菜单
OpenClaw self-check & auto-hardening skill. Audits your instance for the exact vulnerabilities tracked by declawed.io (CVE-2026-25253, exposed panels, default credentials, Docker escapes). Fixes what it finds.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | openclaw-hardener |
| description | OpenClaw self-check & auto-hardening skill. Audits your instance for the exact vulnerabilities tracked by declawed.io (CVE-2026-25253, exposed panels, default credentials, Docker escapes). Fixes what it finds. |
| version | 1.0.0 |
| author | 2233admin |
| license | MIT |
| tags | ["security","hardening","self-check","declawed"] |
| allowed-tools | Bash Read Edit Write Grep Glob |
Inspired by declawed.io tracking 230,000+ exposed OpenClaw instances worldwide. Don't be one of them.
When invoked, systematically check ALL of the following. For each finding, report severity and offer to auto-fix.
Check if OpenClaw is bound to 0.0.0.0 (all interfaces) by inspecting config.yaml server.host field and verifying with ss -tlnp filtering for ports 18789, 8080, 8081.
Severity: CRITICAL if bound to 0.0.0.0 on a public-facing server.
Auto-fix: Change host: 0.0.0.0 to host: 127.0.0.1 (or WireGuard interface IP like 10.10.0.x) in config.yaml, then restart the service.
Check the auth.password field in config.yaml.
Severity: CRITICAL if password: is empty or missing.
Auto-fix: Generate a strong random password with openssl rand -base64 24, update the config, and inform the user of the new password.
declawed.io scans the entire internet for these favicon MD5 hashes:
f58854f6450618729679ad33622bebaf (28,728 matches globally)75661cbf8fd50009be0c46a9ca8b3180 (9,707 matches)Fetch http://localhost:18789/favicon.ico and compute its MD5. If it matches AND the instance is publicly accessible, it is already in declawed.io's database.
Severity: HIGH if favicon matches known fingerprints AND instance is publicly accessible.
Auto-fix options:
The gatewayUrl query parameter can override the saved gateway and auto-connects, sending the auth token to an attacker-controlled endpoint. This enables remote code execution.
Test by checking if the application accepts a gatewayUrl parameter without validation.
Severity: CRITICAL
Auto-fix: Update OpenClaw to latest patched version. If unavailable, add reverse proxy rule to strip or reject requests containing gatewayUrl parameter.
Check if the OpenClaw container has /var/run/docker.sock mounted by inspecting docker-compose.yml or running container mounts.
Severity: CRITICAL if Docker socket is mounted - enables container escape to host.
Auto-fix: Remove Docker socket mount. Use Docker API over TCP with TLS mutual auth if Docker access is genuinely needed.
Scan config.yaml for plaintext API keys (patterns like sk-, api_key: with values). Also check if frontend JS bundles serve any embedded keys by fetching the main page HTML and linked JS assets.
Severity: HIGH if API keys found in config files or client-side code.
Auto-fix: Move keys to environment variables. Replace api_key: sk-xxxx with api_key: ${OPENAI_API_KEY} in config, then set the env var.
Check the mcp: section in config.yaml for enabled: true combined with host: 0.0.0.0.
Severity: HIGH if MCP is enabled AND bound to all interfaces.
Auto-fix: Either disable MCP (enabled: false) or bind to localhost/WireGuard only.
Check if running on macOS (uname -s returns Darwin) with SSH-related skills installed.
Severity: HIGH on macOS systems with SSH skills enabled.
Auto-fix: Update to patched version. Review and sanitize all SSH command inputs in skill definitions.
Check the robots: section in config.yaml for any enabled bots (wecom, dingtalk, lark with enabled: true).
Severity: MEDIUM if bots enabled on a publicly exposed instance - attacker gains messaging channel access.
Auto-fix: Disable bots on exposed instances, or ensure instance is not publicly accessible first.
Check what user the OpenClaw process runs as with whoami and ps aux.
Severity: HIGH if running as root.
Auto-fix: Create dedicated user openclaw, chown files, update systemd service to User=openclaw.
Check iptables (both raw PREROUTING and INPUT chains) for rules restricting access to OpenClaw ports (18789, 8080, 8081).
Severity: HIGH if no firewall rules restrict access to OpenClaw ports on a public server.
Auto-fix: Create an OPENCLAW_BLOCK chain in the raw table that allows only trusted CIDRs (e.g., WireGuard 10.10.0.0/24 and localhost 127.0.0.0/8), drops everything else. Apply to all OpenClaw ports. Persist with iptables-save.
The ClawHavoc campaign (Jan-Feb 2026) distributed 335+ malicious skills via ClawHub, delivering NovaStealer and AMOS info-stealers.
Scan all installed skills for suspicious patterns:
Severity: CRITICAL if suspicious patterns found.
Auto-fix: Quarantine suspicious skills to a quarantined/ directory, generate a report for manual review.
After running all checks, output a summary table:
========================================
OpenClaw Hardener Audit Report
========================================
Instance: localhost:18789
Date: YYYY-MM-DD HH:MM UTC
Score: XX/100
| # | Check | Status | Severity |
|---|--------------------------|--------|----------|
| 1 | Network Exposure | PASS/FAIL | -/CRIT |
| 2 | Authentication | PASS/FAIL | -/CRIT |
| 3 | Favicon Fingerprint | PASS/FAIL | -/HIGH |
| 4 | CVE-2026-25253 Gateway | PASS/FAIL | -/CRIT |
| 5 | Docker Socket | PASS/FAIL | -/CRIT |
| 6 | API Key Exposure | PASS/FAIL | -/HIGH |
| 7 | MCP Exposure | PASS/FAIL | -/HIGH |
| 8 | SSH Injection | PASS/FAIL | -/HIGH |
| 9 | Bot Channel Security | PASS/FAIL | -/MED |
|10 | Process Privilege | PASS/FAIL | -/HIGH |
|11 | Firewall Rules | PASS/FAIL | -/HIGH |
|12 | Malicious Skills | PASS/FAIL | -/CRIT |
CRITICAL: X issues HIGH: X issues MEDIUM: X issues
[Auto-fix available for X issues. Apply? (y/n)]
========================================
When the user confirms auto-fix, apply all available fixes in order:
After applying fixes, re-run the audit to verify improvements. Show before/after score comparison.