Skip to main content
affpapa.org
RU EN
skill Claude Code CX Codex Cursor GitHub Copilot

healthcheck — Claude Code skill: what it does, how to install

Audits OpenClaw host security, listening ports, SSH, and firewalls. Spots exposures and applies staged hardening without locking you out.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add openclaw/openclaw --skill healthcheck -a claude-code
Open on GitHub

What healthcheck does

The skill inspects host security, checking privilege levels and access paths. Diagnosis comes first. The tool runs read-only commands like openclaw security audit --deep and openclaw doctor --lint. It also inspects active firewall rules, disk encryption, and listening sockets on Linux, macOS, or Windows.

After reporting the findings, the agent suggests a hardening posture from low friction to strict lockdown. It never touches SSH settings, firewall rules, or gateway bindings without explicit approval for each change. This prevents accidental lockouts during remote sessions.

Install this skill if you run OpenClaw on a workstation or remote server and want to lock down the gateway. For isolated disposable containers, skip it.

What it helps with

  • audit listening ports and network exposure
  • verify disk encryption and backup status
  • bind the OpenClaw gateway safely to local or tailnet interfaces
  • harden SSH access and firewall rules without dropping connections

Example prompts for the agent

  • Run a security audit on this host
  • Check firewall status and OpenClaw gateway binding
  • Help me close exposed ports safely

How to install healthcheck

1Skills CLI (Vercel)

npx skills add openclaw/openclaw --skill healthcheck -a claude-code

2Manually: put the files in place

~/.claude/skills/healthcheck/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/healthcheck/

From the same set45

The whole set →
summarize openclaw Runs a CLI tool to summarize or transcribe web articles, YouTube videos, podcasts, and local PDF documents directly within your AI assistant. Claude Code CX Codex Cursor +1 26,900installs weather openclaw This skill fetches current conditions and forecasts for a city, region, airport code, or coordinates. Use it to check rain and temperature or plan a trip. Claude Code CX Codex Cursor +1 9,300installs gog openclaw Guides an agent using the gog CLI for Gmail, Calendar, Drive, Contacts, Sheets, and Docs. Use it when Google Workspace tasks need to run from a terminal. Claude Code CX Codex Cursor +1 8,500installs tmux openclaw Lets an agent work with live tmux sessions: read pane output, send keys and text, wait for a prompt line to show up. Claude Code CX Codex Cursor +1 8,400installs openai-whisper openclaw This skill lets your agent call the Whisper CLI to transcribe audio on your own machine. No API key needed. Claude Code CX Codex Cursor +1 7,100installs nano-pdf openclaw Edit PDF pages with plain text instructions through the nano-pdf CLI. Useful when you need to fix a typo or swap a heading without leaving your terminal. Claude Code CX Codex Cursor +1 7,100installs skill-creator openclaw A skill for writing, repairing and reviewing other skills. It splits behaviour into branches, sets the frontmatter and sorts resources into folders. Useful once your skill folder gets crowded. Claude Code CX Codex Cursor +1 6,700installs coding-agent openclaw This skill sends large coding tasks to Codex, Claude Code, or OpenCode as background workers. Use it for refactors, PR reviews, and issue-to-PR work. Claude Code CX Codex Cursor +1 6,500installs

Similar

application-security-testing usestrix This skill selects tests for source code, a live web app, APIs, and CI, then turns confirmed findings into a ranked remediation plan. Use it for an AppSec review. Claude Code CX Codex Cursor +1 12,300installs security-best-practices github.com/openai/skills A skill that reviews code against security best practices for Python, JavaScript/TypeScript and Go, then suggests fixes. Claude Code CX Codex Cursor +1 357installs docker-expert sickn33 A skill that turns your AI agent into a Docker reviewer for Dockerfiles, multi-stage builds and container security. Useful when images and Compose files need a second look. Claude Code CX Codex Cursor +1 27,200installs java-springboot official github Gives GitHub Copilot Spring Boot development practices, from project layout to tests and security. Use it when writing or reviewing Java application code. GitHub Copilot 21,272installs docker-patterns affaan-m A skill with Dockerfile and Docker Compose patterns: local dev stacks, networking, volumes, container hardening. Claude Code CX Codex Cursor +1 6,300installs git-guardrails-claude-code Matt Pocock This skill adds a Claude Code hook that stops risky Git commands before they run. Use it when an agent must not push or discard working-tree changes. Claude Code 499,069installs ponytail-review DietrichGebert ponytail-review reviews a change beyond the diff, checking connected code, bugs, risks, load, tests, speed, and unnecessary code. Use it for PRs and commits. Claude Code CX Codex Cursor +1 56,300installs ponytail-audit DietrichGebert It audits a repository and ranks bugs, risks, and redundant code in a one-shot report. Use it when you need a review without code changes. Claude Code CX Codex Cursor +1 44,800installs

Questions about healthcheck

How do I install healthcheck in Claude Code?

Run npx skills add openclaw/openclaw --skill healthcheck -a claude-code in your terminal. This configures the skill inside ~/.claude/skills/healthcheck/SKILL.md.

What does the healthcheck skill do?

It inspects your host system and OpenClaw configuration using read-only checks. Then it reports security findings and outlines staged hardening steps.

Can this skill lock me out of my remote server?

No. The skill is instructed never to modify SSH or firewall settings without confirming the access path first, and every state change requires direct approval.

Source text

SKILL.md · MIT 
---
name: healthcheck
description: "Audit/harden OpenClaw hosts: SSH, firewall, updates, exposure, backups, disk encryption, gateway security."
---

# OpenClaw host healthcheck

Goal: assess host risk, run read-only checks, then propose staged hardening without breaking access.

## Rules

- Ask before state-changing actions.
- Do not change SSH/firewall/remote access until access path is confirmed.
- Prefer reversible steps and rollback notes.
- Never claim OpenClaw manages OS firewall, SSH, or updates.
- If identity/role unknown, recommend only.
- User choices: numbered list.
- Never print secrets.

## Context to infer first

- OS/version, container vs host.
- Privilege level.
- Access path: local, SSH, RDP, tailnet.
- Network exposure: public IP, reverse proxy, tunnel, LAN only.
- OpenClaw gateway status, bind, auth.
- Backup status.
- Disk encryption.
- Automatic security updates.
- Usage mode: personal workstation, local assistant box, remote server, other.

Ask only for missing facts. Simple phrasing preferred.

## Read-only checks

Ask once for permission to run read-only checks. Then run relevant commands.

Common:

```bash
openclaw security audit --deep
openclaw gateway status --deep
openclaw doctor --lint
```

`doctor --lint` can exit `1` for findings: read the report and continue the remaining checks. Ordinary `doctor` and `doctor --non-interactive` can copy legacy config and migrate state without `--fix`; reserve repairs for explicit approval. Read-only checks exclude config/service repairs and state migrations, but may produce incidental logs or cache bookkeeping.

macOS:

```bash
sw_vers
lsof -nP -iTCP -sTCP:LISTEN
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
pfctl -s info
tmutil status
fdesetup status
softwareupdate --schedule
```

Linux:

```bash
cat /etc/os-release
ss -ltnup || ss -ltnp
ufw status || firewall-cmd --state || nft list ruleset
systemctl status ssh sshd
lsblk -f
```

Windows:

```powershell
systeminfo
Get-NetFirewallProfile
Get-BitLockerVolume
```

## Risk profile

After context is known, ask desired posture:

1. Convenience: local/private, minimal prompts.
2. Balanced: secure defaults, low friction.
3. Strict: remote/public/sensitive data, more lock-down.

## Report shape

- Current posture: one paragraph.
- Findings: severity + evidence + why it matters.
- Recommended plan: staged, reversible.
- Commands: read-only first; write actions only after approval.
- Gaps: what could not be checked.

## Hardening menu

Offer only relevant items:

- Bind gateway to loopback/LAN/tailnet intentionally.
- Require auth for remote access.
- Close public ports or restrict by firewall.
- Enable OS security updates.
- Enable disk encryption.
- Verify backups and restore path.
- Disable password SSH or require keys/MFA where appropriate.
- Add scheduled `openclaw security audit --deep`.

Confirm exact action before applying.

© openclaw · MIT · openclaw/openclaw

See also

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor