.
• Recommended plan: staged, reversible.
• Commands: read-only first; write actions only after approval.
• Gaps: what could not be checked.

Hardening menu

Offer only relevant items:

• Bind gateway to loopback/LAN/tailnet intentionally.
• Require auth for remote access.
• Close public ports or restrict by firewall.
• Enable OS security updates.
• Enable disk encryption.
• Verify backups and restore path.
• Disable password SSH or require keys/MFA where appropriate.
• Add scheduled `openclaw security audit --deep`.

Confirm exact action before applying.