AWS Cloud Advisor
tech-leads-club/agent-skills
Answers AWS architecture, security and service-selection questions by searching AWS documentation through MCP tools first, then adapting advice to your stack and team.
Harden OpenClaw self-hosted environments with baseline host controls, auth tightening, secret handling, network segmentation, and safe update/rollback workflows.
Install Openclaw Security Hardening
$ npx skills add BagelHole/DevOps-Security-Agent-Skills --skill openclaw-security-hardening -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install BagelHole/DevOps-Security-Agent-Skills openclaw-security-hardening --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/BagelHole/DevOps-Security-Agent-Skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/infrastructure/local-ai/openclaw-security-hardening .claude/skills/openclaw-security-hardening && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "openclaw-security-hardening" agent skill from https://github.com/BagelHole/DevOps-Security-Agent-Skills/tree/main/infrastructure/local-ai/openclaw-security-hardening into .claude/skills/openclaw-security-hardening/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "openclaw-security-hardening", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/BagelHole/DevOps-Security-Agent-Skills/tree/main/infrastructure/local-ai/openclaw-security-hardeningType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add BagelHole/DevOps-Security-Agent-Skills --skill openclaw-security-hardening -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install BagelHole/DevOps-Security-Agent-Skills openclaw-security-hardening --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/BagelHole/DevOps-Security-Agent-Skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/infrastructure/local-ai/openclaw-security-hardening .agents/skills/openclaw-security-hardening && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "openclaw-security-hardening" agent skill from https://github.com/BagelHole/DevOps-Security-Agent-Skills/tree/main/infrastructure/local-ai/openclaw-security-hardening into .agents/skills/openclaw-security-hardening/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "openclaw-security-hardening", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add BagelHole/DevOps-Security-Agent-Skills --skill openclaw-security-hardening -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install BagelHole/DevOps-Security-Agent-Skills openclaw-security-hardening --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/BagelHole/DevOps-Security-Agent-Skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/infrastructure/local-ai/openclaw-security-hardening .cursor/skills/openclaw-security-hardening && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "openclaw-security-hardening" agent skill from https://github.com/BagelHole/DevOps-Security-Agent-Skills/tree/main/infrastructure/local-ai/openclaw-security-hardening into .cursor/skills/openclaw-security-hardening/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "openclaw-security-hardening", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/BagelHole/DevOps-Security-Agent-Skills.git --path infrastructure/local-ai/openclaw-security-hardening--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add BagelHole/DevOps-Security-Agent-Skills --skill openclaw-security-hardening -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install BagelHole/DevOps-Security-Agent-Skills openclaw-security-hardening --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/BagelHole/DevOps-Security-Agent-Skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/infrastructure/local-ai/openclaw-security-hardening .gemini/skills/openclaw-security-hardening && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "openclaw-security-hardening" agent skill from https://github.com/BagelHole/DevOps-Security-Agent-Skills/tree/main/infrastructure/local-ai/openclaw-security-hardening into .gemini/skills/openclaw-security-hardening/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "openclaw-security-hardening", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install BagelHole/DevOps-Security-Agent-Skills openclaw-security-hardeningInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add BagelHole/DevOps-Security-Agent-Skills --skill openclaw-security-hardening -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/BagelHole/DevOps-Security-Agent-Skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/infrastructure/local-ai/openclaw-security-hardening .github/skills/openclaw-security-hardening && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "openclaw-security-hardening" agent skill from https://github.com/BagelHole/DevOps-Security-Agent-Skills/tree/main/infrastructure/local-ai/openclaw-security-hardening into .github/skills/openclaw-security-hardening/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "openclaw-security-hardening", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add BagelHole/DevOps-Security-Agent-Skills --skill openclaw-security-hardening -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install BagelHole/DevOps-Security-Agent-Skills openclaw-security-hardening --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/BagelHole/DevOps-Security-Agent-Skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/infrastructure/local-ai/openclaw-security-hardening .opencode/skills/openclaw-security-hardening && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "openclaw-security-hardening" agent skill from https://github.com/BagelHole/DevOps-Security-Agent-Skills/tree/main/infrastructure/local-ai/openclaw-security-hardening into .opencode/skills/openclaw-security-hardening/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "openclaw-security-hardening", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
openclaw-security-hardening- GitHub stars
- 1.2k
- Token cost
- ~1k tokens
- SKILL.md length
- 462 words
- Files
- 1
- Skills in repo
- 44
- Repo updated
- First seen
- Licence
- MIT
At a glance
Harden OpenClaw self-hosted environments with baseline host controls, auth tightening, secret handling, network segmentation, and safe update/rollback workflows.
- Works in 5 steps: Keep OS and package dependencies patched… → Run OpenClaw as a dedicated non-admin… → Enable full-disk encryption and secure… → …
- Deploying OpenClaw in home labs
- SKILL.md covers Build a Threat Model First, Apply Baseline Host Hardening, Harden Application Runtime and Protect Secrets and Tokens, plus 4 more sections
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Openclaw Security Hardening is an agent skill from BagelHole/DevOps-Security-Agent-Skills. Harden OpenClaw self-hosted environments with baseline host controls, auth tightening, secret handling, network segmentation, and safe update/rollback workflows. Use when deploying OpenClaw in home labs, startups, or production-like local AI infrastructure.
Its SKILL.md is about 1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.
It sits in DevOps & Cloud, covering Security review. The repository describes itself as: Agent-ready DevOps, security, infrastructure, and compliance knowledge base with 80+ skills across Kubernetes, Terraform, AWS/Azure/GCP, AI platform operations, container… The licence is MIT.
When your agent uses it
- Deploying OpenClaw in home labs
- Production-like local AI infrastructure
Example prompts
- “/openclaw-security-hardening”
Workflow steps
5 steps, taken from the first numbered list in SKILL.md.
- Keep OS and package dependencies patched on a regular cadence.
- Run OpenClaw as a dedicated non-admin user account.
- Enable full-disk encryption and secure boot features where available.
- Remove unnecessary services and block inbound ports by default.
- Lock down remote admin (key-only SSH, no password login, limited source CIDRs).
What it can do on your machine
Read from SKILL.md and the folder at commit 0365f57. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are bash).
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Openclaw Security Hardening loads about 1k tokens when it runs. Until then it costs about 71 tokens; SKILL.md has 462 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check: notes
The automated check noted patterns worth knowing about, such as sudo or a known installer.
- NoteRuns commands with sudoSKILL.md:37
sudo ss -tulpn - NoteRuns commands with sudoSKILL.md:38
sudo ufw status verbose - NoteRuns commands with sudoSKILL.md:39
sudo systemctl --failed - NoteMentions a .env fileSKILL.md:60
platform secret manager, not committed `.env` files.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from BagelHole/DevOps-Security-Agent-Skills at commit 0365f57, republished under its MIT licence (© BagelHole). 462 words, ~1,004 tokens.
Download SKILL.mdSave it as
.claude/skills/openclaw-security-hardening/SKILL.md (or your agent's skills folder).- name
- openclaw-security-hardening
- description
- Harden OpenClaw self-hosted environments with baseline host controls, auth tightening, secret handling, network segmentation, and safe update/rollback workflows. Use when deploying OpenClaw in home labs, startups, or production-like local AI infrastructure.
- license
- MIT
- metadata.author
- devops-skills
- metadata.version
- 1.0
OpenClaw Security Hardening
Use this skill to reduce exposure in self-hosted OpenClaw deployments before opening access to teammates or external networks.
Build a Threat Model First
Map the highest-risk assets and paths:
- Admin/API endpoints for OpenClaw
- Provider API keys and model credentials
- Prompt/response logs containing sensitive business data
- Host-level access (SSH, local admin accounts, remote desktop)
Prioritize controls that reduce credential theft, remote code execution blast radius, and data exfiltration.
Apply Baseline Host Hardening
- Keep OS and package dependencies patched on a regular cadence.
- Run OpenClaw as a dedicated non-admin user account.
- Enable full-disk encryption and secure boot features where available.
- Remove unnecessary services and block inbound ports by default.
- Lock down remote admin (key-only SSH, no password login, limited source CIDRs).
Example Linux baseline checks:
id openclaw
sudo ss -tulpn
sudo ufw status verbose
sudo systemctl --failedHarden Application Runtime
- Bind OpenClaw to localhost or private VLAN by default.
- Place a reverse proxy in front of OpenClaw for TLS, auth, and rate limits.
- Enforce authentication on every non-health endpoint.
- Disable debug/dev modes in persistent environments.
- Restrict outbound egress to only required providers (LLM API, telemetry sink, package mirror).
Example reverse proxy controls to enforce:
- TLS 1.2+ only
- strict transport security header
- request body size limits
- request timeout and upstream timeout guardrails
- per-IP and per-token rate limiting
Protect Secrets and Tokens
- Store secrets in a vault or platform secret manager, not committed
.envfiles. - Rotate provider and admin tokens on a fixed interval and after any incident.
- Scope tokens minimally (least privilege, per-service keys).
- Scan repos and deployment artifacts for leaked credentials before release.
Rotation checklist:
- Generate replacement key.
- Update runtime secret store.
- Restart or reload OpenClaw.
- Validate request success with new key.
- Revoke old key.
Show full SKILL.md (178 more words)Show less
Segment Network Access
Use layered access patterns:
- Tier 1 (private): OpenClaw service port reachable only from app/proxy subnet.
- Tier 2 (operator): Admin plane reachable only from VPN/Tailscale/WireGuard.
- Tier 3 (public): Expose only hardened reverse proxy with strict ACLs.
Do not publish raw OpenClaw service ports directly to the internet.
Add Detection and Recovery Paths
- Centralize auth, error, and audit logs.
- Alert on brute-force attempts, token failures, and unusual outbound traffic.
- Capture immutable backup snapshots of configs and prompt data retention settings.
- Test rollback and restore procedures every release cycle.
Minimum operational runbook:
- service restart path
- key revocation path
- incident isolation path (network block + token disable)
- known-good rollback version
Validation Checklist
- All sensitive endpoints require auth and are unreachable without VPN or gateway policy.
- Secrets are absent from repo history and plaintext shared directories.
- Host firewall default deny is active for inbound traffic.
- TLS termination and rate limits are active at ingress.
- Rollback drill can restore service within target RTO.
Related Skills
- openclaw-local-mac-mini - Local OpenClaw hosting setup
- multi-tenant-llm-hosting - Multi-tenant AI isolation patterns
- zero-trust - Private access and identity-aware network controls
© BagelHole, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in infrastructure/local-ai/openclaw-security-hardening of BagelHole/DevOps-Security-Agent-Skills.
Open the folder on GitHubat commit 0365f57
Compare with similar skills
Openclaw Security Hardening next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Openclaw Security Hardening this skillBagelHole/DevOps-Security-Agent-Skills | 1.2k | — | ~1k | Automated safety check: Notes | MIT | |
| AWS Cloud Advisortech-leads-club/agent-skills | 7k | — | ~2.1k | Automated safety check: Pass | CC-BY-4.0 | |
| Secure GitHub Actionsvechain/x-app-template | 450 | — | ~1.2k | Automated safety check: Pass | MIT | |
| Production Gradenagisanzenin/production-grade | 181 | — | ~16k | Automated safety check: Notes | None | |
| Robotics Securityarpitg1304/robotics-agent-skills | 369 | — | ~7.8k | Automated safety check: Warn | Apache-2.0 | |
| Iac Security ReviewOWASP/secure-agent-playbook | 188 | — | ~694 | Automated safety check: Pass | CC-BY-4.0 |
Similar skills
Secure GitHub Actions
vechain/x-app-template
Secure GitHub Actions workflows against supply-chain, privilege, and shell-injection risks.
Production Grade
nagisanzenin/production-grade
A skill your agent uses when the user wants to build, create, or develop anything — websites, apps, APIs, services, platforms.
Robotics Security
arpitg1304/robotics-agent-skills
Security hardening and best practices for robotic systems, covering SROS2 DDS security, network segmentation, secrets management, secure boot, and the physical-cyber safety intersection.
Iac Security Review
OWASP/secure-agent-playbook
Security review of Infrastructure-as-Code (Terraform, Kubernetes, CloudFormation).
Frontmcp Production Readiness
agentfront/frontmcp
Pre-production audit, hardening, and go-live checklists for FrontMCP servers.
More from BagelHole/DevOps-Security-Agent-Skills
All 44 skills in this repoHashicorp Vault
BagelHole/DevOps-Security-Agent-Skills
Manage secrets and PKI with HashiCorp Vault. An agent skill from BagelHole/DevOps-Security-Agent-Skills.
Incident Response
BagelHole/DevOps-Security-Agent-Skills
Handle security incidents with IR playbooks and procedures. An agent skill from BagelHole/DevOps-Security-Agent-Skills.
Kubernetes Ops
BagelHole/DevOps-Security-Agent-Skills
Deploy, scale, and manage Kubernetes workloads. An agent skill from BagelHole/DevOps-Security-Agent-Skills.
Linux Hardening
BagelHole/DevOps-Security-Agent-Skills
Apply CIS benchmarks and secure Linux servers. An agent skill from BagelHole/DevOps-Security-Agent-Skills.
Prometheus Grafana
BagelHole/DevOps-Security-Agent-Skills
Set up metrics collection and visualization with Prometheus and Grafana.
Vulnerability Scanning
BagelHole/DevOps-Security-Agent-Skills
Scan systems and dependencies for CVEs and security vulnerabilities.
Related
Categories
Questions about Openclaw Security Hardening
What does Openclaw Security Hardening do?
Harden OpenClaw self-hosted environments with baseline host controls, auth tightening, secret handling, network segmentation, and safe update/rollback workflows. Openclaw Security Hardening is an agent skill from BagelHole/DevOps-Security-Agent-Skills. Harden OpenClaw self-hosted environments with baseline host controls, auth tightening, secret handling, network segmentation, and safe update/rollback workflows.
When should I use Openclaw Security Hardening?
Openclaw Security Hardening fits situations like: deploying OpenClaw in home labs; production-like local AI infrastructure.
How do I install Openclaw Security Hardening in Claude Code?
Run `npx skills add BagelHole/DevOps-Security-Agent-Skills --skill openclaw-security-hardening -a claude-code`. Or copy the skill folder (infrastructure/local-ai/openclaw-security-hardening in BagelHole/DevOps-Security-Agent-Skills) into .claude/skills/openclaw-security-hardening in your project. Claude Code loads it when a task matches its description.
How do I install Openclaw Security Hardening in Codex?
Run `npx skills add BagelHole/DevOps-Security-Agent-Skills --skill openclaw-security-hardening -a codex`. Or copy the skill folder (infrastructure/local-ai/openclaw-security-hardening in BagelHole/DevOps-Security-Agent-Skills) into .agents/skills/openclaw-security-hardening in your project. Codex loads it when a task matches its description.
Can I use Openclaw Security Hardening in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add BagelHole/DevOps-Security-Agent-Skills --skill openclaw-security-hardening -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/openclaw-security-hardening, .gemini/skills/openclaw-security-hardening, .github/skills/openclaw-security-hardening and .opencode/skills/openclaw-security-hardening in your project.
What does Openclaw Security Hardening need to run?
SKILL.md names no scripts, command-line tools or credentials: Openclaw Security Hardening is instructions for the agent only.
Does Openclaw Security Hardening access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Openclaw Security Hardening safe to install?
Our automated static check of SKILL.md found notes only (runs commands with sudo; mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.
What licence does Openclaw Security Hardening use?
Openclaw Security Hardening is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Openclaw Security Hardening use?
About 1k tokens (SKILL.md is roughly 4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Openclaw Security Hardening?
Skills that share tags, products or a category with Openclaw Security Hardening: AWS Cloud Advisor (tech-leads-club/agent-skills, 7k stars), Secure GitHub Actions (vechain/x-app-template, 450 stars), Production Grade (nagisanzenin/production-grade, 181 stars) and Robotics Security (arpitg1304/robotics-agent-skills, 369 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Openclaw Security Hardening?
BagelHole (a GitHub user) maintains it in BagelHole/DevOps-Security-Agent-Skills, which has 1,152 GitHub stars. The repository holds 44 skills in this directory. The repository was last updated on May 22, 2026.
Source: BagelHole/DevOps-Security-Agent-Skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.