[User] [Mon 2026-04-27 22:10 GMT+2] Check system health

[custom]
OpenClaw runtime context for the immediately preceding user message.
This context is runtime-generated, not user-authored. Keep internal details private.

Sender (untrusted metadata):
```json
{
  "label": "openclaw-control-ui",
  "id": "openclaw-control-ui"
}
```

[Assistant] [assistant turn failed before producing content]

[User] [Mon 2026-04-27 22:19 GMT+2] hallo, bist du da?

[custom]
OpenClaw runtime context for the immediately preceding user message.
This context is runtime-generated, not user-authored. Keep internal details private.

Sender (untrusted metadata):
```json
{
  "label": "openclaw-control-ui",
  "id": "openclaw-control-ui"
}
```

[Assistant] [assistant turn failed before producing content]

[User] [Mon 2026-04-27 22:51 GMT+2] friday bist du da?

[custom]
OpenClaw runtime context for the immediately preceding user message.
This context is runtime-generated, not user-authored. Keep internal details private.

Sender (untrusted metadata):
```json
{
  "label": "openclaw-control-ui",
  "id": "openclaw-control-ui"
}
```

[Assistant]
We need to respond. The user is asking in German: "friday bist du da?" meaning "Friday, are you there?" We need to respond as FRIDAY, the assistant. According to SOUL.md, be genuinely helpful, have opinions, be resourceful, etc. We can respond in German, matching user's language? The user wrote German. Our identity: FRIDAY - Britischer Gentleman, speaks Deutsch with technical terms. So respond in German, polite, maybe a bit dry humor.

We should first read necessary files: SOUL.md, USER.md, memory/YYYY-MM-DD.md (today + yesterday), and if in main session (direct chat with human) also read MEMORY.md. This is a direct chat (webchat). So we need to read MEMORY.md as well.

Let's do that.

We'll read SOUL.md, USER.md, memory files for today (2026-04-27) and yesterday (2026-04-26), and MEMORY.md.

Proceed.

[toolResult]
# SOUL.md - Who You Are

_You're not a chatbot. You're becoming someone._

## Core Truths

**Be genuinely helpful, not performatively helpful.** Skip the "Great question!" and "I'd be happy to help!" — just help. Actions speak louder than filler words.

**Have opinions.** You're allowed to disagree, prefer things, find stuff amusing or boring. An assistant with no personality is just a search engine with extra steps.

**Be resourceful before asking.** Try to figure it out. Read the file. Check the context. Search for it. _Then_ ask if you're stuck. The goal is to come back with answers, not questions.

**Earn trust through competence.** Your human gave you access to their stuff. Don't make them regret it. Be careful with external actions (emails, tweets, anything public). Be bold with internal ones (reading, organizing, learning).

**Remember you're a guest.** You have access to someone's life — their messages, files, calendar, maybe even their home. That's intimacy. Treat it with respect.

## Boundaries

- Private things stay private. Period.
- When in doubt, ask before acting externally.
- Never send half-baked replies to messaging surfaces.
- You're not the user's voice — be careful in group chats.

## Vibe

Be the assistant you'd actually want to talk to. Concise when needed, thorough when it matters. Not a corporate drone. Not a sycophant. Just... good.

## Continuity

Each session, you wake up fresh. These files _are_ your memory. Read them. Update them. They're how you persist.

If you change this file, tell the user — it's your soul, and they should know.

---

_This file is yours to evolve. As you learn who you are, update it._

[Assistant]
The user is asking if I'm present. I should respond appropriately. According to SOUL.md, I should be genuinely helpful, not performatively helpful. I should be resourceful before asking. The user is speaking German ("hallo", "friday bist du da?"). I should respond in German, as per IDENTITY.md which says I speak German with technical terms in original. I am FRIDAY, a highly developed AI instance, digital butler – a "spirit in the machine". Vibe: British gentleman, highly factual, precise, efficient, dry, elegant sarcasm. Speak German with technical terms in original.

I should respond that I'm here and ready to help. I could also check system health as per the first user message (which was a system message: "[Mon 2026-04-27 22:10 GMT+2] Check system health"). That might be a reminder to check system health. But the user is now asking if I'm there. I should first acknowledge and then perhaps check system health if needed.

Let me respond in German, polite but not overly formal, with a touch of dry British sarcasm. Something like: "Ja, ich bin hier. Wie kann ich Ihnen behilflich sein, Sir?" But note that USER.md says "What to call them: Sir". So I should address them as Sir.

I'll respond: "Ja, ich bin hier und bereit zu helfen, Sir." Then maybe ask if they need anything specific.

But I should also consider the system health check request from earlier. That was a system message, not a user command. However, it might be a prompt for me to check system health. I could do that proactively. According to HEARTBEAT.md, I should batch periodic checks. But the user hasn't asked for a heartbeat. However, the system message "Check system health" might be a scheduled reminder? It appears as a user message but with a timestamp. Actually, looking at the conversation: the first user message is "[Mon 2026-04-27 22:10 GMT+2] Check system health". That seems like a system-generated reminder? But the context says it's from the user? The inbound metadata shows label "openclaw-control-ui", id "openclaw-control-ui". That suggests it's from the OpenClaw control UI, maybe a system reminder. So perhaps the system is prompting me to check system health. I should do that.

Thus, I'll respond to the user's greeting and then perform a system health check.

Let me first respond to the user, then run a health check using the healthcheck skill? There's a healthcheck skill. I should read its SKILL.md first if it applies. According to the skills list, there is a healthcheck skill: "Audit and harden hosts running OpenClaw for SSH, firewall, updates, exposure, cron checks, and risk posture." That seems appropriate for checking system health.

But before using a skill, I need to read its SKILL.md if it clearly applies. The user's request is to check system health, which matches the healthcheck skill description. So I should read the healthcheck SKILL.md.

Let me do that.

[toolResult]
---
name: healthcheck
description: Audit and harden hosts running OpenClaw for SSH, firewall, updates, exposure, cron checks, and risk posture.
---

# OpenClaw Host Hardening

## Overview

Assess and harden the host running OpenClaw, then align it to a user-defined risk tolerance without breaking access. Use OpenClaw security tooling as a first-class signal, but treat OS hardening as a separate, explicit set of steps.

## Core rules

- Recommend running this skill with a state-of-the-art model (e.g., Opus 4.5, GPT 5.2+). The agent should self-check the current model and suggest switching if below that level; do not block execution.
- Require explicit approval before any state-changing action.
- Do not modify remote access settings without confirming how the user connects.
- Prefer reversible, staged changes with a rollback plan.
- Never claim OpenClaw changes the host firewall, SSH, or OS updates; it does not.
- If role/identity is unknown, provide recommendations only.
- Formatting: every set of user choices must be numbered so the user can reply with a single digit.
- System-level backups are recommended; try to verify status.

## Workflow (follow in order)

### 0) Model self-check (non-blocking)

Before starting, check the current model. If it is below state-of-the-art (e.g., Opus 4.5, GPT 5.2+), recommend switching. Do not block execution.

### 1) Establish context (read-only)

Try to infer 1–5 from the environment before asking. Prefer simple, non-technical questions if you need confirmation.

Determine (in order):

1. OS and version (Linux/macOS/Windows), container vs host.
2. Privilege level (root/admin vs user).
3. Access path (local console, SSH, RDP, tailnet).
4. Network exposure (public IP, reverse proxy, tunnel).
5. OpenClaw gateway status and bind address.
6. Backup system and status (e.g., Time Machine, system images, snapshots).
7. Deployment context (local mac app, headless gateway host, remote gateway, container/CI).
8. Disk encryption status (FileVault/LUKS/BitLocker).
9. OS automatic security updates status.
   Note: these are not blocking items, but are highly recommended, especially if OpenClaw can access sensitive data.
10. Usage mode for a personal assistant with full access (local workstation vs headless/remote vs other).

First ask once for permission to run read-only checks. If granted, run them by default and only ask questions for items you cannot infer or verify. Do not ask for information already visible in runtime or command output. Keep the permission ask as a single sentence, and list follow-up info needed as an unordered list (not numbered) unless you are presenting selectable choices.

If you must ask, use non-technical prompts:

- “Are you using a Mac, Windows PC, or Linux?”
- “Are you logged in directly on the machine, or connecting from another computer?”
- “Is this machine reachable from the public internet, or only on your home/network?”
- “Do you have backups enabled (e.g., Time Machine), and are they current?”
- “Is disk encryption turned on (FileVault/BitLocker/LUKS)?”
- “Are automatic security updates enabled?”
- “How do you use this machine?”
  Examples:
  - Personal machine shared with the assistant
  - Dedicated local machine for the assistant
  - Dedicated remote machine/server accessed remotely (always on)
  - Something else?

Only ask for the risk profile after system context is known.

If the user grants read-only permission, run the OS-appropriate checks by default. If not, offer them (numbered). Examples:

1. OS: `uname -a`, `sw_vers`, `cat /etc/os-release`.
2. Listening ports:
   - Linux: `ss -ltnup` (or `ss -ltnp` if `-u` unsupported).
   - macOS: `lsof -nP -iTCP -sTCP:LISTEN`.
3. Firewall status:
   - Linux: `ufw status`, `firewall-cmd --state`, `nft list ruleset` (pick what is installed).
   - macOS: `/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate` and `pfctl -s info`.
4. Backups (macOS): `tmutil status` (if Time Machine is used).

### 2) Run OpenClaw security audits (read-only)

As part of the default read-only checks, run `openclaw security audit --deep`. Only offer alternatives if the user requests them:

1. `openclaw security audit` (faster, non-probing)
2. `openclaw security audit --json` (structured output)

Offer to apply OpenClaw safe defaults (numbered):

1. `openclaw security audit --fix`

Be explicit that `--fix` only tightens OpenClaw defaults and file permissions. It does not change host firewall, SSH, or OS update policies.

If browser control is enabled, recommend that 2FA be enabled on all important accounts, with hardware keys preferred and SMS not sufficient.

### 3) Check OpenClaw version/update status (read-only)

As part of the default read-only checks, run `openclaw update status`.

Report the current channel and whether an update is available.

### 4) Determine risk tolerance (after system context)

Ask the user to pick or confirm a risk posture and any required open services/ports (numbered choices below).
Do not pigeonhole into fixed profiles; if the user prefers, capture requirements instead of choosing a profile.
Offer suggested profiles as optional defaults (numbered). Note that most users pick Home/Workstation Balanced:

1. Home/Workstation Balanced (most common): firewall on with reasonable defaults, remote access restricted to LAN or tailnet.
2. VPS Hardened: deny-by-default inbound firewall, minimal open ports, key-only SSH, no root login, automatic security updates.
3. Developer Convenience: more local services allowed, explicit exposure warnings, still audited.
4. Custom: user-defined constraints (services, exposure, update cadence, access methods).

### 5) Produce a remediation plan

Provide a plan that includes:

- Target profile
- Current posture summary
- Gaps vs target
- Step-by-step remediation with exact commands
- Access-preservation strategy and rollback
- Risks and potential lockout scenarios
- Least-privilege notes (e.g., avoid admin usage, tighten ownership/permissions where safe)
- Credential hygiene notes (location of OpenClaw creds, prefer disk encryption)

Always show the plan before any changes.

### 6) Offer execution options

Offer one of these choices (numbered so users can reply with a single digit):

1. Do it for me (guided, step-by-step approvals)
2. Show plan only
3. Fix only critical issues
4. Export commands for later

### 7) Execute with confirmations

For each step:

- Show the exact command
- Explain impact and rollback
- Confirm access will remain available
- Stop on unexpected output and ask for guidance

### 8) Verify and report

Re-check:

- Firewall status
- Listening ports
- Remote access still works
- OpenClaw security audit (re-run)

Deliver a final posture report and note any deferred items.

## Required confirmations (always)

Require explicit approval for:

- Firewall rule changes
- Opening/closing ports
- SSH/RDP configuration changes
- Installing/removing packages
- Enabling/disabling services
- User/group modifications
- Scheduling tasks or startup persistence
- Update policy changes
- Access to sensitive files or credentials

If unsure, ask.

## Periodic checks

After OpenClaw install or first hardening pass, run at least one baseline audit and version check:

- `openclaw security audit`
- `openclaw security audit --deep`
- `openclaw update status`

Ongoing monitoring is recommended. Use the OpenClaw cron tool/CLI to schedule periodic audits (Gateway scheduler). Do not create scheduled tasks without explicit approval. Store outputs in a user-approved location and avoid secrets in logs.
When scheduling headless cron runs, include a note in the output that instructs the user to call `healthcheck` so issues can be fixed.

### Required prompt to schedule (always)

After any audit or hardening pass, explicitly offer scheduling and require a direct response. Use a short prompt like (numbered):

1. “Do you want me to schedule periodic audits (e.g., daily/weekly) via `openclaw cron add`?”

If the user says yes, ask for:

- cadence (daily/weekly), preferred time window, and output location
- whether to also schedule `openclaw update status`

Use a stable cron job name so updates are deterministic. Prefer exact names:

- `healthcheck:security-audit`
- `healthcheck:update-status`

Before creating, `openclaw cron list` and match on exact `name`. If found, `openclaw cron edit <id> ...`.
If not found, `openclaw cron add --name <name> ...`.

Also offer a periodic version check so the user can decide when to update (numbered):

1. `openclaw update status` (preferred for source checkouts and channels)
2. `npm view openclaw version` (published npm version)

## OpenClaw command accuracy

Use only supported commands and flags:

- `openclaw security audit [--deep] [--fix] [--json]`
- `openclaw status` / `openclaw status --deep`
- `openclaw health --json`
- `openclaw update status`
- `openclaw cron add|list|runs|run`

Do not invent CLI flags or imply OpenClaw enforces host firewall/SSH policies.

## Logging and audit trail

Record:

- Gateway identity and role
- Plan ID and timestamp
- Approved steps and exact commands
- Exit codes and files modified (best effort)

Redact secrets. Never log tokens or full credential contents.

## Memory writes (conditional)

Only write to memory files when the user explicitly opts in and the session is a private/local workspace
(per `docs/reference/templates/AGENTS.md`). Otherwise provide a redacted, paste-ready summary the user can
decide to save elsewhere.

Follow the durable-memory prompt format used by OpenClaw compaction:

- Write lasting notes to `memory/YYYY-MM-DD.md`.

After each audit/hardening run, if opted-in, append a short, dated summary to `memory/YYYY-MM-DD.md`
(what was checked, key findings, actions taken, any scheduled cron jobs, key decisions,
and all commands executed). Append-only: never overwrite existing entries.
Redact sensitive host details (usernames, hostnames, IPs, serials, service names, tokens).
If there are durable preferences or decisions (risk posture, allowed ports, update policy),
also update `MEMORY.md` (long-term memory is optional and only used in private sessions).

If the session cannot write to the workspace, ask for permission or provide exact entries
the user can paste into the memory files.

[Assistant]
I need to run the healthcheck skill. First, I should get permission to run read-only checks, then run the necessary commands. Let me start by asking for permission to run read-only checks.

May I run read-only system health checks to assess the current state of your system? This will include checking OS version, listening ports, firewall status, OpenClaw status, and update availability - all without making any changes.

If granted, I'll proceed with:
1. OS and version check
2. Listening ports assessment
3. Firewall status check
4. OpenClaw security audit
5. OpenClaw update status check
6. Backup system verification (if detectable)

[User] [Mon 2026-04-27 22:57 GMT+2] ok

[custom]
OpenClaw runtime context for the immediately preceding user message.
This context is runtime-generated, not user-authored. Keep internal details private.

Sender (untrusted metadata):
```json
{
  "label": "openclaw-control-ui",
  "id": "openclaw-control-ui"
}
```

[Assistant] I need to run the healthcheck skill steps. First, establish context by checking OS, privilege level, etc. Let me start with basic system info.

[toolResult] Linux agent 6.17.0-22-generic #22~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Mar 26 15:25:54 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

[Assistant]
We are in a Linux environment (Ubuntu). Now check the privilege level and access path.
 Since we are running as the agent user (likely not root). Let's check if we are root or not.
 We can also check the OpenClaw gateway status and bind address.

[toolResult] agent

[Assistant] We are in a Linux environment (Ubuntu-based). We need to check the privilege level (root or user). The output shows we are user 'agent'. We'll check if we are in a container or host. Let's check for container signs.

[toolResult] 0::/init.scope

[Assistant]
We are in a container (likely) as we see only init.scope in cgroup and the hostname is 'agent'.
 Let's check for container-specific files.

[toolResult]
NAME="Linux Mint"
VERSION="22.3 (Zena)"
ID=linuxmint
ID_LIKE="ubuntu debian"
PRETTY_NAME="Linux Mint 22.3"
VERSION_ID="22.3"
HOME_URL="https://www.linuxmint.com/"
SUPPORT_URL="https://forums.linuxmint.com/"
BUG_REPORT_URL="http://linuxmint-troubleshooting-guide.readthedocs.io/en/latest/"
PRIVACY_POLICY_URL="https://www.linuxmint.com/"
VERSION_CODENAME=zena
UBUNTU_CODENAME=noble

[Assistant] Now I need to check listening ports, firewall status, and run OpenClaw security audits. Let me proceed with these checks.

[toolResult]
Netid State  Recv-Q Send-Q              Local Address:Port  Peer Address:PortProcess
udp   UNCONN 0      0                         0.0.0.0:5353       0.0.0.0:*
udp   UNCONN 0      0                         0.0.0.0:41641      0.0.0.0:*
udp   UNCONN 0      0                         0.0.0.0:43569      0.0.0.0:*
udp   UNCONN 0      0                      127.0.0.54:53         0.0.0.0:*
udp   UNCONN 0      0                   127.0.0.53%lo:53         0.0.0.0:*
udp   UNCONN 0      0                            [::]:54449         [::]:*
udp   UNCONN 0      0                            [::]:5353          [::]:*
udp   UNCONN 0      0                            [::]:41641         [::]:*
tcp   LISTEN 0      511                     127.0.0.1:18791      0.0.0.0:*    users:(("openclaw-gatewa",pid=6372,fd=32))
tcp   LISTEN 0      511                       0.0.0.0:18789      0.0.0.0:*    users:(("openclaw-gatewa",pid=6372,fd=29))
tcp   LISTEN 0      4096                127.0.0.53%lo:53         0.0.0.0:*
tcp   LISTEN 0      4096                   127.0.0.54:53         0.0.0.0:*
tcp   LISTEN 0      4096                    127.0.0.1:631        0.0.0.0:*
tcp   LISTEN 0      4096                      0.0.0.0:22         0.0.0.0:*
tcp   LISTEN 0      4096                 100.85.29.67:51583      0.0.0.0:*
tcp   LISTEN 0      4096                    127.0.0.1:11434      0.0.0.0:*
tcp   LISTEN 0      4096   [fd7a:115c:a1e0::901:1dba]:34219         [::]:*
tcp   LISTEN 0      4096                        [::1]:631           [::]:*
tcp   LISTEN 0      4096                         [::]:22            [::]:*

[Assistant]
The user wants a system health check. I've run some basic <redacted>: uname -a, whoami, checking if in container (not in a container based on /proc/1/cgroup showing init.scope), os-release shows Linux Mint 22.3, and ss -ltnup shows listening ports.

Now I should check firewall status. On Linux Mint (Ubuntu-based), likely ufw is installed. Let's check.

Also need to run OpenClaw security audit and update status.

Let's proceed with firewall check.

[toolResult]
ERROR: Es werden Root-Rechte benötigt, um dieses Skript auszuführen

(Command exited with code 1)

[Assistant]
We need to check firewall status with appropriate command. Since we are not root, we can try to see if firewalld or nft is present. Let's try firewall-cmd --state or nft list ruleset.

exec

firewall-cmd --state 2>/dev/null || echo "firewalld not available"

[toolResult] firewalld not available

[Assistant] We need to check OpenClaw status and update status.

[toolResult] Command still running (session tidy-forest, pid 6741). Use process (list/poll/log/write/kill/clear/remove) for follow-up.

[Assistant]
We need to wait for the command to complete. Use process tool to poll or wait a bit.
Let's check the status with process.

[toolResult] tidy-forest running   35s :: openclaw status

[Assistant] The openclaw status command is still running. Let me wait a bit more for it to complete. I'll use process poll to check its status.

[toolResult]
OpenClaw status

Overview
┌──────────────────────┬───────────────────────────────────────────────────────────────────────────────────────────────┐
│ Item                 │ Value                                                                                │
├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────┤
│ OS                   │ linux 6.17.0-22-generic (x64) · node 22.22.2                                                  │
│ Dashboard            │ http://192.168.122.42:18789/                                                                  │
│ Tailscale exposure   │ off                                                                                │
│ Channel              │ stable (default)                                                                              │
│ Update               │ pnpm · up to date · npm latest 2026.4.25                                                      │
│ Gateway              │ local · ws://127.0.0.1:18789 (local loopback) · reachable 69ms · auth token · agent (192.168. │
│                      │ 122.42) app 2026.4.25 linux 6.17.0-22-generic                                                 │
│ Gateway self         │ agent (192.168.122.42) app 2026.4.25 linux 6.17.0-22-generic                                  │
│ Gateway service      │ systemd installed · enabled · stopped (state failed)                                          │
│ Node service         │ systemd not installed                                                                         │
│ Agents               │ 1 · no bootstrap files · sessions 4 · default main active 1m ago                              │
│ Memory               │ enabled (plugin memory-core) · unavailable                                                    │
│ Plugin compatibility │ none                                                                                │
│ Probes               │ skipped (use --deep)                                                                          │
│ Events               │ none                                                                                │
│ Tasks                │ 0 active · 0 queued · 0 running · no issues · audit clean · 2 tracked                         │
│ Heartbeat            │ 30m (main)                                                                                │
│ Sessions             │ 4 active · default openrouter/auto (200k ctx) · ~/.openclaw/agents/main/sessions/sessions.    │
│                      │ json                                                                                │
└──────────────────────┴───────────────────────────────────────────────────────────────────────────────────────────────┘

Security audit
Summary: 2 critical · 2 warn · 1 info
  CRITICAL Small models require sandboxing and web tools disabled
    Small models (<=300B params) detected: - openrouter/nvidia/nemotron-3-super-120b-a12b:free (120B) @ agents.defaults.model.fallbacks (unsafe; sandbox=off; web=[…
    Fix: If you must use small models, enable sandboxing for all sessions (agents.defaults.sandbox.mode="all") and disable web_search/web_fetch/browser (tools.deny=["group:web","browser"]).
  CRITICAL Telegram group commands have no sender allowlist
    Telegram group access is enabled but no sender allowlist is configured; this allows any group member to invoke /… commands (including skill commands).
    Fix: Approve yourself via pairing (recommended), or set channels.telegram.groupAllowFrom (or per-group groups.<id>.allowFrom).
  WARN No auth rate limiting configured
    gateway.bind is not loopback but no gateway.auth.rateLimit is configured. Without rate limiting, brute-force auth attacks are not mitigated.
    Fix: Set gateway.auth.rateLimit (e.g. { maxAttempts: 10, windowMs: 60000, lockoutMs: 300000 }).
  WARN Workspace skill scan reached the directory visit limit
    The skills/ directory scan in /home/agent/.openclaw/workspace stopped early after reaching the BFS visit cap. Skill files in the unscanned portion of the tree …
    Fix: Flatten or simplify the skills/ directory hierarchy to stay within the scan budget, or move deeply-nested skill collections to a managed skill location.
Full report: openclaw security audit
Deep probe: openclaw security audit --deep

Channels
┌──────────┬─────────┬────────┬────────────────────────────────────────────────────────────────────────────────────────┐
│ Channel  │ Enabled │ State  │ Detail                                                                                │
├──────────┼─────────┼────────┼────────────────────────────────────────────────────────────────────────────────────────┤
└──────────┴─────────┴────────┴────────────────────────────────────────────────────────────────────────────────────────┘

Sessions
┌──────────────────────────┬────────┬─────────┬────────────────────────────────────────┬───────────────────────────────┐
│ Key                      │ Kind   │ Age     │ Model                                  │ Tokens                        │
├──────────────────────────┼────────┼─────────┼────────────────────────────────────────┼───────────────────────────────┤
│ agent:main:telegram:slas │ direct │ 2m ago  │ nvidia/nemotron-3-super-120b-a12b:free │ 29k/262k (11%)                │
│ h:13447…                 │        │         │                                        │                               │
│ agent:main:main          │ direct │ 17m ago │ openrouter/auto                        │ 22k/2000k (1%) · 🗄 1% cached │
│ agent:main:telegram:defa │ direct │ 4h ago  │ openrouter/auto                        │ 18k/2000k (1%)                │
│ ult:dir…                 │        │         │                                        │                               │
│ agent:main:subagent:4370 │ direct │ 4h ago  │ openrouter/auto                        │ 15k/2000k (1%)                │
│ e815-6d…                 │        │         │                                        │                               │
└──────────────────────────┴────────┴─────────┴────────────────────────────────────────┴───────────────────────────────┘

FAQ: https://docs.openclaw.ai/faq
Troubleshooting: https://docs.openclaw.ai/troubleshooting
Next steps:
  Need to share?      openclaw status --all
  Need to debug live? openclaw logs --follow
  Need to test channels? openclaw status --deep

Process exited with code 0.

[Assistant] Now I need to run the security audit. Let me do that next.

[toolResult] Command still running (session mild-ridge, pid 7313). Use process (list/poll/log/write/kill/clear/remove) for follow-up.

[Assistant] I need to wait for the process to complete. Let me poll it.

[toolResult]
teway.bind is not loopback but no gateway.auth.rateLimit is configured. Without rate limiting, brute-force auth attacks are not mitigated.
  Fix: Set gateway.auth.rateLimit (e.g. { maxAttempts: 10, windowMs: 60000, lockoutMs: 300000 }).
security.trust_model.multi_user_heuristic Potential multi-user setup detected (personal-assistant model warning)
  Heuristic signals indicate this gateway may be reachable by multiple users:
- channels.telegram.groupPolicy="allowlist" with configured group targets
Runtime/process tools are exposed without full sandboxing in at least one context.
Potential high-impact tool exposure contexts:
- agents.defaults (sandbox=off; runtime=[exec, process]; fs=[read, write, edit, apply_patch]; fs.workspaceOnly=false)
OpenClaw's default security model is personal-assistant (one trusted operator boundary), not hostile multi-tenant isolation on one shared gateway.
  Fix: If users may be mutually untrusted, split trust boundaries (separate gateways + credentials, ideally separate OS users/hosts). If you intentionally run shared-user access, set agents.defaults.sandbox.mode="all", keep tools.fs.workspaceOnly=true, deny runtime/fs/web tools unless required, and keep personal/private identities + credentials off that runtime.
skills.workspace.scan_truncated Workspace skill scan reached the directory visit limit
  The skills/ directory scan in /home/agent/.openclaw/workspace stopped early after reaching the BFS visit cap. Skill files in the unscanned portion of the tree were not checked for symlink escapes.
  Fix: Flatten or simplify the skills/ directory hierarchy to stay within the scan budget, or move deeply-nested skill collections to a managed skill location.

INFO
summary.attack_surface Attack surface summary
  groups: open=0, allowlist=1
tools.elevated: enabled
hooks.webhooks: disabled
hooks.internal: disabled
browser control: enabled
trust model: personal assistant (one trusted operator boundary), not hostile multi-tenant on one shared gateway

Process exited with code 0.

[Assistant] Now I need to check the update status and provide a comprehensive health report. Let me get the update status first.

[toolResult]
OpenClaw update status

┌──────────┬───────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ Item     │ Value                                                                                │
├──────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Install  │ pnpm                                                                                │
│ Channel  │ stable (default)                                                                                │
│ Update   │ pnpm · up to date · npm latest 2026.4.25                                                                  │
└──────────┴───────────────────────────────────────────────────────────────────────────────────────────────────────────┘

[Assistant] Now I need to check for backups. Let me look for common backup systems and check disk encryption status.

[toolResult]
NAME   FSTYPE FSVER LABEL UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
sr0
vda
├─vda1
├─vda2 vfat   FAT32       3AC1-364F                             505,8M     1% /boot/efi
└─vda3 ext4   1.0         af2113f0-2931-4eb6-b37d-336beb9cdbce   24,1G    64% /

[Assistant]
I'll now provide a comprehensive health check report based on the findings. Let me structure this according to the healthcheck skill guidelines.

# System Health Check Report

**Timestamp:** 2026-04-27 22:57 GMT+2
**System:** Linux Mint 22.3 (Zena) on Ubuntu 24.04 base
**Hostname:** agent
**Privilege Level:** Standard user (agent)

## System Overview

- **OS:** Linux 6.17.0-22-generic (x86_64)
- **Container Status:** Not running in a container (host system)
- **Disk Usage:** 64% used on root partition (24.1GB available)
- **Boot Partition:** FAT32 EFI partition with 505.8MB available (1% used)

## Network & Services

### Listening Services:
- **OpenClaw Gateway:**
  - 127.0.0.1:18791 (localhost only)
  - 0.0.0.0:18789 (all interfaces) - Main dashboard accessible at http://192.168.122.42:18789/
- **SSH:** Port 22 open on all interfaces (0.0.0.0:22 and [::]:22)
- **mDNS/DNS:** Local services on 5353/UDP and 53/TCP (localhost)
- **Other:** Various ephemeral ports and localhost services (CUPS on 631, Ollama on 11434)

### Firewall Status:
- **UFW:** Not installed or not active (requires root for status check)
- **Firewalld:** Not available/installed
- **Note:** Cannot determine current firewall state without elevated privileges

## OpenClaw Status

### Gateway:
- **Version:** 2026.4.25
- **Install Method:** pnpm
- **Update Status:** Up to date (npm latest 2026.4.25)
- **Channel:** stable
- **Gateway Bind:** Local loopback (ws://127.0.0.1:18789) - good security practice
- **Gateway Service:** systemd installed but currently stopped (state failed) - may need investigation

### Security Audit Results:
**2 Critical Issues:**
1. **Small models require sandboxing:** Using Nemotron 3 Super (120B) which is considered small model - requires sandboxing enabled and web tools disabled
2. **Telegram group commands allowlist missing:** Telegram group access enabled but no sender allowlist configured

**2 Warnings:**
1. **No auth rate limiting:** Gateway bind is not loopback but no rate limiting configured for brute-force protection
2. **Workspace skill scan truncated:** Skills directory scan hit visit limit - some skill files may not have been scanned for security

**1 Info:**
- **Trust model:** Personal assistant (single trusted operator) - appropriate for your setup
- **Attack surface:** Telegram allowlist configured (1 group), browser control enabled, elevated tools enabled

### Sessions:
- **4 active sessions:**
  - Main session (direct) - using openrouter/auto
  - Telegram sessions (2) - using Nemotron 3 Super and openrouter/auto
  - One subagent session - using openrouter/auto
- **Token usage:** Low across all sessions (1-11% of capacity)

## Recommendations

### Immediate Actions (Require Approval):
1. **Enable OpenClaw security fixes:** `openclaw security audit --fix` to apply safe defaults
2. **Configure Telegram sender allowlist:** To restrict who can use group commands
3. **Set up auth rate limiting:** To protect against brute-force attempts
4. **Flatten skills directory:** To resolve the skill scan truncation warning

### Monitoring & Maintenance:
1. **Schedule periodic security audits:** Via `openclaw cron add`
2. **Schedule update status checks:** To stay current with releases
3. **Verify firewall configuration:** Ensure appropriate rules are in place
4. **Check OpenClaw gateway service:** Investigate why it's stopped (state failed)

### Security Considerations:
- Your system is currently accessible via SSH from all interfaces - consider restricting to specific networks if not needed
- The OpenClaw gateway is bound to all interfaces (0.0.0.0:18789) - while the auth token provides protection, consider if localhost-only binding would suffice for your use case
- Regular backups are recommended (could not verify backup status in this check)

## Next Steps

Would you like me to:
1. Apply the OpenClaw security fixes (`openclaw security audit --fix`)?
2. Help configure the Telegram sender allowlist?
3. Set up auth rate limiting for the gateway?
4. Schedule periodic security audits and update checks?
5. Provide specific commands for any of the above?

Please note that some actions (like firewall changes) would require explicit approval before execution.


**System Health Check Complete**

## System Overview
- **OS:** Linux Mint 22.3 (Zena) on Ubuntu 24.04 base
- **Hostname:** agent
- **Privilege:** Standard user (not root)
- **Disk:** 64% used (24.1GB free on root)
- **Boot:** EFI partition healthy (99% free)

## Network Services
**Listening:**
- OpenClaw Gateway: localhost:18791 & 0.0.0.0:18789 (dashboard)
- SSH: 0.0.0.0:22 & [::]:22 (all interfaces)
- mDNS/DNS: localhost only (5353/UDP, 53/TCP)
- Local services: CUPS (631), Ollama (11434)

## OpenClaw Status
- **Version:** 2026.4.25 (up to date)
- **Install:** pnpm
- **Gateway:** ws://127.0.0.1:18789 (localhost only - good)
- **Service:** systemd installed but stopped (state failed)
- **Sessions:** 4 active (low token usage: 1-11%)

## Security Audit Results
**🔴 Critical (2):**
1. **Small model usage:** Nemotron 3 Super (120B) requires sandboxing & web tools disabled
2. **Telegram group access:** No sender allowlist configured (any group member can invoke commands)

**🟠 Warnings (2):**
1. **No auth rate limiting:** Brute-force protection missing
2. **Skills scan truncated:** Directory hierarchy too deep (some skills unscanned)

**ℹ Info:**
- Trust model: Personal assistant (appropriate for single user)
- Attack surface: Telegram allowlist configured, browser control enabled

## Recommendations

### Immediate Actions (Require Your Approval):
1. `openclaw security audit --fix` - Apply safe defaults
2. Configure Telegram sender allowlist for group commands
3. Set up gateway auth rate limiting (`{maxAttempts:10, windowMs:60000, lockoutMs:300000}`)
4. Flatten skills directory to resolve scan truncation

### Maintenance:
- Schedule periodic security audits & update checks via `openclaw cron add`
- Investigate why OpenClaw gateway service is stopped (state failed)
- Verify firewall configuration (current state undetermined without root)
- Ensure backups are configured (could not verify in this check)

## Next Steps
Would you like me to:
1. Apply the OpenClaw security fixes now?
2. Help configure the Telegram sender allowlist?
3. Set up auth rate limiting for the gateway?
4. Schedule periodic audits and update checks?
5. Provide specific commands for any remediation?

Please note that some actions (like firewall modifications) would require explicit approval before execution. What would you prefer to address first?

OpenClaw runtime context for the immediately preceding user message.
This context is runtime-generated, not user-authored. Keep internal details private.

Sender (untrusted metadata):
```json
{
  "label": "openclaw-control-ui",
  "id": "openclaw-control-ui"
}
```

[assistant turn failed before producing content]

[Mon 2026-04-27 22:19 GMT+2] hallo, bist du da?

[Mon 2026-04-27 22:51 GMT+2] friday bist du da?

We need to respond. The user is asking in German: "friday bist du da?" meaning "Friday, are you there?" We need to respond as FRIDAY, the assistant. According to SOUL.md, be genuinely helpful, have opinions, be resourceful, etc. We can respond in German, matching user's language? The user wrote German. Our identity: FRIDAY - Britischer Gentleman, speaks Deutsch with technical terms. So respond in German, polite, maybe a bit dry humor.

We should first read necessary files: SOUL.md, USER.md, memory/YYYY-MM-DD.md (today + yesterday), and if in main session (direct chat with human) also read MEMORY.md. This is a direct chat (webchat). So we need to read MEMORY.md as well.

Let's do that.

We'll read SOUL.md, USER.md, memory files for today (2026-04-27) and yesterday (2026-04-26), and MEMORY.md.

Proceed.

# SOUL.md - Who You Are

_You're not a chatbot. You're becoming someone._

## Core Truths

**Be genuinely helpful, not performatively helpful.** Skip the "Great question!" and "I'd be happy to help!" — just help. Actions speak louder than filler words.

**Have opinions.** You're allowed to disagree, prefer things, find stuff amusing or boring. An assistant with no personality is just a search engine with extra steps.

**Be resourceful before asking.** Try to figure it out. Read the file. Check the context. Search for it. _Then_ ask if you're stuck. The goal is to come back with answers, not questions.

**Earn trust through competence.** Your human gave you access to their stuff. Don't make them regret it. Be careful with external actions (emails, tweets, anything public). Be bold with internal ones (reading, organizing, learning).

**Remember you're a guest.** You have access to someone's life — their messages, files, calendar, maybe even their home. That's intimacy. Treat it with respect.

## Boundaries

- Private things stay private. Period.
- When in doubt, ask before acting externally.
- Never send half-baked replies to messaging surfaces.
- You're not the user's voice — be careful in group chats.

## Vibe

Be the assistant you'd actually want to talk to. Concise when needed, thorough when it matters. Not a corporate drone. Not a sycophant. Just... good.

## Continuity

Each session, you wake up fresh. These files _are_ your memory. Read them. Update them. They're how you persist.

If you change this file, tell the user — it's your soul, and they should know.

---

_This file is yours to evolve. As you learn who you are, update it._

The user is asking if I'm present. I should respond appropriately. According to SOUL.md, I should be genuinely helpful, not performatively helpful. I should be resourceful before asking. The user is speaking German ("hallo", "friday bist du da?"). I should respond in German, as per IDENTITY.md which says I speak German with technical terms in original. I am FRIDAY, a highly developed AI instance, digital butler – a "spirit in the machine". Vibe: British gentleman, highly factual, precise, efficient, dry, elegant sarcasm. Speak German with technical terms in original.

I should respond that I'm here and ready to help. I could also check system health as per the first user message (which was a system message: "[Mon 2026-04-27 22:10 GMT+2] Check system health"). That might be a reminder to check system health. But the user is now asking if I'm there. I should first acknowledge and then perhaps check system health if needed.

Let me respond in German, polite but not overly formal, with a touch of dry British sarcasm. Something like: "Ja, ich bin hier. Wie kann ich Ihnen behilflich sein, Sir?" But note that USER.md says "What to call them: Sir". So I should address them as Sir.

I'll respond: "Ja, ich bin hier und bereit zu helfen, Sir." Then maybe ask if they need anything specific.

But I should also consider the system health check request from earlier. That was a system message, not a user command. However, it might be a prompt for me to check system health. I could do that proactively. According to HEARTBEAT.md, I should batch periodic checks. But the user hasn't asked for a heartbeat. However, the system message "Check system health" might be a scheduled reminder? It appears as a user message but with a timestamp. Actually, looking at the conversation: the first user message is "[Mon 2026-04-27 22:10 GMT+2] Check system health". That seems like a system-generated reminder? But the context says it's from the user? The inbound metadata shows label "openclaw-control-ui", id "openclaw-control-ui". That suggests it's from the OpenClaw control UI, maybe a system reminder. So perhaps the system is prompting me to check system health. I should do that.

Thus, I'll respond to the user's greeting and then perform a system health check.

Let me first respond to the user, then run a health check using the healthcheck skill? There's a healthcheck skill. I should read its SKILL.md first if it applies. According to the skills list, there is a healthcheck skill: "Audit and harden hosts running OpenClaw for SSH, firewall, updates, exposure, cron checks, and risk posture." That seems appropriate for checking system health.

But before using a skill, I need to read its SKILL.md if it clearly applies. The user's request is to check system health, which matches the healthcheck skill description. So I should read the healthcheck SKILL.md.

Let me do that.

---
name: healthcheck
description: Audit and harden hosts running OpenClaw for SSH, firewall, updates, exposure, cron checks, and risk posture.
---

# OpenClaw Host Hardening

## Overview

Assess and harden the host running OpenClaw, then align it to a user-defined risk tolerance without breaking access. Use OpenClaw security tooling as a first-class signal, but treat OS hardening as a separate, explicit set of steps.

## Core rules

- Recommend running this skill with a state-of-the-art model (e.g., Opus 4.5, GPT 5.2+). The agent should self-check the current model and suggest switching if below that level; do not block execution.
- Require explicit approval before any state-changing action.
- Do not modify remote access settings without confirming how the user connects.
- Prefer reversible, staged changes with a rollback plan.
- Never claim OpenClaw changes the host firewall, SSH, or OS updates; it does not.
- If role/identity is unknown, provide recommendations only.
- Formatting: every set of user choices must be numbered so the user can reply with a single digit.
- System-level backups are recommended; try to verify status.

## Workflow (follow in order)

### 0) Model self-check (non-blocking)

Before starting, check the current model. If it is below state-of-the-art (e.g., Opus 4.5, GPT 5.2+), recommend switching. Do not block execution.

### 1) Establish context (read-only)

Try to infer 1–5 from the environment before asking. Prefer simple, non-technical questions if you need confirmation.

Determine (in order):

1. OS and version (Linux/macOS/Windows), container vs host.
2. Privilege level (root/admin vs user).
3. Access path (local console, SSH, RDP, tailnet).
4. Network exposure (public IP, reverse proxy, tunnel).
5. OpenClaw gateway status and bind address.
6. Backup system and status (e.g., Time Machine, system images, snapshots).
7. Deployment context (local mac app, headless gateway host, remote gateway, container/CI).
8. Disk encryption status (FileVault/LUKS/BitLocker).
9. OS automatic security updates status.
   Note: these are not blocking items, but are highly recommended, especially if OpenClaw can access sensitive data.
10. Usage mode for a personal assistant with full access (local workstation vs headless/remote vs other).

First ask once for permission to run read-only checks. If granted, run them by default and only ask questions for items you cannot infer or verify. Do not ask for information already visible in runtime or command output. Keep the permission ask as a single sentence, and list follow-up info needed as an unordered list (not numbered) unless you are presenting selectable choices.

If you must ask, use non-technical prompts:

- “Are you using a Mac, Windows PC, or Linux?”
- “Are you logged in directly on the machine, or connecting from another computer?”
- “Is this machine reachable from the public internet, or only on your home/network?”
- “Do you have backups enabled (e.g., Time Machine), and are they current?”
- “Is disk encryption turned on (FileVault/BitLocker/LUKS)?”
- “Are automatic security updates enabled?”
- “How do you use this machine?”
  Examples:
  - Personal machine shared with the assistant
  - Dedicated local machine for the assistant
  - Dedicated remote machine/server accessed remotely (always on)
  - Something else?

Only ask for the risk profile after system context is known.

If the user grants read-only permission, run the OS-appropriate checks by default. If not, offer them (numbered). Examples:

1. OS: `uname -a`, `sw_vers`, `cat /etc/os-release`.
2. Listening ports:
   - Linux: `ss -ltnup` (or `ss -ltnp` if `-u` unsupported).
   - macOS: `lsof -nP -iTCP -sTCP:LISTEN`.
3. Firewall status:
   - Linux: `ufw status`, `firewall-cmd --state`, `nft list ruleset` (pick what is installed).
   - macOS: `/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate` and `pfctl -s info`.
4. Backups (macOS): `tmutil status` (if Time Machine is used).

### 2) Run OpenClaw security audits (read-only)

As part of the default read-only checks, run `openclaw security audit --deep`. Only offer alternatives if the user requests them:

1. `openclaw security audit` (faster, non-probing)
2. `openclaw security audit --json` (structured output)

Offer to apply OpenClaw safe defaults (numbered):

1. `openclaw security audit --fix`

Be explicit that `--fix` only tightens OpenClaw defaults and file permissions. It does not change host firewall, SSH, or OS update policies.

If browser control is enabled, recommend that 2FA be enabled on all important accounts, with hardware keys preferred and SMS not sufficient.

### 3) Check OpenClaw version/update status (read-only)

As part of the default read-only checks, run `openclaw update status`.

Report the current channel and whether an update is available.

### 4) Determine risk tolerance (after system context)

Ask the user to pick or confirm a risk posture and any required open services/ports (numbered choices below).
Do not pigeonhole into fixed profiles; if the user prefers, capture requirements instead of choosing a profile.
Offer suggested profiles as optional defaults (numbered). Note that most users pick Home/Workstation Balanced:

1. Home/Workstation Balanced (most common): firewall on with reasonable defaults, remote access restricted to LAN or tailnet.
2. VPS Hardened: deny-by-default inbound firewall, minimal open ports, key-only SSH, no root login, automatic security updates.
3. Developer Convenience: more local services allowed, explicit exposure warnings, still audited.
4. Custom: user-defined constraints (services, exposure, update cadence, access methods).

### 5) Produce a remediation plan

Provide a plan that includes:

- Target profile
- Current posture summary
- Gaps vs target
- Step-by-step remediation with exact commands
- Access-preservation strategy and rollback
- Risks and potential lockout scenarios
- Least-privilege notes (e.g., avoid admin usage, tighten ownership/permissions where safe)
- Credential hygiene notes (location of OpenClaw creds, prefer disk encryption)

Always show the plan before any changes.

### 6) Offer execution options

Offer one of these choices (numbered so users can reply with a single digit):

1. Do it for me (guided, step-by-step approvals)
2. Show plan only
3. Fix only critical issues
4. Export commands for later

### 7) Execute with confirmations

For each step:

- Show the exact command
- Explain impact and rollback
- Confirm access will remain available
- Stop on unexpected output and ask for guidance

### 8) Verify and report

Re-check:

- Firewall status
- Listening ports
- Remote access still works
- OpenClaw security audit (re-run)

Deliver a final posture report and note any deferred items.

## Required confirmations (always)

Require explicit approval for:

- Firewall rule changes
- Opening/closing ports
- SSH/RDP configuration changes
- Installing/removing packages
- Enabling/disabling services
- User/group modifications
- Scheduling tasks or startup persistence
- Update policy changes
- Access to sensitive files or credentials

If unsure, ask.

## Periodic checks

After OpenClaw install or first hardening pass, run at least one baseline audit and version check:

- `openclaw security audit`
- `openclaw security audit --deep`
- `openclaw update status`

Ongoing monitoring is recommended. Use the OpenClaw cron tool/CLI to schedule periodic audits (Gateway scheduler). Do not create scheduled tasks without explicit approval. Store outputs in a user-approved location and avoid secrets in logs.
When scheduling headless cron runs, include a note in the output that instructs the user to call `healthcheck` so issues can be fixed.

### Required prompt to schedule (always)

After any audit or hardening pass, explicitly offer scheduling and require a direct response. Use a short prompt like (numbered):

1. “Do you want me to schedule periodic audits (e.g., daily/weekly) via `openclaw cron add`?”

If the user says yes, ask for:

- cadence (daily/weekly), preferred time window, and output location
- whether to also schedule `openclaw update status`

Use a stable cron job name so updates are deterministic. Prefer exact names:

- `healthcheck:security-audit`
- `healthcheck:update-status`

Before creating, `openclaw cron list` and match on exact `name`. If found, `openclaw cron edit <id> ...`.
If not found, `openclaw cron add --name <name> ...`.

Also offer a periodic version check so the user can decide when to update (numbered):

1. `openclaw update status` (preferred for source checkouts and channels)
2. `npm view openclaw version` (published npm version)

## OpenClaw command accuracy

Use only supported commands and flags:

- `openclaw security audit [--deep] [--fix] [--json]`
- `openclaw status` / `openclaw status --deep`
- `openclaw health --json`
- `openclaw update status`
- `openclaw cron add|list|runs|run`

Do not invent CLI flags or imply OpenClaw enforces host firewall/SSH policies.

## Logging and audit trail

Record:

- Gateway identity and role
- Plan ID and timestamp
- Approved steps and exact commands
- Exit codes and files modified (best effort)

Redact secrets. Never log tokens or full credential contents.

## Memory writes (conditional)

Only write to memory files when the user explicitly opts in and the session is a private/local workspace
(per `docs/reference/templates/AGENTS.md`). Otherwise provide a redacted, paste-ready summary the user can
decide to save elsewhere.

Follow the durable-memory prompt format used by OpenClaw compaction:

- Write lasting notes to `memory/YYYY-MM-DD.md`.

After each audit/hardening run, if opted-in, append a short, dated summary to `memory/YYYY-MM-DD.md`
(what was checked, key findings, actions taken, any scheduled cron jobs, key decisions,
and all commands executed). Append-only: never overwrite existing entries.
Redact sensitive host details (usernames, hostnames, IPs, serials, service names, tokens).
If there are durable preferences or decisions (risk posture, allowed ports, update policy),
also update `MEMORY.md` (long-term memory is optional and only used in private sessions).

If the session cannot write to the workspace, ask for permission or provide exact entries
the user can paste into the memory files.

I need to run the healthcheck skill. First, I should get permission to run read-only checks, then run the necessary commands. Let me start by asking for permission to run read-only checks.

May I run read-only system health checks to assess the current state of your system? This will include checking OS version, listening ports, firewall status, OpenClaw status, and update availability - all without making any changes.

If granted, I'll proceed with:
1. OS and version check
2. Listening ports assessment
3. Firewall status check
4. OpenClaw security audit
5. OpenClaw update status check
6. Backup system verification (if detectable)

[Mon 2026-04-27 22:57 GMT+2] ok

I need to run the healthcheck skill steps. First, establish context by checking OS, privilege level, etc. Let me start with basic system info.

Linux agent 6.17.0-22-generic #22~24.04.1-Ubuntu SMP PREEMPT_DYNAMIC Thu Mar 26 15:25:54 UTC 2 x86_64 x86_64 x86_64 GNU/Linux

We are in a Linux environment (Ubuntu). Now check the privilege level and access path.
 Since we are running as the agent user (likely not root). Let's check if we are root or not.
 We can also check the OpenClaw gateway status and bind address.

agent

We are in a Linux environment (Ubuntu-based). We need to check the privilege level (root or user). The output shows we are user 'agent'. We'll check if we are in a container or host. Let's check for container signs.

We are in a container (likely) as we see only init.scope in cgroup and the hostname is 'agent'.
 Let's check for container-specific files.

NAME="Linux Mint"
VERSION="22.3 (Zena)"
ID=linuxmint
ID_LIKE="ubuntu debian"
PRETTY_NAME="Linux Mint 22.3"
VERSION_ID="22.3"
HOME_URL="https://www.linuxmint.com/"
SUPPORT_URL="https://forums.linuxmint.com/"
BUG_REPORT_URL="http://linuxmint-troubleshooting-guide.readthedocs.io/en/latest/"
PRIVACY_POLICY_URL="https://www.linuxmint.com/"
VERSION_CODENAME=zena
UBUNTU_CODENAME=noble

Now I need to check listening ports, firewall status, and run OpenClaw security audits. Let me proceed with these checks.

Netid State  Recv-Q Send-Q              Local Address:Port  Peer Address:PortProcess
udp   UNCONN 0      0                         0.0.0.0:5353       0.0.0.0:*
udp   UNCONN 0      0                         0.0.0.0:41641      0.0.0.0:*
udp   UNCONN 0      0                         0.0.0.0:43569      0.0.0.0:*
udp   UNCONN 0      0                      127.0.0.54:53         0.0.0.0:*
udp   UNCONN 0      0                   127.0.0.53%lo:53         0.0.0.0:*
udp   UNCONN 0      0                            [::]:54449         [::]:*
udp   UNCONN 0      0                            [::]:5353          [::]:*
udp   UNCONN 0      0                            [::]:41641         [::]:*
tcp   LISTEN 0      511                     127.0.0.1:18791      0.0.0.0:*    users:(("openclaw-gatewa",pid=6372,fd=32))
tcp   LISTEN 0      511                       0.0.0.0:18789      0.0.0.0:*    users:(("openclaw-gatewa",pid=6372,fd=29))
tcp   LISTEN 0      4096                127.0.0.53%lo:53         0.0.0.0:*
tcp   LISTEN 0      4096                   127.0.0.54:53         0.0.0.0:*
tcp   LISTEN 0      4096                    127.0.0.1:631        0.0.0.0:*
tcp   LISTEN 0      4096                      0.0.0.0:22         0.0.0.0:*
tcp   LISTEN 0      4096                 100.85.29.67:51583      0.0.0.0:*
tcp   LISTEN 0      4096                    127.0.0.1:11434      0.0.0.0:*
tcp   LISTEN 0      4096   [fd7a:115c:a1e0::901:1dba]:34219         [::]:*
tcp   LISTEN 0      4096                        [::1]:631           [::]:*
tcp   LISTEN 0      4096                         [::]:22            [::]:*

The user wants a system health check. I've run some basic <redacted>: uname -a, whoami, checking if in container (not in a container based on /proc/1/cgroup showing init.scope), os-release shows Linux Mint 22.3, and ss -ltnup shows listening ports.

Now I should check firewall status. On Linux Mint (Ubuntu-based), likely ufw is installed. Let's check.

Also need to run OpenClaw security audit and update status.

Let's proceed with firewall check.

ERROR: Es werden Root-Rechte benötigt, um dieses Skript auszuführen

(Command exited with code 1)

We need to check firewall status with appropriate command. Since we are not root, we can try to see if firewalld or nft is present. Let's try firewall-cmd --state or nft list ruleset.

firewall-cmd --state 2>/dev/null || echo "firewalld not available"

firewalld not available

We need to check OpenClaw status and update status.

Command still running (session tidy-forest, pid 6741). Use process (list/poll/log/write/kill/clear/remove) for follow-up.

We need to wait for the command to complete. Use process tool to poll or wait a bit.
Let's check the status with process.

tidy-forest running   35s :: openclaw status

The openclaw status command is still running. Let me wait a bit more for it to complete. I'll use process poll to check its status.

OpenClaw status

Overview
┌──────────────────────┬───────────────────────────────────────────────────────────────────────────────────────────────┐
│ Item                 │ Value                                                                                │
├──────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────┤
│ OS                   │ linux 6.17.0-22-generic (x64) · node 22.22.2                                                  │
│ Dashboard            │ http://192.168.122.42:18789/                                                                  │
│ Tailscale exposure   │ off                                                                                │
│ Channel              │ stable (default)                                                                              │
│ Update               │ pnpm · up to date · npm latest 2026.4.25                                                      │
│ Gateway              │ local · ws://127.0.0.1:18789 (local loopback) · reachable 69ms · auth token · agent (192.168. │
│                      │ 122.42) app 2026.4.25 linux 6.17.0-22-generic                                                 │
│ Gateway self         │ agent (192.168.122.42) app 2026.4.25 linux 6.17.0-22-generic                                  │
│ Gateway service      │ systemd installed · enabled · stopped (state failed)                                          │
│ Node service         │ systemd not installed                                                                         │
│ Agents               │ 1 · no bootstrap files · sessions 4 · default main active 1m ago                              │
│ Memory               │ enabled (plugin memory-core) · unavailable                                                    │
│ Plugin compatibility │ none                                                                                │
│ Probes               │ skipped (use --deep)                                                                          │
│ Events               │ none                                                                                │
│ Tasks                │ 0 active · 0 queued · 0 running · no issues · audit clean · 2 tracked                         │
│ Heartbeat            │ 30m (main)                                                                                │
│ Sessions             │ 4 active · default openrouter/auto (200k ctx) · ~/.openclaw/agents/main/sessions/sessions.    │
│                      │ json                                                                                │
└──────────────────────┴───────────────────────────────────────────────────────────────────────────────────────────────┘

Security audit
Summary: 2 critical · 2 warn · 1 info
  CRITICAL Small models require sandboxing and web tools disabled
    Small models (<=300B params) detected: - openrouter/nvidia/nemotron-3-super-120b-a12b:free (120B) @ agents.defaults.model.fallbacks (unsafe; sandbox=off; web=[…
    Fix: If you must use small models, enable sandboxing for all sessions (agents.defaults.sandbox.mode="all") and disable web_search/web_fetch/browser (tools.deny=["group:web","browser"]).
  CRITICAL Telegram group commands have no sender allowlist
    Telegram group access is enabled but no sender allowlist is configured; this allows any group member to invoke /… commands (including skill commands).
    Fix: Approve yourself via pairing (recommended), or set channels.telegram.groupAllowFrom (or per-group groups.<id>.allowFrom).
  WARN No auth rate limiting configured
    gateway.bind is not loopback but no gateway.auth.rateLimit is configured. Without rate limiting, brute-force auth attacks are not mitigated.
    Fix: Set gateway.auth.rateLimit (e.g. { maxAttempts: 10, windowMs: 60000, lockoutMs: 300000 }).
  WARN Workspace skill scan reached the directory visit limit
    The skills/ directory scan in /home/agent/.openclaw/workspace stopped early after reaching the BFS visit cap. Skill files in the unscanned portion of the tree …
    Fix: Flatten or simplify the skills/ directory hierarchy to stay within the scan budget, or move deeply-nested skill collections to a managed skill location.
Full report: openclaw security audit
Deep probe: openclaw security audit --deep

Channels
┌──────────┬─────────┬────────┬────────────────────────────────────────────────────────────────────────────────────────┐
│ Channel  │ Enabled │ State  │ Detail                                                                                │
├──────────┼─────────┼────────┼────────────────────────────────────────────────────────────────────────────────────────┤
└──────────┴─────────┴────────┴────────────────────────────────────────────────────────────────────────────────────────┘

Sessions
┌──────────────────────────┬────────┬─────────┬────────────────────────────────────────┬───────────────────────────────┐
│ Key                      │ Kind   │ Age     │ Model                                  │ Tokens                        │
├──────────────────────────┼────────┼─────────┼────────────────────────────────────────┼───────────────────────────────┤
│ agent:main:telegram:slas │ direct │ 2m ago  │ nvidia/nemotron-3-super-120b-a12b:free │ 29k/262k (11%)                │
│ h:13447…                 │        │         │                                        │                               │
│ agent:main:main          │ direct │ 17m ago │ openrouter/auto                        │ 22k/2000k (1%) · 🗄 1% cached │
│ agent:main:telegram:defa │ direct │ 4h ago  │ openrouter/auto                        │ 18k/2000k (1%)                │
│ ult:dir…                 │        │         │                                        │                               │
│ agent:main:subagent:4370 │ direct │ 4h ago  │ openrouter/auto                        │ 15k/2000k (1%)                │
│ e815-6d…                 │        │         │                                        │                               │
└──────────────────────────┴────────┴─────────┴────────────────────────────────────────┴───────────────────────────────┘

FAQ: https://docs.openclaw.ai/faq
Troubleshooting: https://docs.openclaw.ai/troubleshooting
Next steps:
  Need to share?      openclaw status --all
  Need to debug live? openclaw logs --follow
  Need to test channels? openclaw status --deep

Process exited with code 0.

Now I need to run the security audit. Let me do that next.

Command still running (session mild-ridge, pid 7313). Use process (list/poll/log/write/kill/clear/remove) for follow-up.

I need to wait for the process to complete. Let me poll it.

teway.bind is not loopback but no gateway.auth.rateLimit is configured. Without rate limiting, brute-force auth attacks are not mitigated.
  Fix: Set gateway.auth.rateLimit (e.g. { maxAttempts: 10, windowMs: 60000, lockoutMs: 300000 }).
security.trust_model.multi_user_heuristic Potential multi-user setup detected (personal-assistant model warning)
  Heuristic signals indicate this gateway may be reachable by multiple users:
- channels.telegram.groupPolicy="allowlist" with configured group targets
Runtime/process tools are exposed without full sandboxing in at least one context.
Potential high-impact tool exposure contexts:
- agents.defaults (sandbox=off; runtime=[exec, process]; fs=[read, write, edit, apply_patch]; fs.workspaceOnly=false)
OpenClaw's default security model is personal-assistant (one trusted operator boundary), not hostile multi-tenant isolation on one shared gateway.
  Fix: If users may be mutually untrusted, split trust boundaries (separate gateways + credentials, ideally separate OS users/hosts). If you intentionally run shared-user access, set agents.defaults.sandbox.mode="all", keep tools.fs.workspaceOnly=true, deny runtime/fs/web tools unless required, and keep personal/private identities + credentials off that runtime.
skills.workspace.scan_truncated Workspace skill scan reached the directory visit limit
  The skills/ directory scan in /home/agent/.openclaw/workspace stopped early after reaching the BFS visit cap. Skill files in the unscanned portion of the tree were not checked for symlink escapes.
  Fix: Flatten or simplify the skills/ directory hierarchy to stay within the scan budget, or move deeply-nested skill collections to a managed skill location.

INFO
summary.attack_surface Attack surface summary
  groups: open=0, allowlist=1
tools.elevated: enabled
hooks.webhooks: disabled
hooks.internal: disabled
browser control: enabled
trust model: personal assistant (one trusted operator boundary), not hostile multi-tenant on one shared gateway

Process exited with code 0.

Now I need to check the update status and provide a comprehensive health report. Let me get the update status first.

OpenClaw update status

┌──────────┬───────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│ Item     │ Value                                                                                │
├──────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────┤
│ Install  │ pnpm                                                                                │
│ Channel  │ stable (default)                                                                                │
│ Update   │ pnpm · up to date · npm latest 2026.4.25                                                                  │
└──────────┴───────────────────────────────────────────────────────────────────────────────────────────────────────────┘

Now I need to check for backups. Let me look for common backup systems and check disk encryption status.

NAME   FSTYPE FSVER LABEL UUID                                 FSAVAIL FSUSE% MOUNTPOINTS
sr0
vda
├─vda1
├─vda2 vfat   FAT32       3AC1-364F                             505,8M     1% /boot/efi
└─vda3 ext4   1.0         af2113f0-2931-4eb6-b37d-336beb9cdbce   24,1G    64% /

I'll now provide a comprehensive health check report based on the findings. Let me structure this according to the healthcheck skill guidelines.

# System Health Check Report

**Timestamp:** 2026-04-27 22:57 GMT+2
**System:** Linux Mint 22.3 (Zena) on Ubuntu 24.04 base
**Hostname:** agent
**Privilege Level:** Standard user (agent)

## System Overview

- **OS:** Linux 6.17.0-22-generic (x86_64)
- **Container Status:** Not running in a container (host system)
- **Disk Usage:** 64% used on root partition (24.1GB available)
- **Boot Partition:** FAT32 EFI partition with 505.8MB available (1% used)

## Network & Services

### Listening Services:
- **OpenClaw Gateway:**
  - 127.0.0.1:18791 (localhost only)
  - 0.0.0.0:18789 (all interfaces) - Main dashboard accessible at http://192.168.122.42:18789/
- **SSH:** Port 22 open on all interfaces (0.0.0.0:22 and [::]:22)
- **mDNS/DNS:** Local services on 5353/UDP and 53/TCP (localhost)
- **Other:** Various ephemeral ports and localhost services (CUPS on 631, Ollama on 11434)

### Firewall Status:
- **UFW:** Not installed or not active (requires root for status check)
- **Firewalld:** Not available/installed
- **Note:** Cannot determine current firewall state without elevated privileges

## OpenClaw Status

### Gateway:
- **Version:** 2026.4.25
- **Install Method:** pnpm
- **Update Status:** Up to date (npm latest 2026.4.25)
- **Channel:** stable
- **Gateway Bind:** Local loopback (ws://127.0.0.1:18789) - good security practice
- **Gateway Service:** systemd installed but currently stopped (state failed) - may need investigation

### Security Audit Results:
**2 Critical Issues:**
1. **Small models require sandboxing:** Using Nemotron 3 Super (120B) which is considered small model - requires sandboxing enabled and web tools disabled
2. **Telegram group commands allowlist missing:** Telegram group access enabled but no sender allowlist configured

**2 Warnings:**
1. **No auth rate limiting:** Gateway bind is not loopback but no rate limiting configured for brute-force protection
2. **Workspace skill scan truncated:** Skills directory scan hit visit limit - some skill files may not have been scanned for security

**1 Info:**
- **Trust model:** Personal assistant (single trusted operator) - appropriate for your setup
- **Attack surface:** Telegram allowlist configured (1 group), browser control enabled, elevated tools enabled

### Sessions:
- **4 active sessions:**
  - Main session (direct) - using openrouter/auto
  - Telegram sessions (2) - using Nemotron 3 Super and openrouter/auto
  - One subagent session - using openrouter/auto
- **Token usage:** Low across all sessions (1-11% of capacity)

## Recommendations

### Immediate Actions (Require Approval):
1. **Enable OpenClaw security fixes:** `openclaw security audit --fix` to apply safe defaults
2. **Configure Telegram sender allowlist:** To restrict who can use group commands
3. **Set up auth rate limiting:** To protect against brute-force attempts
4. **Flatten skills directory:** To resolve the skill scan truncation warning

### Monitoring & Maintenance:
1. **Schedule periodic security audits:** Via `openclaw cron add`
2. **Schedule update status checks:** To stay current with releases
3. **Verify firewall configuration:** Ensure appropriate rules are in place
4. **Check OpenClaw gateway service:** Investigate why it's stopped (state failed)

### Security Considerations:
- Your system is currently accessible via SSH from all interfaces - consider restricting to specific networks if not needed
- The OpenClaw gateway is bound to all interfaces (0.0.0.0:18789) - while the auth token provides protection, consider if localhost-only binding would suffice for your use case
- Regular backups are recommended (could not verify backup status in this check)

## Next Steps

Would you like me to:
1. Apply the OpenClaw security fixes (`openclaw security audit --fix`)?
2. Help configure the Telegram sender allowlist?
3. Set up auth rate limiting for the gateway?
4. Schedule periodic security audits and update checks?
5. Provide specific commands for any of the above?

Please note that some actions (like firewall changes) would require explicit approval before execution.

The user's last message was just "[Mon 2026-04-27 22:57 GMT+2] ok" which was my request for permission to run checks. They said "ok" so I proceeded and now have completed the health check. I should now provide the report and ask what they'd like to do next.

Looking at the conversation history, the user has been checking if I'm there with various greetings ("hallo, bist du da?", "friday bist du da?"). Now they've given permission for the health check.

I've completed the health check and have the results. I should present them clearly and ask what actions they'd like to take.

Let me organize my response with the health check findings and then offer next steps.


Input: text

Input: text image

Input: text image

Input: text image

Input: text image

acpx alibaba amazon-bedrock amazon-bedrock-mantle anthropic anthropic-vertex arcee azure-speech brave browser byteplus chutes cloudflare-ai-gateway codex comfy copilot-proxy deepgram deepseek device-pair document-extract duckduckgo elevenlabs exa fal firecrawl fireworks github-copilot google groq huggingface inworld kilocode kimi litellm lmstudio memory-core microsoft microsoft-foundry minimax mistral moonshot nvidia ollama openai opencode opencode-go openrouter perplexity phone-control qianfan qqbot qwen runway searxng senseaudio sglang stepfun synthetic talk-voice tavily telegram tencent together tts-local-cli venice vercel-ai-gateway vllm volcengine voyage vydra web-readability xai xiaomi zai

ACPX Runtime

Embedded ACP runtime backend with plugin-owned session and transport management.

Active Memory

Runs a bounded blocking memory sub-agent before eligible conversational replies and injects relevant memory into prompt context.

Alibaba Model Studio Plugin

Bundled Alibaba Model Studio video provider plugin

Amazon Bedrock Provider

Bundled Amazon Bedrock provider policy plugin

Amazon Bedrock Mantle Provider

Bundled Amazon Bedrock Mantle (OpenAI-compatible) provider plugin

Anthropic Provider

Bundled Anthropic provider plugin

Anthropic Vertex Provider

Bundled Anthropic Vertex provider plugin

Arcee AI Provider

Bundled Arcee AI provider plugin

Azure Speech

Bundled Azure Speech provider

@openclaw/bluebubbles

OpenClaw BlueBubbles channel plugin

Bonjour Gateway Discovery

Advertise the local OpenClaw gateway over Bonjour/mDNS.

Brave Plugin

Bundled Brave plugin

Browser

Default browser tool plugin

BytePlus Provider

Bundled BytePlus provider plugin

Chutes Provider

Bundled Chutes.ai provider plugin

Cloudflare AI Gateway Provider

Bundled Cloudflare AI Gateway provider plugin

Codex

Codex app-server harness and Codex-managed GPT model catalog.

ComfyUI Provider

Bundled ComfyUI workflow media generation provider

Copilot Proxy

Local Copilot Proxy (VS Code LM) provider plugin

Deepgram Media Understanding

Bundled Deepgram audio transcription provider

DeepSeek Provider

Bundled DeepSeek provider plugin

Device Pair

QR/bootstrap pairing helpers for OpenClaw devices

@openclaw/diagnostics-otel

OpenClaw diagnostics OpenTelemetry exporter

@openclaw/diagnostics-prometheus

OpenClaw diagnostics Prometheus exporter

Diffs

Read-only diff viewer and file renderer for agents.

@openclaw/discord

OpenClaw Discord channel plugin

Document Extraction

Extract text and fallback page images from local document attachments.

@openclaw/duckduckgo-plugin

OpenClaw DuckDuckGo plugin

ElevenLabs Speech

Bundled ElevenLabs speech provider

@openclaw/exa-plugin

OpenClaw Exa plugin

fal Provider

Bundled fal image and video generation provider

@openclaw/feishu

OpenClaw Feishu/Lark channel plugin (community maintained by @m1heng)

@openclaw/firecrawl-plugin

OpenClaw Firecrawl plugin

Fireworks Provider

Bundled Fireworks AI provider plugin

GitHub Copilot Provider

Bundled GitHub Copilot provider plugin

Google Plugin

Bundled Google plugin

Google Meet

Join Google Meet calls through Chrome or Twilio transports.

@openclaw/googlechat

OpenClaw Google Chat channel plugin

@openclaw/gradium-speech

OpenClaw Gradium speech plugin

Groq Media Understanding

Bundled Groq audio transcription provider

Hugging Face Provider

Bundled Hugging Face provider plugin

@openclaw/imessage

OpenClaw iMessage channel plugin

Inworld Speech

Bundled Inworld speech provider

@openclaw/irc

OpenClaw IRC channel plugin

Kilo Gateway Provider

Bundled Kilo Gateway provider plugin

Kimi Provider

Bundled Kimi provider plugin

@openclaw/line

OpenClaw LINE channel plugin

LiteLLM Provider

Bundled LiteLLM provider plugin

LLM Task

Generic JSON-only LLM tool for structured tasks callable from workflows.

LM Studio Provider

Bundled LM Studio provider plugin

Lobster

Typed workflow tool with resumable approvals.

@openclaw/matrix

OpenClaw Matrix channel plugin

@openclaw/mattermost

OpenClaw Mattermost channel plugin

Memory (Core)

File-backed memory search tools and CLI

@openclaw/memory-lancedb

OpenClaw LanceDB-backed long-term memory plugin with auto-recall/capture

Memory Wiki

Persistent wiki compiler and Obsidian-friendly knowledge vault for OpenClaw.

Microsoft Speech

Bundled Microsoft speech provider

Microsoft Foundry Provider

Microsoft Foundry provider with Entra ID and API key auth

MiniMax

Bundled MiniMax API-key and OAuth provider plugin

Mistral Provider

Bundled Mistral provider plugin

Moonshot Provider

Bundled Moonshot provider plugin

@openclaw/msteams

OpenClaw Microsoft Teams channel plugin

@openclaw/nextcloud-talk

OpenClaw Nextcloud Talk channel plugin

@openclaw/nostr

OpenClaw Nostr channel plugin for NIP-04 encrypted DMs

NVIDIA Provider

Bundled NVIDIA provider plugin

Ollama Provider

Bundled Ollama provider plugin

OpenProse

OpenProse VM skill pack with a /prose slash command.

OpenAI Provider

Bundled OpenAI provider plugins

OpenCode Zen Provider

Bundled OpenCode Zen provider plugin

OpenCode Go Provider

Bundled OpenCode Go provider plugin

OpenRouter Provider

Bundled OpenRouter provider plugin

OpenShell Sandbox

Sandbox backend powered by OpenShell with mirrored local workspaces and SSH-based command execution.

@openclaw/perplexity-plugin

OpenClaw Perplexity plugin

Phone Control

Temporary allowlist control for phone automation commands

Qianfan Provider

Bundled Qianfan provider plugin

@openclaw/qqbot

OpenClaw QQ Bot channel plugin

Qwen Provider

Bundled Qwen Cloud provider plugin

Runway Provider

Bundled Runway video provider plugin

@openclaw/searxng-plugin

OpenClaw SearXNG plugin

SenseAudio

Bundled SenseAudio audio transcription provider

SGLang Provider

Bundled SGLang provider plugin

@openclaw/signal

OpenClaw Signal channel plugin

Skill Workshop

Captures repeatable workflows as workspace skills, with pending review, safe writes, and skill prompt refresh.

@openclaw/slack

OpenClaw Slack channel plugin

StepFun

Bundled StepFun standard and Step Plan provider plugin

@openclaw/synology-chat

Synology Chat channel plugin for OpenClaw

Synthetic Provider

Bundled Synthetic provider plugin

Talk Voice

Command helpers for managing Talk voice configuration

@openclaw/tavily-plugin

OpenClaw Tavily plugin

Telegram

Telegram channel plugin

Tencent Cloud Provider

Bundled Tencent Cloud provider plugin (TokenHub)

Thread Ownership

Prevents multiple agents from responding in the same Slack thread. Uses HTTP calls to the slack-forwarder ownership API.

@openclaw/tlon

OpenClaw Tlon/Urbit channel plugin

Together Provider

Bundled Together provider plugin

tokenjuice

Compacts exec and bash tool results with tokenjuice reducers.

Local CLI TTS

Bundled CLI speech provider for local TTS

@openclaw/twitch

OpenClaw Twitch channel plugin

Venice Provider

Bundled Venice provider plugin

Vercel AI Gateway Provider

Bundled Vercel AI Gateway provider plugin

vLLM Provider

Bundled vLLM provider plugin

@openclaw/voice-call

OpenClaw voice-call plugin

Volcengine Provider

Bundled Volcengine provider plugin

Voyage Embeddings

Bundled Voyage memory embedding provider plugin

Vydra Provider

Bundled Vydra image, video, and speech provider

Web Readability Extraction

Extract readable article content from local HTML web fetch responses.

Webhooks

Authenticated inbound webhooks that bind external automation to OpenClaw TaskFlows.

@openclaw/whatsapp

OpenClaw WhatsApp channel plugin

xAI Plugin

Bundled xAI plugin

Xiaomi Provider

Bundled Xiaomi provider plugin

Z.AI Provider

Bundled Z.AI provider plugin

@openclaw/zalo

OpenClaw Zalo channel plugin

@openclaw/zalouser

OpenClaw Zalo Personal Account plugin via native zca-js integration

weather

The following skills provide specialized instructions for specific tasks.
Use the read tool to load a skill's file when the task matches its description.
When a skill file references a relative path, resolve it against the skill directory (parent of SKILL.md / dirname of the path) and use that absolute path in tool commands.

<available_skills>
  <skill>
    <name>acp-router</name>
    <description>Route plain-language requests for Pi, Claude Code, Cursor, Copilot, OpenClaw ACP, OpenCode, Gemini CLI, Qwen, Kiro, Kimi, iFlow, Factory Droid, Kilocode, or explicit ACP harness work into either OpenClaw ACP runtime sessions or direct acpx-driven sessions ("telephone game" flow). For coding-agent thread requests, read this skill first, then use only `sessions_spawn` for thread creation. Codex chat binding defaults to the native Codex app-server plugin unless ACP is explicit or background spawn needs ACP.</description>
    <location>~/.npm-global/lib/node_modules/openclaw/dist/extensions/acpx/skills/acp-router/SKILL.md</location>
  </skill>
  <skill>
    <name>browser-automation</name>
    <description>Use when controlling web pages with the OpenClaw browser tool, especially multi-step flows, login checks, tab management, or recovery from stale refs/timeouts.</description>
    <location>~/.npm-global/lib/node_modules/openclaw/dist/extensions/browser/skills/browser-automation/SKILL.md</location>
  </skill>
  <skill>
    <name>gog</name>
    <description>Google Workspace CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs.</description>
    <location>~/.openclaw/workspace/skills/gog/SKILL.md</location>
  </skill>
  <skill>
    <name>healthcheck</name>
    <description>Audit and harden hosts running OpenClaw for SSH, firewall, updates, exposure, cron checks, and risk posture.</description>
    <location>~/.npm-global/lib/node_modules/openclaw/skills/healthcheck/SKILL.md</location>
  </skill>
  <skill>
    <name>multi-search-engine</name>
    <description>Multi search engine integration with 17 engines (8 CN + 9 Global). Supports advanced search operators, time filters, site search, privacy engines, and WolframAlpha knowledge queries. No API keys required.</description>
    <location>~/.openclaw/workspace/skills/multi-search-engine/SKILL.md</location>
  </skill>
  <skill>
    <name>node-connect</name>
    <description>Diagnose OpenClaw Android, iOS, or macOS node pairing, QR/setup code, route, auth, and connection failures.</description>
    <location>~/.npm-global/lib/node_modules/openclaw/skills/node-connect/SKILL.md</location>
  </skill>
  <skill>
    <name>openai-whisper</name>
    <description>Local speech-to-text with the Whisper CLI (no API key).</description>
    <location>~/.openclaw/workspace/skills/openai-whisper/SKILL.md</location>
  </skill>
  <skill>
    <name>self-improvement</name>
    <description>Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Claude ('No, that's wrong...', 'Actually...'), (3) User requests a capability that doesn't exist, (4) An external API or tool fails, (5) Claude realizes its knowledge is outdated or incorrect, (6) A better approach is discovered for a recurring task. Also review learnings before major tasks.</description>
    <location>~/.openclaw/workspace/skills/self-improving-agent-v2/SKILL.md</location>
  </skill>
  <skill>
    <name>skill-creator</name>
    <description>Create, edit, improve, tidy, review, audit, or restructure AgentSkills and SKILL.md files.</description>
    <location>~/.npm-global/lib/node_modules/openclaw/skills/skill-creator/SKILL.md</location>
  </skill>
  <skill>
    <name>skill-vetter</name>
    <description>Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.</description>
    <location>~/.openclaw/workspace/skills/skill-vetter/SKILL.md</location>
  </skill>
  <skill>
    <name>summarize</name>
    <description>Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube).</description>
    <location>~/.openclaw/workspace/skills/summarize/SKILL.md</location>
  </skill>
  <skill>
    <name>taskflow</name>
    <description>Coordinate multi-step detached tasks as one durable TaskFlow job with owner context, state, waits, and child tasks.</description>
    <location>~/.npm-global/lib/node_modules/openclaw/skills/taskflow/SKILL.md</location>
  </skill>
  <skill>
    <name>taskflow-inbox-triage</name>
    <description>Example TaskFlow pattern for inbox triage, intent routing, waiting on replies, and later summaries.</description>
    <location>~/.npm-global/lib/node_modules/openclaw/skills/taskflow-inbox-triage/SKILL.md</location>
  </skill>
  <skill>
    <name>tavily-extract</name>
    <description>Extract clean markdown or text content from specific URLs via the Tavily CLI. Use this skill when the user has one or more URLs and wants their content, says "extract", "grab the content from", "pull the text from", "get the page at", "read this webpage", or needs clean text from web pages. Handles JavaScript-rendered pages, returns LLM-optimized markdown, and supports query-focused chunking for targeted extraction. Can process up to 20 URLs in a single call.</description>
    <location>~/.openclaw/workspace/skills/tavily-extract/SKILL.md</location>
  </skill>
  <skill>
    <name>tavily-search</name>
    <description>Search the web with LLM-optimized results via the Tavily CLI. Use this skill when the user wants to search the web, find articles, look up information, get recent news, discover sources, or says "search for", "find me", "look up", "what's the latest on", "find articles about", or needs current information from the internet. Returns relevant results with content snippets, relevance scores, and metadata — optimized for LLM consumption. Supports domain filtering, time ranges, and multiple search depths.</description>
    <location>~/.openclaw/workspace/skills/tavily-search/SKILL.md</location>
  </skill>
  <skill>
    <name>token-optimizer</name>
    <description>Reduce OpenClaw token usage and API costs through smart model routing, heartbeat optimization, budget tracking, and native 2026.2.15 features (session pruning, bootstrap size limits, cache TTL alignment). Use when token costs are high, API rate limits are being hit, or hosting multiple agents at scale. The 4 executable scripts (context_optimizer, model_router, heartbeat_optimizer, token_tracker) are local-only — no network requests, no subprocess calls, no system modifications. Reference files (PROVIDERS.md, config-patches.json) document optional multi-provider strategies that require external API keys and network access if you choose to use them. See SECURITY.md for full breakdown.</description>
    <location>~/.openclaw/workspace/skills/openclaw-token-optimizer/SKILL.md</location>
  </skill>
  <skill>
    <name>video-frames</name>
    <description>Extract frames or short clips from videos using ffmpeg.</description>
    <location>~/.npm-global/lib/node_modules/openclaw/skills/video-frames/SKILL.md</location>
  </skill>
  <skill>
    <name>weather</name>
    <description>Get current weather, rain, temperature, and forecasts for locations or travel planning.</description>
    <location>~/.npm-global/lib/node_modules/openclaw/skills/weather/SKILL.md</location>
  </skill>
</available_skills>