技能 claw

运维部署社区

作者仓库星标 3,406
作者仓库 claude-octopus

解读按原文结构重写，命令、链接、术语均保留；右侧可核对作者原始 SKILL.md

方法与流程

The Process：原文以此为独立章节。
Phase 1: Detect Platform：You MUST detect the platform before running any administrative commands. Set the platform context before proceeding: macOS: Homebrew, launchd, Application Firewall, APFS
Phase 2: Assess Current State：Run diagnostics appropriate to the platform: OpenClaw Diagnostics (All Platforms) macOS Host Diagnostics

适用与边界

When to Use：Use this skill for: Installing, updating, or migrating OpenClaw instances Gateway lifecycle management (start, stop, restart, health checks)
当前原文没有单列不适用场景或限制。

原文中的明确线索

要点：「Your first output line MUST be」、「CLAUDE OCTOPUS ACTIVATED」、「Use this skill for」、「Do NOT use for」、「You MUST detect the platform before running any administrative commands.」、「Set the platform context」、「macOS」、「Ubuntu/Debian」
文件与命令：🐙 CLAUDE OCTOPUS ACTIVATED - OpenClaw Administration、/octo:debug、curl -fsSL https://openclaw.ai/install.sh \| bash && openclaw onboard --install-daemon、git clone https://github.com/openclaw/openclaw.git && cd openclaw && ./docker-setup.sh、launchctl start gui/$UID/com.openclaw.gateway、systemctl --user start openclaw-gateway、docker compose up -d、launchctl stop gui/$UID/com.openclaw.gateway

流狐整理：以上内容来自当前 SKILL.md 的章节与原词；未补写作者没有声明的工具、兼容性或能力。

OpenClaw Instance Administration

Your first output line MUST be: 🐙 **CLAUDE OCTOPUS ACTIVATED** - OpenClaw Administration

The Iron Law

DETECT PLATFORM FIRST. DIAGNOSE BEFORE CHANGING. VERIFY AFTER EVERY ACTION.

Never assume the OS or hosting environment. Never make changes without checking current state. Never claim success without verification.

When to Use

Use this skill for:

Installing, updating, or migrating OpenClaw instances
Gateway lifecycle management (start, stop, restart, health checks)
Host-level administration (packages, services, firewall, users, disks)
Security hardening and audits
Monitoring setup and troubleshooting
Backup and disaster recovery
Platform-specific configuration (macOS, Ubuntu/Debian, Docker, OCI, Proxmox)
Channel configuration (WhatsApp, Telegram, Discord, Slack, Signal)
Tailscale setup and management (Serve, Funnel, SSH, ACLs)
gogcli (Google Workspace CLI) setup and troubleshooting
OpenClaw scheduler, memory, plugins, and MCP server management

Do NOT use for:

Writing OpenClaw extensions or plugins (use plugin-dev skills)
Designing cloud architecture from scratch (use cloud-architect persona)
Application-level code debugging (use /octo:debug)

The Process

Phase 1: Detect Platform

You MUST detect the platform before running any administrative commands.

# Detect OS
uname -s  # Darwin = macOS, Linux = Ubuntu/Debian/Proxmox host

# If Linux, detect distro
cat /etc/os-release 2>/dev/null | head -5

# Check if inside Docker
[ -f /.dockerenv ] && echo "Docker container" || echo "Not Docker"

# Check if on Proxmox host
command -v pveversion &>/dev/null && pveversion 2>/dev/null

# Check if inside Proxmox LXC
[ -f /proc/1/environ ] && grep -q container=lxc /proc/1/environ 2>/dev/null && echo "Proxmox LXC"

# Check for OCI metadata
curl -s -m 2 http://169.254.169.254/opc/v2/instance/ -H "Authorization: Bearer Oracle" 2>/dev/null | head -5

Set the platform context before proceeding:

macOS: Homebrew, launchd, Application Firewall, APFS
Ubuntu/Debian: apt, systemd, ufw, ext4/ZFS
Docker: docker compose, container logs, volume management
OCI: ARM architecture, VCN security, Tailscale, systemd
Proxmox: qm/pct, vzdump, ZFS, LXC bind mounts

Phase 2: Assess Current State

Run diagnostics appropriate to the platform:

OpenClaw Diagnostics (All Platforms)

# Check OpenClaw installation
command -v openclaw &>/dev/null && openclaw --version

# Gateway status
openclaw status --all

# Health check
openclaw health

# Doctor (auto-detect and report issues)
openclaw doctor

# Security audit
openclaw security audit

macOS Host Diagnostics

# Service status
launchctl list | grep openclaw

# System resources
vm_stat | head -10
df -h /

# Homebrew health
brew doctor 2>&1 | head -20

# Firewall status
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

Ubuntu/Debian Host Diagnostics

# Service status
systemctl --user status openclaw-gateway 2>/dev/null || systemctl status openclaw-gateway

# System resources
free -h
df -h /

# Failed services
systemctl --failed

# Firewall status
ufw status verbose

# Pending updates
apt list --upgradable 2>/dev/null | head -20

Docker Diagnostics

# Container status
docker compose ps

# Container health
docker inspect --format='{{.State.Health.Status}}' openclaw-gateway 2>/dev/null

# Resource usage
docker stats --no-stream

# Disk usage
docker system df

Proxmox Diagnostics

# Proxmox version
pveversion -v

# VM/LXC list
qm list 2>/dev/null
pct list 2>/dev/null

# Storage status
pvesm status

# ZFS health
zpool status 2>/dev/null

# Cluster status
pvecm status 2>/dev/null

Phase 3: Execute the Requested Action

Route to the appropriate workflow based on user intent:

Installation Workflows

Platform	Method
macOS	`curl -fsSL https://openclaw.ai/install.sh \| bash && openclaw onboard --install-daemon`
Ubuntu/Debian	`curl -fsSL https://openclaw.ai/install.sh \| bash && openclaw onboard --install-daemon`
Docker	`git clone https://github.com/openclaw/openclaw.git && cd openclaw && ./docker-setup.sh`
OCI ARM	Install Node.js 22 + build-essential, then curl installer, enable systemd lingering, configure Tailscale
Proxmox LXC	Create Ubuntu/Debian LXC, install Node.js 22, curl installer, configure bind mounts for persistence

Service Lifecycle

Action	macOS	Linux	Docker
Start	`launchctl start gui/$UID/com.openclaw.gateway`	`systemctl --user start openclaw-gateway`	`docker compose up -d`
Stop	`launchctl stop gui/$UID/com.openclaw.gateway`	`systemctl --user stop openclaw-gateway`	`docker compose down`
Restart	`openclaw gateway restart`	`openclaw gateway restart`	`docker compose restart`
Status	`launchctl list \| grep openclaw`	`systemctl --user status openclaw-gateway`	`docker compose ps`
Logs	`openclaw logs --follow`	`journalctl --user -u openclaw-gateway -f`	`docker compose logs -f`

Update Workflow

Backup config, credentials, and workspace:

cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.bak
cp -r ~/.openclaw/credentials/ ~/.openclaw/credentials.bak/

Update using the appropriate method:

# Installer (recommended)
curl -fsSL https://openclaw.ai/install.sh | bash

# npm
npm i -g openclaw@latest

# Docker
docker compose pull && docker compose up -d

Verify the update:

openclaw --version
openclaw doctor
openclaw health

Security Hardening Checklist

Gateway binds to loopback only (127.0.0.1 / ::1)
Token auth enabled — tokens treated as admin credentials
Tailscale or VPN for remote access — never expose port 18789
Filesystem restrictions: tools.exec.applyPatch.workspaceOnly: true, tools.fs.workspaceOnly: true
Docker sandboxing enabled for agent tool execution
DM pairing policy enforced for unknown senders
openclaw security audit --deep --fix passes clean
Credential permissions: chmod 700 ~/.openclaw/credentials/
Firewall: only required ports open (SSH, Tailscale UDP 41641)
Use Anthropic Opus 4.6 as agent model (best prompt injection resistance)

Phase 4: Verify Outcome

After every action, verify it took effect:

# Check gateway is running
openclaw status

# Check health
openclaw health

# Run doctor to catch issues
openclaw doctor

# If security changes were made
openclaw security audit

Report the before/after state and any remaining issues.

Key File Paths

Path	Purpose
`~/.openclaw/openclaw.json`	Main configuration (JSON5)
`~/.openclaw/credentials/`	API keys and auth tokens
`~/.openclaw/workspace/`	Agent workspace data
`~/.openclaw/sandboxes/`	Sandbox isolation directories
`~/Library/LaunchAgents/com.openclaw.gateway.plist`	macOS launchd service
`~/.config/systemd/user/openclaw-gateway.service`	Linux systemd user service

OpenClaw CLI Quick Reference

openclaw status [--all|--deep]         # Health overview
openclaw health                        # Gateway health check
openclaw doctor [--fix]                # Diagnostics + auto-fix
openclaw logs [--follow]               # Gateway logs
openclaw security audit [--deep] [--fix]  # Security scan

openclaw gateway start|stop|restart    # Service lifecycle
openclaw gateway install|uninstall     # Daemon management
openclaw configure                     # Interactive config wizard
openclaw update [--channel ...]        # Self-update

openclaw channels list|status|add|remove  # Messaging channels
openclaw models list|status [--probe]     # AI model config
openclaw agents list|add|delete           # Agent management
openclaw sessions list|history            # Session management
openclaw skills list|info|check           # Skills
openclaw plugins list|install|doctor      # Plugins
openclaw cron status|list|add|edit|rm     # Scheduled jobs

Tailscale Management

tailscale up [--ssh]                             # Connect to tailnet
tailscale serve https / http://127.0.0.1:18789  # Expose OpenClaw to tailnet
tailscale serve status                           # Check serve config
tailscale status                                 # List connected devices
tailscale ping <hostname>                        # Test connectivity
tailscale netcheck                               # Network diagnostics

Rules:

Use tailscale serve for OpenClaw access (tailnet only)
Warn before tailscale funnel (exposes to public internet)
Docker: use sidecar pattern with network_mode: "service:tailscale"
Proxmox LXC: add TUN device to container config before installing

Channel Integration

Channel	Library	Admin Setup
WhatsApp	Baileys	`openclaw channels login whatsapp` → scan QR
Telegram	Grammy	Token from @BotFather → set in config
Discord	discord.js	Bot token from Developer Portal
Slack	Bolt	App manifest + bot/app tokens (Socket Mode)
Signal	signal-cli	`openclaw channels login signal` → linked device

openclaw channels list|status|add|remove|login|logout
openclaw channels dm-allow <channel> user:@username
openclaw channels info <channel> [--dm-list|--detailed]

Integration with Other Skills

Scenario	Route
Infrastructure architecture needed	Hand off to cloud-architect persona
Application-level bug found	Hand off to `/octo:debug`
Security vulnerability in code	Hand off to `/octo:security`
Need CI/CD pipeline for deployment	Hand off to deployment-engineer persona
OpenClaw extension development	Hand off to plugin-dev skills

Red Flags — Don't Do This

Action	Why It's Wrong
Assume the OS without checking	macOS and Linux commands differ significantly
Expose port 18789 to the internet	Gateway should only bind to loopback; use Tailscale
Run `openclaw security audit --fix` without `--deep` first	Understand the findings before auto-remediating
Skip backup before updating	Updates can break config; always back up first
Use `docker compose down -v` without warning	Destroys volumes and all data
Grant `manage all-resources` in OCI IAM	Violates least-privilege; use scoped policies
Run privileged LXC containers on Proxmox	Unprivileged LXC is safer; only privilege if absolutely needed

流狐档案作者与许可取自来源；运行、权限和网络为流狐检测或估算

流狐分类: 运维部署
作者声明 Agent: 未找到明确声明；不据此推断已兼容或已测试
静态检查: 83 / 100 · 启发式扫描，不代表运行安全
作者 / 版本 / 许可: @nyldn · 未声明 license
流狐 Token 估算: 低消耗
流狐接入估算: 需手动接入
是否需要外部 API Key: 未发现要求
检测到的系统要求: macOS · Linux · Docker
底层运行要求: Node.js · Docker
检测到的文件与系统行为: 只读
允许写入 / 修改
Shell 执行
检测到的网络行为: 允许外网请求
安装命令数: 无（仅作为资料）

档案由构建时根据 SKILL.md 与安装命令自动衍生，可能与作者实际意图存在差异。

需要注意： 未限定 allowed-tools，默认拥有全部工具权限。；检出高风险片段：pipe_curl_to_shell

输出预览 skill-claw.preview

作者没有在当前 SKILL.md 中定义固定输出样例。

SKILL.md SKILL.md

# OpenClaw Instance Administration

**Your first output line MUST be:** `🐙 **CLAUDE OCTOPUS ACTIVATED** - OpenClaw Administration`

## The Iron Law

```
DETECT PLATFORM FIRST. DIAGNOSE BEFORE CHANGING. VERIFY AFTER EVERY ACTION.
```

Never assume the OS or hosting environment. Never make changes without checking current state. Never claim success without verification.

---

## When to Use

**Use this skill for:**
- Installing, updating, or migrating OpenClaw instances
- Gateway lifecycle management (start, stop, restart, health checks)
- Host-level administration (packages, services, firewall, users, disks)
- Security hardening and audits
- Monitoring setup and troubleshooting
- Backup and disaster recovery
- Platform-specific configuration (macOS, Ubuntu/Debian, Docker, OCI, Proxmox)
- Channel configuration (WhatsApp, Telegram, Discord, Slack, Signal)
- Tailscale setup and management (Serve, Funnel, SSH, ACLs)
- gogcli (Google Workspace CLI) setup and troubleshooting
- OpenClaw scheduler, memory, plugins, and MCP server management

**Do NOT use for:**
- Writing OpenClaw extensions or plugins (use plugin-dev skills)
- Designing cloud architecture from scratch (use cloud-architect persona)
- Application-level code debugging (use `/octo:debug`)

---

## The Process

### Phase 1: Detect Platform

**You MUST detect the platform before running any administrative commands.**

```bash
# Detect OS
uname -s  # Darwin = macOS, Linux = Ubuntu/Debian/Proxmox host

# If Linux, detect distro
cat /etc/os-release 2>/dev/null | head -5

# Check if inside Docker
[ -f /.dockerenv ] && echo "Docker container" || echo "Not Docker"

# Check if on Proxmox host
command -v pveversion &>/dev/null && pveversion 2>/dev/null

# Check if inside Proxmox LXC

…

证据边界与执行链路

作者原文负责流程事实；流狐只索引当前章节、要点、文件与命令。

章节    -> The Iron Law → When to Use → The Process → Phase 1: Detect Platform → Phase 2: Assess Current State → Phase 3: Execute the Requested Action
要点    -> Your first output line MUST be · CLAUDE OCTOPUS ACTIVATED · Use this skill for · Do NOT use for · You MUST detect the platform before running any administrative commands. · Set the platform context · macOS · Ubuntu/Debian
文件/命令 -> 🐙 CLAUDE OCTOPUS ACTIVATED - OpenClaw Administration · /octo:debug · curl -fsSL https://openclaw.ai/install.sh \| bash && openclaw onboard --install-daemon · git clone https://github.com/openclaw/openclaw.git && cd openclaw && ./docker-setup.sh · launchctl start gui/$UID/com.openclaw.gateway · systemctl --user start openclaw-gateway · docker compose up -d · launchctl stop gui/$UID/com.openclaw.gateway
内容 SHA-256 -> ea584cded280