Agent安装

Name: Agent安装
Author: nyldn

运维部署社区

作者仓库星标 3,406
作者更新于实时读取
作者仓库 claude-octopus

流狐档案事实层信息：领域、Agent、信任分、运行环境、权限与网络

领域: 运维部署
兼容 Agent: Claude Code
Cursor
Cline
Codex
Windsurf
Gemini CLI

+20
信任分: 83 / 100 · 社区维护
作者 / 版本 / 许可: @nyldn · 未声明 license
Token 消耗评级: 低消耗
接入复杂程度: 需手动接入
是否需要外部 API Key: 不需要
兼容的系统: macOS · Linux · Docker
底层运行要求: Node.js · Docker
文件与系统权限: 只读
允许写入 / 修改
Shell 执行
网络行为: 允许外网请求
安装命令数: 26 条

档案由构建时根据 SKILL.md 与安装命令自动衍生，可能与作者实际意图存在差异。

需要注意： 未限定 allowed-tools，默认拥有全部工具权限。；检出高风险片段：pipe_curl_to_shell

输出预览 skill-claw.preview

---
name: skill-claw
description: OpenClaw instance administration — manage hosts across macOS, Ubuntu/Debian, Docker, OCI, and Pr…
category: 运维部署
runtime: Node.js / Docker
---

# skill-claw 输出预览

## PART A: 任务判断
- 适用问题：部署、CI、环境检查、发布或运维排障。
- 输入要求：目标材料、限制条件、期望输出和验收方式。
- 证据边界：围绕“The Iron Law / When to Use / The Process”读取原文规则，不把推断写成作者承诺。

## PART B: 执行结果
- **01** 任务判断：确认你的需求是否属于部署、CI、环境检查、发布或运维排障，并标出输入、限制和预期结果。
- **02** 执行计划：优先按“The Iron Law / When to Use / The Process”拆成步骤，说明每一步会读取什么、修改什么、产出什么。
- **03** 交付结果：给出可复制的命令、文件改动、检查清单或内容草稿，并说明如何继续迭代。
- **04** 风险边界：结合 读取文件、写入/修改文件、执行终端命令、会按任务需要访问外部网络、通常不需要额外 API Key 给出执行前确认项。

## Running Rules
- 读取文件、写入/修改文件、执行终端命令；会按任务需要访问外部网络；通常不需要额外 API Key。
- 先小样例验证，再放大到真实任务。
- 交付时同时给结果、检查口径和下一步迭代建议。

SKILL.md SKILL.md

---
name: skill-claw
description: OpenClaw instance administration — manage hosts across macOS, Ubuntu/Debian, Docker, OCI, and Pr…
category: 运维部署
source: nyldn/claude-octopus
---

# skill-claw

## 什么时候使用
- 把部署运维方向的常用动作沉淀成 Agent 可调用的技能 适合处理部署、CI、发布、回滚、环境检查和运维排障，核心价值是把输入、判断、执行、验证和交付边界固定下来，避免 Agent 泛泛回答。 把任务拆成可执行、可检查、可继续迭代的步骤…
- 面向部署、CI、环境检查、发布或运维排障，优先处理能明确输入、步骤和验收标准的工作。

## 需要提供什么
- 目标材料、目录范围、期望结果和不可改动内容。
- 是否允许联网、执行命令、读写文件或调用外部服务。

## 执行规则
- 围绕「The Iron Law / When to Use / The Process」组织步骤，不把推断写成作者事实。
- 读取文件、写入/修改文件、执行终端命令；会按任务需要访问外部网络；通常不需要额外 API Key。
- 先跑小样例，确认结果可检查后再扩大任务范围。

## 输出要求
- 给出最终产物、关键证据、验证方式和下一步动作。
- 信息不足时标记 unknown，不编造命令、平台或依赖。

证据边界与执行链路

作者原文负责流程事实；仓库文件负责来源和命令；流狐只补充适用场景、限制和质量判断。

skill "skill-claw" {
  输入层     -> 用户目标 + 目标文件 + 禁止范围 + 验收标准
  上下文层   -> The Iron Law / When to Use / The Process
  规则层     -> SKILL.md 触发条件 / 执行顺序 / 输出格式
  运行层     -> Node.js / Docker | 读取文件、写入/修改文件、执行终端命令 | 会按任务需要访问外部网络
  安全层     -> 通常不需要额外 API Key + 小任务验证 + diff / 日志复核
  输出层     -> 可复制结果 + 检查清单 + 下一步迭代
}

解读按原文结构重写，命令、链接、术语均保留；右侧可核对作者原始 SKILL.md

先判断是否适合

核心用途：把部署运维方向的常用动作沉淀成 Agent 可调用的技能适合处理部署、CI、发布、回滚、环境检查和运维排障，核心价值是把输入、判断、执行、验证和交付边界固定下来，避免 Agent 泛泛回答。把任务拆成可执行、可检查、可继续迭代的步骤；通常不需要额外 A…
适用任务：更适合部署、CI、发布、回滚、环境检查和运维排障，尤其是输入、步骤、验收口径可以反复复用的场景。
不宜硬套：如果任务只有一次性问答、来源材料很少，或需要作者没有说明的命令和外部服务，应先降级为普通对话。

作者设计意图

触发依据：使用时机、上下文收集、输出格式和失败处理共同决定它是否适合当前任务。
来源边界：作者原文负责事实，仓库文件负责命令和文件证据；Fluxly 只补充用途、限制和使用判断。

作者的方法与取舍

执行主线：任务围绕「The Iron Law / When to Use / The Process」组织，把触发条件、必要上下文、执行规则和交付标准连成一条可复核的链路。
设计重点：重点不在重复教程，而在解释作者为什么规定这些步骤、哪些条件不可省略，以及结果偏离时应回到哪一层检查。
使用判断：先确认任务与原文边界一致，再决定是否启用；来源没有说明的命令、平台和依赖保持未知，不由 Fluxly 补写。

边界和复核

依赖条件：通常不需要额外 API Key，适合先用小任务验证触发是否稳定。
权限提醒：会涉及 read / write / shell-exec 权限，执行前要说明可读写范围、命令边界和回退方式。
质量标准：结果应包含明确产物、必要证据和下一步动作；如果只是泛泛解释，需要补充输入和验收条件后重跑。

OpenClaw Instance Administration

Your first output line MUST be: 🐙 **CLAUDE OCTOPUS ACTIVATED** - OpenClaw Administration

The Iron Law

DETECT PLATFORM FIRST. DIAGNOSE BEFORE CHANGING. VERIFY AFTER EVERY ACTION.

Never assume the OS or hosting environment. Never make changes without checking current state. Never claim success without verification.

When to Use

Use this skill for:

Installing, updating, or migrating OpenClaw instances
Gateway lifecycle management (start, stop, restart, health checks)
Host-level administration (packages, services, firewall, users, disks)
Security hardening and audits
Monitoring setup and troubleshooting
Backup and disaster recovery
Platform-specific configuration (macOS, Ubuntu/Debian, Docker, OCI, Proxmox)
Channel configuration (WhatsApp, Telegram, Discord, Slack, Signal)
Tailscale setup and management (Serve, Funnel, SSH, ACLs)
gogcli (Google Workspace CLI) setup and troubleshooting
OpenClaw scheduler, memory, plugins, and MCP server management

Do NOT use for:

Writing OpenClaw extensions or plugins (use plugin-dev skills)
Designing cloud architecture from scratch (use cloud-architect persona)
Application-level code debugging (use /octo:debug)

The Process

Phase 1: Detect Platform

You MUST detect the platform before running any administrative commands.

# Detect OS
uname -s  # Darwin = macOS, Linux = Ubuntu/Debian/Proxmox host

# If Linux, detect distro
cat /etc/os-release 2>/dev/null | head -5

# Check if inside Docker
[ -f /.dockerenv ] && echo "Docker container" || echo "Not Docker"

# Check if on Proxmox host
command -v pveversion &>/dev/null && pveversion 2>/dev/null

# Check if inside Proxmox LXC
[ -f /proc/1/environ ] && grep -q container=lxc /proc/1/environ 2>/dev/null && echo "Proxmox LXC"

# Check for OCI metadata
curl -s -m 2 http://169.254.169.254/opc/v2/instance/ -H "Authorization: Bearer Oracle" 2>/dev/null | head -5

Set the platform context before proceeding:

macOS: Homebrew, launchd, Application Firewall, APFS
Ubuntu/Debian: apt, systemd, ufw, ext4/ZFS
Docker: docker compose, container logs, volume management
OCI: ARM architecture, VCN security, Tailscale, systemd
Proxmox: qm/pct, vzdump, ZFS, LXC bind mounts

Phase 2: Assess Current State

Run diagnostics appropriate to the platform:

OpenClaw Diagnostics (All Platforms)

# Check OpenClaw installation
command -v openclaw &>/dev/null && openclaw --version

# Gateway status
openclaw status --all

# Health check
openclaw health

# Doctor (auto-detect and report issues)
openclaw doctor

# Security audit
openclaw security audit

macOS Host Diagnostics

# Service status
launchctl list | grep openclaw

# System resources
vm_stat | head -10
df -h /

# Homebrew health
brew doctor 2>&1 | head -20

# Firewall status
/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

Ubuntu/Debian Host Diagnostics

# Service status
systemctl --user status openclaw-gateway 2>/dev/null || systemctl status openclaw-gateway

# System resources
free -h
df -h /

# Failed services
systemctl --failed

# Firewall status
ufw status verbose

# Pending updates
apt list --upgradable 2>/dev/null | head -20

Docker Diagnostics

# Container status
docker compose ps

# Container health
docker inspect --format='{{.State.Health.Status}}' openclaw-gateway 2>/dev/null

# Resource usage
docker stats --no-stream

# Disk usage
docker system df

Proxmox Diagnostics

# Proxmox version
pveversion -v

# VM/LXC list
qm list 2>/dev/null
pct list 2>/dev/null

# Storage status
pvesm status

# ZFS health
zpool status 2>/dev/null

# Cluster status
pvecm status 2>/dev/null

Phase 3: Execute the Requested Action

Route to the appropriate workflow based on user intent:

Installation Workflows

Platform	Method
macOS	`curl -fsSL https://openclaw.ai/install.sh \| bash && openclaw onboard --install-daemon`
Ubuntu/Debian	`curl -fsSL https://openclaw.ai/install.sh \| bash && openclaw onboard --install-daemon`
Docker	`git clone https://github.com/openclaw/openclaw.git && cd openclaw && ./docker-setup.sh`
OCI ARM	Install Node.js 22 + build-essential, then curl installer, enable systemd lingering, configure Tailscale
Proxmox LXC	Create Ubuntu/Debian LXC, install Node.js 22, curl installer, configure bind mounts for persistence

Service Lifecycle

Action	macOS	Linux	Docker
Start	`launchctl start gui/$UID/com.openclaw.gateway`	`systemctl --user start openclaw-gateway`	`docker compose up -d`
Stop	`launchctl stop gui/$UID/com.openclaw.gateway`	`systemctl --user stop openclaw-gateway`	`docker compose down`
Restart	`openclaw gateway restart`	`openclaw gateway restart`	`docker compose restart`
Status	`launchctl list \| grep openclaw`	`systemctl --user status openclaw-gateway`	`docker compose ps`
Logs	`openclaw logs --follow`	`journalctl --user -u openclaw-gateway -f`	`docker compose logs -f`

Update Workflow

Backup config, credentials, and workspace:

cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.bak
cp -r ~/.openclaw/credentials/ ~/.openclaw/credentials.bak/

Update using the appropriate method:

# Installer (recommended)
curl -fsSL https://openclaw.ai/install.sh | bash

# npm
npm i -g openclaw@latest

# Docker
docker compose pull && docker compose up -d

Verify the update:

openclaw --version
openclaw doctor
openclaw health

Security Hardening Checklist

Gateway binds to loopback only (127.0.0.1 / ::1)
Token auth enabled — tokens treated as admin credentials
Tailscale or VPN for remote access — never expose port 18789
Filesystem restrictions: tools.exec.applyPatch.workspaceOnly: true, tools.fs.workspaceOnly: true
Docker sandboxing enabled for agent tool execution
DM pairing policy enforced for unknown senders
openclaw security audit --deep --fix passes clean
Credential permissions: chmod 700 ~/.openclaw/credentials/
Firewall: only required ports open (SSH, Tailscale UDP 41641)
Use Anthropic Opus 4.6 as agent model (best prompt injection resistance)

Phase 4: Verify Outcome

After every action, verify it took effect:

# Check gateway is running
openclaw status

# Check health
openclaw health

# Run doctor to catch issues
openclaw doctor

# If security changes were made
openclaw security audit

Report the before/after state and any remaining issues.

Key File Paths

Path	Purpose
`~/.openclaw/openclaw.json`	Main configuration (JSON5)
`~/.openclaw/credentials/`	API keys and auth tokens
`~/.openclaw/workspace/`	Agent workspace data
`~/.openclaw/sandboxes/`	Sandbox isolation directories
`~/Library/LaunchAgents/com.openclaw.gateway.plist`	macOS launchd service
`~/.config/systemd/user/openclaw-gateway.service`	Linux systemd user service

OpenClaw CLI Quick Reference

openclaw status [--all|--deep]         # Health overview
openclaw health                        # Gateway health check
openclaw doctor [--fix]                # Diagnostics + auto-fix
openclaw logs [--follow]               # Gateway logs
openclaw security audit [--deep] [--fix]  # Security scan

openclaw gateway start|stop|restart    # Service lifecycle
openclaw gateway install|uninstall     # Daemon management
openclaw configure                     # Interactive config wizard
openclaw update [--channel ...]        # Self-update

openclaw channels list|status|add|remove  # Messaging channels
openclaw models list|status [--probe]     # AI model config
openclaw agents list|add|delete           # Agent management
openclaw sessions list|history            # Session management
openclaw skills list|info|check           # Skills
openclaw plugins list|install|doctor      # Plugins
openclaw cron status|list|add|edit|rm     # Scheduled jobs

Tailscale Management

tailscale up [--ssh]                             # Connect to tailnet
tailscale serve https / http://127.0.0.1:18789  # Expose OpenClaw to tailnet
tailscale serve status                           # Check serve config
tailscale status                                 # List connected devices
tailscale ping <hostname>                        # Test connectivity
tailscale netcheck                               # Network diagnostics

Rules:

Use tailscale serve for OpenClaw access (tailnet only)
Warn before tailscale funnel (exposes to public internet)
Docker: use sidecar pattern with network_mode: "service:tailscale"
Proxmox LXC: add TUN device to container config before installing

Channel Integration

Channel	Library	Admin Setup
WhatsApp	Baileys	`openclaw channels login whatsapp` → scan QR
Telegram	Grammy	Token from @BotFather → set in config
Discord	discord.js	Bot token from Developer Portal
Slack	Bolt	App manifest + bot/app tokens (Socket Mode)
Signal	signal-cli	`openclaw channels login signal` → linked device

openclaw channels list|status|add|remove|login|logout
openclaw channels dm-allow <channel> user:@username
openclaw channels info <channel> [--dm-list|--detailed]

Integration with Other Skills

Scenario	Route
Infrastructure architecture needed	Hand off to cloud-architect persona
Application-level bug found	Hand off to `/octo:debug`
Security vulnerability in code	Hand off to `/octo:security`
Need CI/CD pipeline for deployment	Hand off to deployment-engineer persona
OpenClaw extension development	Hand off to plugin-dev skills

Red Flags — Don't Do This

Action	Why It's Wrong
Assume the OS without checking	macOS and Linux commands differ significantly
Expose port 18789 to the internet	Gateway should only bind to loopback; use Tailscale
Run `openclaw security audit --fix` without `--deep` first	Understand the findings before auto-remediating
Skip backup before updating	Updates can break config; always back up first
Use `docker compose down -v` without warning	Destroys volumes and all data
Grant `manage all-resources` in OCI IAM	Violates least-privilege; use scoped policies
Run privileged LXC containers on Proxmox	Unprivileged LXC is safer; only privilege if absolutely needed

安装命令

一键复制安装选择包管理器,点击右侧复制,粘贴到终端回车即可

npx skills add nyldn/claude-octopus/.claude/skills/skill-claw -y

查看通用安装教程

查看 Skill 原文

兼容工具

Claude Code
Cursor
Cline
Codex
Windsurf
Gemini
OpenCode
Roo Code
AAide
+Augment
GitHub Copilot
OpenClaw
KKiro
Junie
WWarp
Goose
Trae
Kilo Code
OpenHands
Amp
Zencoder
CContinue
AIAider
CodeBuddy
CodeGeeX
Replit Agent

安全审计

83 / 100

社区

未声明 license/许可。
未声明 version。
未限定 allowed-tools，默认拥有全部工具权限。
检出高风险片段：pipe_curl_to_shell

元信息

来源: github
nyldn/claude-octopus
English

@nyldn 的其他技能

分类与标签

分类运维部署