Skills openclaw-secure-linux-cloud
📦
openclaw-secure-linux-cloud
Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access
Secure OpenClaw on Linux Cloud
Self-hosting OpenClaw on a cloud server can expose a powerful control plane. This skill guides private deployment with SSH tunneling, Podman, token auth, sandboxing, and firewall checks.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "openclaw-secure-linux-cloud" from https://skillstore.io/skills/xixu-me-openclaw-secure-linux-cloud.md and its manifest at https://skillstore.io/api/skills/xixu-me-openclaw-secure-linux-cloud/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "openclaw-secure-linux-cloud". I want OpenClaw on a VPS for personal use only.
Expected outcome:
- Recommended path: keep the gateway private and use an SSH tunnel.
- Harden SSH and firewall rules before OpenClaw becomes reachable.
- Use narrow tool permissions and keep sandboxing enabled.
Using "openclaw-secure-linux-cloud". My OpenClaw UI is reachable from the internet.
Expected outcome:
- Immediate concern: public Control UI exposure increases risk even with token auth.
- Move access behind a private path first, then review auth and logs.
- Consider a reverse proxy only when public access is required.
Using "openclaw-secure-linux-cloud". Should I use Tailscale or a reverse proxy?
Expected outcome:
- Use Tailscale when trusted devices need repeated private access.
- Use a reverse proxy only for a clear public access requirement.
- Keep loopback binding as the baseline unless the design changes deliberately.
Security Audit
Criticalv4 • 7/8/2026 Open versioned report
The skill is legitimate security guidance, and many SKILL.md alerts are Markdown false positives. However, the reference includes privileged host changes, persistent service enablement, token display, and root execution of project scripts from a cloned repository. These commands require strong user confirmation and safer installation guidance before publication.
2
Files scanned
505
Lines analyzed
17
Review items
0
False positives ignored
Confirmed security concerns (5)
Critical
Privileged Setup Script Execution
The reference clones OpenClaw from GitHub and then runs a project setup script with sudo. This combines external source retrieval with root code execution.
The lines show the install flow from external clone to sudo script execution. This is a clear supply-chain and privilege boundary risk.
High
Environment file access
sudo -u openclaw grep '^OPENCLAW_GATEWAY_TOKEN=' /home/openclaw/.openclaw/.env
The command extracts OPENCLAW_GATEWAY_TOKEN from a .env file. Revealing this token can compromise the OpenClaw gateway.
High
Systemd service enablement
sudo systemctl enable --now unattended-upgrades
The command enables unattended-upgrades as a persistent system service. Persistent service changes must be explicit and reviewed.
High
Systemd service enablement
sudo systemctl enable --now nftables
The command enables nftables persistently and starts it immediately. This can alter host networking across reboots.
High
Remote Lockout Risk From SSH and Firewall Changes
The reference changes SSH authentication and replaces nftables rules on a remote host. Incorrect use can lock out administration or change exposed services.
The cited section writes SSH and firewall configuration, then reloads or enables services. The risk is operational and depends on careful sequencing.
Capability review items (17)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Critical
sudo privilege escalation
sudo ./setup-podman.sh --quadlet
The command runs a repository setup script with sudo. Executing downloaded project scripts as root is a direct privileged code execution risk.
Critical
sudo privilege escalation
sudo ./scripts/run-openclaw-podman.sh launch setup
The command runs an OpenClaw helper script with sudo. It is privileged project code execution and can alter service or host state.
High
sudo privilege escalation
sudo apt update
This is a privileged package-manager command in copy-paste guidance. It can change host package state if an assistant or user runs it.
High
sudo privilege escalation
sudo apt full-upgrade -y
A full system upgrade with sudo can replace core packages and affect availability. It is legitimate hardening guidance but still a privileged host change.
High
sudo privilege escalation
sudo apt install -y git curl openssl podman nftables unattended-upgrades apt-listchanges
The command installs packages with root privileges. This changes the trusted computing base and depends on the configured package sources.
High
sudo privilege escalation
sudo tee /etc/apt/apt.conf.d/20auto-upgrades >/dev/null <<'EOF'
The command writes an apt configuration file under /etc with sudo. Misuse can change unattended upgrade behavior across the host.
High
sudo privilege escalation
sudo systemctl enable --now unattended-upgrades
The command enables and starts a systemd service. That creates persistent host behavior and should require explicit user approval.
High
sudo privilege escalation
sudo tee /etc/ssh/sshd_config.d/99-openclaw-hardening.conf >/dev/null <<'EOF'
The command writes SSH daemon hardening settings under /etc. Incorrect SSH changes can lock out remote access or weaken the login path.
High
sudo privilege escalation
sudo systemctl reload ssh
Reloading SSH applies privileged configuration changes to the active daemon. A wrong setting can disrupt remote administration.
High
sudo privilege escalation
sudo tee /etc/nftables.conf >/dev/null <<'EOF'
The command replaces the host nftables configuration with root privileges. Firewall mistakes can expose services or cut off access.
High
sudo privilege escalation
sudo systemctl enable --now nftables
The command enables and starts nftables as a persistent system service. It changes network enforcement at boot and runtime.
High
sudo privilege escalation
sudo nft -f /etc/nftables.conf
Loading nftables rules with sudo immediately changes firewall behavior. A bad rule set can expose or block critical network paths.
High
sudo privilege escalation
sudo git clone https://github.com/openclaw/openclaw.git
The command clones external source code into /opt with sudo. That introduces supply-chain risk and root-owned files from a remote repository.
High
sudo privilege escalation
sudo -u openclaw grep '^OPENCLAW_GATEWAY_TOKEN=' /home/openclaw/.openclaw/.env
The command reads the OpenClaw gateway token from a protected environment file. Displaying that token can disclose a control-plane secret.
High
sudo privilege escalation
sudo systemctl --machine openclaw@ --user restart openclaw.service
Restarting the OpenClaw service with sudo changes active service state. It can disrupt access or apply unsafe configuration changes.
High
Hidden file access
sudo -u openclaw grep '^OPENCLAW_GATEWAY_TOKEN=' /home/openclaw/.openclaw/.env
The command reads a hidden .env file under the OpenClaw user home. That file contains a gateway token and should be handled as secret material.
Medium
Hardcoded URL
sudo git clone https://github.com/openclaw/openclaw.git
The command depends on a hardcoded external GitHub repository. This is expected for installation but still creates supply-chain reliance.
Risk Factors
⚙️ External commands (31)
references/REFERENCE.md:118 references/REFERENCE.md:99 references/REFERENCE.md:100 references/REFERENCE.md:101 references/REFERENCE.md:107 references/REFERENCE.md:112 references/REFERENCE.md:118 references/REFERENCE.md:120 references/REFERENCE.md:130 references/REFERENCE.md:131 references/REFERENCE.md:137 references/REFERENCE.md:164 references/REFERENCE.md:165 references/REFERENCE.md:166 references/REFERENCE.md:173 references/REFERENCE.md:176 references/REFERENCE.md:182 references/REFERENCE.md:183 references/REFERENCE.md:190 references/REFERENCE.md:196 references/REFERENCE.md:202 references/REFERENCE.md:203 references/REFERENCE.md:252 references/REFERENCE.md:253 references/REFERENCE.md:254 SKILL.md:16 SKILL.md:25 SKILL.md:76 SKILL.md:77 SKILL.md:80 SKILL.md:152
🌐 Network access (6)
📁 Filesystem access (13)
references/REFERENCE.md:309 references/REFERENCE.md:324 references/REFERENCE.md:196 references/REFERENCE.md:252 references/REFERENCE.md:253 references/REFERENCE.md:254 references/REFERENCE.md:309 references/REFERENCE.md:324 references/REFERENCE.md:107 references/REFERENCE.md:120 references/REFERENCE.md:137 SKILL.md:80 SKILL.md:80
Detected Patterns
Systemd service enablement×2
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/xixu-me-openclaw-secure-linux-cloud/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/xixu-me-openclaw-secure-linux-cloud?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/xixu-me-openclaw-secure-linux-cloud?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/xixu-me-openclaw-secure-linux-cloud/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/xixu-me-openclaw-secure-linux-cloud.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
xixu-me. (2026). openclaw-secure-linux-cloud security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/xixu-me-openclaw-secure-linux-cloud/audits/4BibTeX citation
@techreport{xixu-me-xixu-me-openclaw-secure-linux-cloud-2026,
author = {xixu-me},
title = {openclaw-secure-linux-cloud security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/xixu-me-openclaw-secure-linux-cloud/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "openclaw-secure-linux-cloud security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "xixu-me"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/xixu-me-openclaw-secure-linux-cloud/audits/4"
identifiers:
- type: other
value: "skillstore:xixu-me-openclaw-secure-linux-cloud:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 41
Architecture
85
Maintainability
85
Content
70
Community
83
Spec Compliance
What You Can Build
Plan a private deployment
Create a secure first-run plan for OpenClaw on a new Linux VPS.
Review an exposed host
Identify risky OpenClaw exposure and prioritize safer access controls.
Choose an access model
Compare SSH tunneling, Tailscale, and reverse proxy options for remote control.
Try These Prompts
Plan a first deployment
Help me deploy OpenClaw on a Linux VPS with private access only. Ask for blocking details first.
Check my current setup
Review my OpenClaw cloud setup for exposure risks. Focus on network binding, auth, sandboxing, and permissions.
Compare access options
Compare SSH tunnel, Tailscale, and reverse proxy access for my OpenClaw host. Recommend the lowest-risk path.
Build a hardening runbook
Create a staged OpenClaw hardening runbook with validation steps, rollback notes, and commands separated by local and server context.
Best Practices
- Confirm the target host and distro before using package or firewall commands.
- Keep OpenClaw private by default and expose it only after a documented need.
- Review privileged commands with the user before execution.
Avoid
- Binding the gateway to all interfaces during first setup.
- Treating token authentication as a replacement for network boundaries.
- Running broad tool permissions before the workflow requires them.
Frequently Asked Questions
Does this skill install OpenClaw automatically?
No. It provides guidance and example commands that users must review before use.
Which platforms does it target?
It targets Linux cloud hosts, with Debian and Ubuntu examples in the reference.
Why does it prefer SSH tunneling?
SSH tunneling keeps the Control UI private while the user validates the deployment.
Can it help with Tailscale?
Yes. It explains when Tailscale is useful for repeated private access across trusted devices.
Does it support public reverse proxy deployment?
It discusses reverse proxy use only when public access is required and extra safeguards are accepted.
Why are privileged commands included?
Host hardening often needs elevated commands. Users should inspect each command before running it.
Developer Details
Author
xixu-meLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
64ca8af0f54a325752f08bd54e52151061ea659a
Maintenance freshness
7/23/2026
Usage
13 downloads · 208 views
File structure