Skill: dinstein/openclaw-ops (version 1.2.1)

--- name: openclaw-ops version: 1.2.1 description: Use when diagnosing, repairing, or maintaining an OpenClaw Gateway on the same machine. Designed for rescue agents to fix a down gateway or check operational health. Supports Linux (systemd) and macOS (launchd). repository: https://github.com/dinstein/openclaw-ops-skill requirements: - Shell access on the same machine as the OpenClaw Gateway - Read/write access to ~/.openclaw/ (config, agents, sessions) - Read access to systemd user service config (Linux) or LaunchAgents (macOS) - Node.js 18+ and npm (for openclaw CLI) - Optional: Tailscale CLI (for reverse proxy troubleshooting) security_notes: - This skill instructs the agent to read and modify OpenClaw config files - The agent will access env files containing tokens (but is instructed never to print them) - Config edits are always preceded by timestamped backups - Destructive operations require user confirmation --- # OpenClaw Operations ## Design Philosophy This skill serves **two core scenarios** and nothing else: 1. **Rescue** — The main OpenClaw Gateway is down or broken. You (the rescue agent) need to diagnose the root cause, fix it, and bring the gateway back online. 2. **Health Check** — The main OpenClaw Gateway is running. You need to verify its operational health, clean up resources, or perform maintenance tasks like upgrades. **What this skill is NOT for:** - Day-to-day business configuration (adding channels, configuring agents, setting up integrations) - Application-level issues (agent behavior, prompt tuning, skill management) - Initial deployment or first-time setup (use `openclaw daemon install` and `openclaw configure`) **Principle:** Diagnose → Judge → Act → Verify. Never skip steps. ## Platform Detection Detect the platform first — commands differ between Linux (systemd) and macOS (launchd): ```bash OS=$(uname -s) # "Linux" or "Darwin" echo "Platform: $OS" ``` ## Port Detection Do NOT assume port 18789. Detect the actual configured port first: ```bash PORT=$(openclaw config get gateway.port 2>/dev/null | grep -oE '[0-9]+') PORT=${PORT:-18789} # fallback to default only if config unavailable echo "Gateway port: $PORT" ``` Use `$PORT` in all port-related commands throughout this guide. --- # Scenario A: Rescue (Gateway Down) Follow these sections in order when the main gateway is not running. ## A1. Assess the Situation ```bash # Is the service running at all? # Linux: systemctl --user status openclaw-gateway # macOS: launchctl list | grep openclaw # Is the process alive? pgrep -af openclaw # Is the port listening? # Linux: ss -tlnp | grep $PORT # macOS: lsof -iTCP:$PORT -sTCP:LISTEN ``` ## A2. Check Logs for Root Cause **Linux:** ```bash journalctl --user -u openclaw-gateway --since "1 hour ago" --no-pager | grep -iE "error|crash|fatal|SIGTERM|OOM" # Last 50 lines for context journalctl --user -u openclaw-gateway -n 50 --no-pager ``` **macOS:** ```bash LOG_DIR="$HOME/.openclaw/logs" grep -iE "error|crash|fatal" "$LOG_DIR/gateway.log" | tail -20 tail -50 "$LOG_DIR/gateway.log" # Also check unified log log show --predicate 'process == "node"' --last 1h | grep -iE "error|crash|fatal" ``` ### Common crash patterns | Log pattern | Meaning | Fix | |------------|---------|-----| | `EADDRINUSE` | Port already in use | Find conflicting process: `ss -tlnp \| grep $PORT` (Linux) or `lsof -iTCP:$PORT` (macOS), kill it or change port | | `ENOMEM` / `JavaScript heap` | Out of memory | Check `free -h` (Linux) / `vm_stat` (macOS), kill memory hogs or increase Node heap | | `SyntaxError` in config | Bad JSON in openclaw.json | See A3 Config Repair | | `MODULE_NOT_FOUND` | Missing dependency | `cd $(npm root -g)/openclaw && npm install --production` | | `Invalid token` / `401` / `403` | Auth failure | Check tokens in env file or systemd drop-in | | `ECONNREFUSED` | Upstream unreachable | Check network, Tailscale, API endpoints | ## A3. Config Repair **Always backup first:** ```bash cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.bak.$(date +%s) ``` **JSON syntax validation:** ```bash python3 -c "import json; json.load(open('$HOME/.openclaw/openclaw.json'))" ``` Common JSON issues: trailing comma, missing quotes, unescaped characters. The error message shows line/position. **Config schema validation:** ```bash openclaw config get gateway # check gateway config section openclaw config get channels # check channels config section ``` **Common config errors:** | Symptom | Likely cause | Fix | |---------|-------------|-----| | "device identity mismatch" | Service env token ≠ config token | Sync tokens between env file and openclaw.json | | Agent not routing | `bindings` misconfigured | Bindings go at top-level, not inside `agents.list[].routing` | **After fixing, validate:** ```bash python3 -c "import json; json.load(open('$HOME/.openclaw/openclaw.json')); print('JSON OK')" openclaw status ``` ## A4. Check Resources ```bash # Disk space df -h ~ # Memory (Linux) free -h # Memory (macOS) vm_stat | head -5 # Node.js available? node -v which openclaw openclaw --version ``` ## A5. Restart and Verify Only restart **after identifying and fixing the root cause**. **Linux:** ```bash systemctl --user restart openclaw-gateway sleep 3 systemctl --user status openclaw-gateway journalctl --user -u openclaw-gateway -n 20 --no-pager ``` **macOS:** ```bash launchctl kickstart -k "gui/$(id -u)/com.openclaw.gateway" sleep 3 launchctl list | grep openclaw tail -20 ~/.openclaw/logs/gateway.log ``` **If service won't start at all:** ```bash # Manual foreground start for better error output openclaw gateway start ``` **Final verification:** ```bash openclaw status openclaw doctor --non-interactive ``` --- # Scenario B: Health Check (Gateway Running) Follow these sections for routine operational checks on a running gateway. ## B1. Quick Health Check ```bash # Comprehensive check — start here openclaw doctor # If issues found, auto-fix safe ones openclaw doctor --fix ``` ## B2. Update & Upgrade ```bash # Check versions CURRENT=$(openclaw --version) LATEST=$(npm view openclaw version) echo "Current: $CURRENT Latest: $LATEST" ``` **Perform update:** ```bash # 1. Save doctor baseline openclaw doctor --non-interactive 2>&1 | tee /tmp/doctor-before.txt # 2. Backup config cp ~/.openclaw/openclaw.json ~/.openclaw/openclaw.json.pre-upgrade.$(date +%s) # 3. Update npm update -g openclaw openclaw --version # 4. Restart # Linux: systemctl --user restart openclaw-gateway # macOS: launchctl kickstart -k "gui/$(id -u)/com.openclaw.gateway" # 5. Compare doctor output sleep 5 openclaw doctor --non-interactive 2>&1 | tee /tmp/doctor-after.txt diff /tmp/doctor-before.txt /tmp/doctor-after.txt ``` **Rollback:** ```bash npm install -g openclaw@<previous_version> cp ~/.openclaw/openclaw.json.pre-upgrade.<timestamp> ~/.openclaw/openclaw.json # Restart (platform-appropriate command above) ``` ## B3. Session & Disk Cleanup ```bash # Check disk usage per agent for agent_dir in ~/.openclaw/agents/*/; do agent=$(basename "$agent_dir") size=$(du -sh "$agent_dir/sessions/" 2>/dev/null | cut -f1) count=$(find "$agent_dir/sessions/" -name "*.jsonl" 2>/dev/null | wc -l) echo "$agent: $size ($count transcripts)" done # Auto-fix orphans openclaw doctor --fix # Manual cleanup: old transcripts (>30 days) find ~/.openclaw/agents/*/sessions/ -name "*.jsonl" -mtime +30 -exec ls -lh {} \; # Review, then delete if safe: find ~/.openclaw/agents/*/sessions/ -name "*.jsonl" -mtime +30 -delete ``` ## B4. Backup ```bash BACKUP_DIR=~/openclaw-backup-$(date +%Y%m%d-%H%M%S) mkdir -p "$BACKUP_DIR" # Core files cp ~/.openclaw/openclaw.json "$BACKUP_DIR/" [ -f ~/.openclaw/env ] && cp ~/.openclaw/env "$BACKUP_DIR/" || echo "No env file (tokens may be in systemd drop-in or plist)" cp -r ~/.openclaw/agents "$BACKUP_DIR/" cp -r ~/.openclaw/devices "$BACKUP_DIR/" cp -r ~/.openclaw/workspace "$BACKUP_DIR/" # Service config if [ "$(uname -s)" = "Linux" ]; then cp ~/.config/systemd/user/openclaw-gateway.service "$BACKUP_DIR/" 2>/dev/null cp -r ~/.config/systemd/user/openclaw-gateway.service.d "$BACKUP_DIR/" 2>/dev/null elif [ "$(uname -s)" = "Darwin" ]; then cp ~/Library/LaunchAgents/com.openclaw.gateway.plist "$BACKUP_DIR/" 2>/dev/null fi echo "Backup saved to $BACKUP_DIR" ``` ## B5. Tailscale Serve Check If OpenClaw uses Tailscale Serve as reverse proxy: ```bash tailscale status tailscale serve status curl -s -o /dev/null -w "%{http_code}" http://localhost:$PORT/healthz || echo "Gateway not reachable on localhost" ``` **Reconfigure if broken:** ```bash tailscale serve reset tailscale serve https / http://localhost:$PORT tailscale serve status ``` --- # Reference ## Troubleshooting Quick Index | Symptom | Path | |---------|------| | Gateway won't start | A1 → A2 → A3 → A5 | | Gateway crashed | A2 (logs) → A4 (resources) → A3 (config) → A5 (restart) | | Config broken after edit | A3 → A5 | | Disk filling up | B3 | | After upgrade something broke | B2 (rollback) | | Tailscale not proxying | B5 | ## `openclaw doctor` Reference | Flag | Effect | |------|--------| | (none) | Interactive health check | | `--fix` | Apply safe repairs (orphan cleanup, stale locks) | | `--force` | Aggressive repairs (may overwrite custom service config) | | `--deep` | Scan system for extra gateway installs | | `--non-interactive` | No prompts, safe migrations only | **`--fix` repairs:** orphan transcripts, stale session locks, legacy key migration. **`--fix` does NOT:** modify openclaw.json, change service files (unless `--force`), delete workspace files. ## Key Commands | Command | Purpose | |---------|---------| | `openclaw status` | Quick status: running, version, basic info | | `openclaw doctor` | Deep health check: state, channels, plugins, skills | | `openclaw doctor --fix` | Health check + auto-repair safe issues | | `openclaw gateway start` | Start gateway in foreground (for debugging) | | `openclaw daemon install` | Install as persistent service (systemd/launchd) | | `openclaw daemon restart` | Restart the service | | `openclaw config get <path>` | Read config value | | `openclaw config set <path> <value>` | Write config value | ## Safety Rules 1. **Always check logs before changing anything** — understand the problem first 2. **Always backup before editing config** — `cp` with timestamp suffix 3. **Always validate JSON after editing** — one bad comma kills the service 4. **Never print secrets** — check env file exists, don't cat it 5. **Never delete workspace files** — use `trash` if you must remove something 6. **Always verify after restart** — status + logs, don't assume it worked 7. **Destructive operations require confirmation** — ask the user before wiping data ## File Layout ``` ~/.openclaw/ ├── openclaw.json # Main config ├── openclaw.json.bak # Auto-backup ├── env # Environment variables (secrets) ├── logs/ # macOS: launchd log output ├── agents/ # Per-agent configs │ └── <agent>/agent/ │ ├── auth-profiles.json │ └── models.json ├── devices/ │ └── paired.json ├── workspace/ # Agent workspace └── sessions/ # Session logs # Linux: ~/.config/systemd/user/ ├── openclaw-gateway.service └── openclaw-gateway.service.d/ └── env.conf # macOS: ~/Library/LaunchAgents/ └── com.openclaw.gateway.plist ```

path: README.md
content: # openclaw-ops

[English](README.md) | [中文](README_CN.md)

A skill that teaches any AI agent how to operate and maintain an [OpenClaw](https://openclaw.ai) Gateway running as a persistent service.

Works with **any agent that has shell access** — Claude Code, Codex, OpenClaw, Pi, or any AI agent with shell access running on the same machine as the OpenClaw Gateway.

Supports both **Linux (systemd)** and **macOS (launchd)**.

## Install

> **⚠️ Install this skill on your rescue agent (Claude Code, secondary OpenClaw, etc.), NOT on the main OpenClaw Gateway you want to maintain.**

### Ask your agent to install it

Just tell your rescue agent in a conversation:

```
> Install the openclaw-ops skill from https://github.com/dinstein/openclaw-ops-skill
```

The agent will download `SKILL.md` and place it in the correct skills directory automatically.

### From ClawHub (when using a secondary OpenClaw as rescue agent)

```bash
clawhub install openclaw-ops
```

### Manual

Copy `SKILL.md` into your agent's skills directory:

```bash
# Claude Code
mkdir -p ~/.claude/skills/openclaw-ops
cp SKILL.md ~/.claude/skills/openclaw-ops/SKILL.md

# OpenClaw
mkdir -p ~/.openclaw/workspace/skills/openclaw-ops
cp SKILL.md ~/.openclaw/workspace/skills/openclaw-ops/SKILL.md

# Other agents — place in whatever skills directory your agent reads from
```

## Architecture

```mermaid
graph LR
    You["👤 You"] -->|remote access| Rescue["🛠️ Rescue Agent<br/>+ openclaw-ops skill"]
    Rescue -->|diagnoses & fixes| Main["🦞 Main OpenClaw<br/>Gateway"]
    Main -->|serves users| Users["👥 Discord / Telegram / etc"]
```

**Main OpenClaw Gateway** — Your primary AI agent system. Handles all day-to-day operations: chat channels, cron jobs, sessions, etc.

**Rescue Agent** — A separate agent (Claude Code, secondary OpenClaw instance, or any AI agent with shell access) with this skill installed. Lives on the same machine. Its sole purpose: fix the main gateway when it breaks, and perform operational health checks.

**This skill** — Teaches the rescue agent what commands to run, how to interpret output, and what steps to follow for diagnosis and repair.

## Two Core Scenarios

### 🔴 Rescue: Main Gateway is Down

The main OpenClaw is crashed, misconfigured, or won't start. You connect to the rescue agent and ask it to fix things.

**Example 1: Won't start after config edit**
```
You: "I edited openclaw.json and now it won't start"

Rescue agent: validates JSON → finds trailing comma on line 47 →
backs up file → fixes syntax → restarts gateway → verifies health
```

**Example 2: Broken after upgrade**
```
You: "I upgraded OpenClaw and now the gateway keeps crashing"

Rescue agent: checks crash logs → finds MODULE_NOT_FOUND for a removed plugin →
reinstalls dependencies → restarts → still failing →
rolls back to previous version → gateway is back online
```

### 🟢 Health Check: Main Gateway is Running

The main OpenClaw is working fine, but you want to verify health, update, or clean up.

```
You: "Run a health check on OpenClaw"

Rescue agent: runs openclaw doctor → reports status, orphan count,
channel connectivity, disk usage → offers to fix any issues found
```

## Connecting to the Rescue Agent

When the main OpenClaw is down, you can't talk to it through Discord/Telegram. You need an alternative way to reach the rescue agent on the server.

### Option 1: Native Remote Control (⭐ Recommended)

If your agent supports native remote access, use it — the most seamless experience with full agent capabilities from your browser or mobile device.

- **Claude Code** — [Remote Control](https://code.claude.com/docs/en/remote-control): access your server-side Claude Code from any browser, with built-in auth and session persistence

Currently only Claude Code offers this. As more agents add native remote access, this will be the preferred approach for all.

### Option 2: Remote Agent Platforms

Third-party platforms that let you manage and interact with coding agents on remote machines:

- [Happy](https://github.com/slopus/happy) — Mobile & web client for Claude Code and Codex with push notifications, device switching, and E2E encryption
- [Hapi](https://github.com/tiann/hapi) — Local-first remote control for Claude Code / Codex / Gemini / OpenCode via Web, PWA, or Telegram Mini App
- Similar products that support remote shell-capable agent access

These are good when your agent doesn't have native remote control, or when you want a unified dashboard for multiple agents.

### Option 3: SSH + Agent CLI

SSH into the server and run the agent directly in the terminal:

```bash
ssh user@your-server
claude  # or codex, or any agent CLI
```

**Tips for mobile:**
- Use SSH client apps (Termius, Blink, etc.) from your phone
- Use tmux to keep sessions alive between connections:

```bash
# On the server (one-time setup)
tmux new -s rescue
claude

# Later, from anywhere
ssh user@your-server
tmux attach -t rescue
```

- VS Code Remote SSH also works well from a laptop

## What it covers

| Module | Scenario | Description |
|--------|----------|-------------|
| Crash diagnosis | 🔴 Rescue | Read logs, identify root cause |
| Config repair | 🔴 Rescue | JSON fix, schema validation, common errors |
| Service restart | 🔴 Rescue | Safe restart after fixing root cause |
| Resource check | 🔴 Rescue | Disk, memory, Node.js, dependencies |
| Health check | 🟢 Health | `openclaw doctor`, service status |
| Update & upgrade | 🟢 Health | Version check, safe upgrade, rollback |
| Disk cleanup | 🟢 Health | Orphan transcripts, session management |
| Backup | 🟢 Health | Config, agents, workspace backup |
| Tailscale check | 🟢 Health | Reverse proxy verification |

## Requirements

The rescue agent needs:

- **Shell access** on the same machine as the OpenClaw Gateway
- **Read/write access** to `~/.openclaw/` (config, agents, sessions)
- **Node.js 18+** and npm (for the `openclaw` CLI)
- **Optional:** Tailscale CLI (for reverse proxy troubleshooting)

### Security considerations

This skill instructs the agent to:
- Read and modify OpenClaw config files (always with backup first)
- Access env files containing tokens (but **never print them**)
- Restart system services (systemd / launchd)
- Delete old session transcripts (only with user confirmation)

All destructive operations require explicit user approval.

## How it works

This is a **pure documentation skill** — no scripts, no external dependencies, no framework lock-in. Install it in any agent that can read markdown and run shell commands. It teaches the agent:

1. **What to check** — the right commands for each situation
2. **How to interpret** — what the output means and common error patterns
3. **What to do** — step-by-step fix procedures with safety guardrails
4. **How to verify** — confirmation steps after every action

## Safety

The skill enforces these rules:

- Always check logs before making changes
- Always backup config before editing
- Always validate JSON after editing
- Never print secrets (env files)
- Never delete workspace files without confirmation
- Always verify after restart

## License

MIT


path: README_CN.md
content: # openclaw-ops

[English](README.md) | [中文](README_CN.md)

一个教 AI Agent 如何运维 [OpenClaw](https://openclaw.ai) Gateway 的技能。

适用于**任何有 shell 访问权限的 Agent** — Claude Code、Codex、OpenClaw、Pi 或任何运行在 OpenClaw Gateway 同一台机器上的 AI Agent。

支持 **Linux (systemd)** 和 **macOS (launchd)**。

## 安装

> **⚠️ 本技能应安装在 Rescue Agent（Claude Code、备用 OpenClaw 等）上，而不是你要维护的主 OpenClaw Gateway 里。**

### 在对话中让 Agent 安装

直接在对话里告诉你的 Rescue Agent：

```
> 从 https://github.com/dinstein/openclaw-ops-skill 安装 openclaw-ops 技能
```

Agent 会自动下载 `SKILL.md` 并放到正确的技能目录。

### 通过 ClawHub（使用第二个 OpenClaw 作为 Rescue Agent 时）

```bash
clawhub install openclaw-ops
```

### 手动安装

将 `SKILL.md` 复制到你的 Agent 技能目录：

```bash
# Claude Code
mkdir -p ~/.claude/skills/openclaw-ops
cp SKILL.md ~/.claude/skills/openclaw-ops/SKILL.md

# OpenClaw
mkdir -p ~/.openclaw/workspace/skills/openclaw-ops
cp SKILL.md ~/.openclaw/workspace/skills/openclaw-ops/SKILL.md

# 其他 Agent — 放到你的 Agent 读取技能文件的目录
```

## 架构

```mermaid
graph LR
    You["👤 你"] -->|远程连接| Rescue["🛠️ Rescue Agent<br/>+ openclaw-ops 技能"]
    Rescue -->|诊断 & 修复| Main["🦞 主 OpenClaw<br/>Gateway"]
    Main -->|服务用户| Users["👥 Discord / Telegram 等"]
```

**主 OpenClaw Gateway** — 你的主要 AI Agent 系统，处理日常操作：聊天频道、定时任务、会话等。

**Rescue Agent** — 一个独立的 Agent（Claude Code、备用 OpenClaw 实例或其他有 shell 访问权限的 AI Agent），安装了本技能。和主 Gateway 运行在同一台机器上。它的唯一职责：主 Gateway 出问题时修复它，以及执行运维健康检查。

**本技能** — 教会 Rescue Agent 该跑什么命令、如何解读输出、按什么步骤诊断和修复。

## 两个核心场景

### 🔴 救援：主 Gateway 挂了

主 OpenClaw 崩溃、配置损坏或无法启动。你连接到 Rescue Agent 让它修复。

**示例 1：改了配置后启动不了**
```
你: "我改了 openclaw.json，现在启动不了了"

Rescue Agent: 校验 JSON → 发现第 47 行多了个逗号 →
备份文件 → 修复语法 → 重启 Gateway → 验证健康状态
```

**示例 2：升级后崩溃**
```
你: "升级了 OpenClaw 之后 Gateway 一直崩"

Rescue Agent: 查崩溃日志 → 发现 MODULE_NOT_FOUND，某个插件被移除了 →
重装依赖 → 重启 → 还是挂 →
回滚到上个版本 → Gateway 恢复正常
```

### 🟢 健康检查：主 Gateway 运行中

主 OpenClaw 正常运行，你想确认运行状态、升级或清理。

```
你: "检查一下 OpenClaw 的运行状况"

Rescue Agent: 运行 openclaw doctor → 报告状态、孤立文件数量、
频道连接情况、磁盘使用 → 提供修复建议
```

## 如何远程连接 Rescue Agent

主 OpenClaw 挂了之后，你无法通过 Discord/Telegram 和它对话。你需要其他方式连接服务器上的 Rescue Agent。

### 方案 1：原生远程控制（⭐ 推荐）

如果你的 Agent 支持原生远程访问，优先使用 — 体验最好，浏览器或手机直接操作。

- **Claude Code** — [Remote Control](https://code.claude.com/docs/en/remote-control)：从任何浏览器访问服务器上的 Claude Code，自带认证和会话保持

目前只有 Claude Code 提供此功能。随着更多 Agent 支持原生远程访问，这将成为所有 Agent 的首选方案。

### 方案 2：远程 Agent 管理平台

第三方平台，支持远程管理和操控服务器上的 Agent：

- [Happy](https://github.com/slopus/happy) — Claude Code 和 Codex 的移动端 & Web 客户端，支持推送通知、设备切换和端到端加密
- [Hapi](https://github.com/tiann/hapi) — 本地优先的远程控制，支持 Claude Code / Codex / Gemini / OpenCode，通过 Web、PWA 或 Telegram Mini App 访问
- 类似支持远程 shell Agent 访问的产品

适合 Agent 没有原生远程控制、或者需要统一管理多个 Agent 的场景。

### 方案 3：SSH + Agent CLI

SSH 登录服务器，直接在终端运行 Agent：

```bash
ssh user@your-server
claude  # 或 codex，或任何 Agent CLI
```

**移动端技巧：**
- 使用 SSH 客户端 App（Termius、Blink 等）
- 用 tmux 保持会话：

```bash
# 服务器上（一次性设置）
tmux new -s rescue
claude

# 之后从任何地方
ssh user@your-server
tmux attach -t rescue
```

- VS Code Remote SSH 也很好用（笔记本场景）

## 功能覆盖

| 模块 | 场景 | 说明 |
|------|------|------|
| 崩溃诊断 | 🔴 救援 | 读取日志、定位根因 |
| 配置修复 | 🔴 救援 | JSON 修复、Schema 校验、常见错误 |
| 服务重启 | 🔴 救援 | 修复根因后安全重启 |
| 资源检查 | 🔴 救援 | 磁盘、内存、Node.js、依赖 |
| 健康检查 | 🟢 运维 | `openclaw doctor`、服务状态 |
| 更新升级 | 🟢 运维 | 版本检查、安全升级、回滚 |
| 磁盘清理 | 🟢 运维 | 孤立 transcript、会话管理 |
| 备份 | 🟢 运维 | 配置、agents、workspace 备份 |
| Tailscale 检查 | 🟢 运维 | 反向代理验证 |

## 前置要求

Rescue Agent 需要：

- **Shell 访问权限** — 与 OpenClaw Gateway 在同一台机器上
- **读写权限** — `~/.openclaw/` 目录（配置、agents、sessions）
- **Node.js 18+** 和 npm（用于 `openclaw` CLI）
- **可选：** Tailscale CLI（反向代理排查）

### 安全说明

本技能会指导 Agent：
- 读取和修改 OpenClaw 配置文件（修改前必定备份）
- 访问包含 token 的 env 文件（但**绝不打印内容**）
- 重启系统服务（systemd / launchd）
- 删除旧的 session transcript（需用户确认）

所有破坏性操作都需要用户明确批准。

## 工作原理

这是一个**纯文档技能** — 无脚本、无外部依赖、无框架绑定。安装到任何能读取 Markdown 并执行 shell 命令的 Agent 中即可。它教会 Agent：

1. **检查什么** — 每种场景对应的正确命令
2. **如何解读** — 输出含义和常见错误模式
3. **怎么修复** — 带安全护栏的逐步修复流程
4. **如何验证** — 每个操作后的确认步骤

## 安全规则

- 修改前必须先查日志
- 编辑配置前必须备份
- 编辑后必须校验 JSON
- 不打印敏感信息（env 文件）
- 不删除 workspace 文件，除非用户确认
- 重启后必须验证服务状态

## 许可证

MIT


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)