[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6PB6E9CF56RMPSNGPMDBD82":3,"skill-same:01M6PB6E9CF56RMPSNGPMDBD82":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":22,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":34,"commitSha":56,"skillDirectory":57,"forksCount":13,"repositoryHtmlUrl":58,"repositoryHomepageUrl":6,"ownerHtmlUrl":59,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":60,"install":61,"resources":74},"01M6PB6E9CF56RMPSNGPMDBD82","openclaw-deployment-hardening",null,"Secure OpenClaw deployments with preflight hardening checks, CI\u002FCD guardrails, container runtime restrictions, and post-deploy verification.","duc-duy-1612\u002FOnline-Delivery-Systems-Web","duc-duy-1612","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F192231384?v=4","01M6NSDKQQDKVTHZ8DZMZ1VYY6","01M6NSDKW8DDVTQHBT1HBDDJPT",0,"MIT","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fopenclaw-deployment-hardening\u002FSKILL.md",[17],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"openclaw deployment hardening","deployment","hardening","openclaw","only","CI\u002FCD","relevant","scripts","scope","critical","active","main","community","devops-security","Guardrails","ci","verification","assessment","secure","security","2026-11-10 10:12:30",false,"---\nname: openclaw-deployment-hardening\ndescription: Secure OpenClaw deployments with preflight hardening checks, CI\u002FCD guardrails,\n  container runtime restrictions, and post-deploy verification.\ncategory: security\nrisk: critical\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires the relevant security tooling (scanners, vault CLIs) and an\n  authorized scope for any active assessment. Docs-only; helper scripts and templates\n  not bundled.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# OpenClaw Deployment Hardening\n\nUse this skill to add repeatable security gates around OpenClaw build and deployment workflows.\n\n## Enforce a Secure Build Pipeline\n\nAdd mandatory controls to CI before artifacts are promoted:\n\n1. Dependency and lockfile vulnerability scan (fail on critical CVEs).\n2. Image scan for OS\u002Fpackage vulnerabilities.\n3. Secret scanning across source and build context.\n4. SBOM generation and artifact signing.\n5. Policy check that blocks deploy when controls fail.\n\nExample CI step order:\n\n```bash\n# Build\nnpm ci\nnpm run build\n\n# Security gates\ntrivy fs .\ntrivy image my-registry\u002Fopenclaw:${GIT_SHA}\nsyft my-registry\u002Fopenclaw:${GIT_SHA} -o spdx-json > sbom.json\ncosign sign --key cosign.key my-registry\u002Fopenclaw:${GIT_SHA}\n```\n\n## Lock Down Container Runtime\n\nRun OpenClaw with restrictive defaults:\n\n- Non-root user in container\n- Read-only root filesystem where possible\n- Drop all Linux capabilities, add back only required\n- `no-new-privileges` enabled\n- Constrained CPU\u002Fmemory limits to reduce abuse impact\n- Seccomp\u002FAppArmor (or equivalent) profile enforced\n\nKubernetes-oriented expectations:\n\n- `runAsNonRoot: true`\n- `allowPrivilegeEscalation: false`\n- `readOnlyRootFilesystem: true`\n- network policy deny-all baseline with explicit allow rules\n\n## Gate Production Promotion\n\nRequire explicit promotion checks:\n\n- Security sign-off on CVE exceptions.\n- Signed artifact verification in deployment stage.\n- Drift check between expected and live manifest values.\n- Deployment only from immutable tags or digests.\n\nAvoid mutable `latest` tags for production OpenClaw services.\n\n## Protect Data and Session Surfaces\n\n- Minimize prompt\u002Fresponse retention by policy.\n- Mask secrets and PII in logs before shipping to SIEM.\n- Encrypt persistent volumes and backups.\n- Isolate tenant\u002Fsession data boundaries when serving multiple teams.\n\n## Post-Deploy Verification\n\nRun a hardening smoke test immediately after rollout:\n\n```bash\nkubectl get pods -n openclaw\nkubectl auth can-i --as=system:serviceaccount:openclaw:default list secrets -n openclaw\nkubectl get networkpolicy -n openclaw\nkubectl logs deploy\u002Fopenclaw -n openclaw --tail=200\n```\n\nVerify:\n\n- Pod security context matches policy.\n- Service account permissions are least privilege.\n- Ingress auth\u002Frate limits are effective.\n- No plaintext secrets appear in logs.\n\n## Incident-Ready Rollback Pattern\n\nMaintain a hardened rollback workflow:\n\n1. Freeze further rollouts.\n2. Revoke suspect tokens and rotate secrets.\n3. Roll back to last signed known-good image digest.\n4. Re-run post-deploy hardening verification.\n5. Capture timeline and artifacts for forensics.\n\n## Related Skills\n\n- container-hardening (`container-hardening`) - Container security baseline controls\n- kubernetes-hardening (`kubernetes-hardening`) - Pod and cluster hardening patterns\n- sbom-supply-chain (`sbom-supply-chain`) - SBOM, signing, and provenance controls\n\n## When to Use\n\n- You need the security workflow covered by this skill (secrets, scanning, network defense, operations, AI security) inside an authorized scope.\n\n## Limitations\n\n- Apply guidance only within authorized scope; test destructive steps in non-production first.\n- Docs-only import: upstream scripts and templates not bundled.\n\n### Example\n\n```bash\n# Read-only first: inventory before any active step.\nwhich \u003Ctool> && \u003Ctool> --help | head -n 20\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n","# OpenClaw Deployment Hardening\n\nUse this skill to add repeatable security gates around OpenClaw build and deployment workflows.\n\n## Enforce a Secure Build Pipeline\n\nAdd mandatory controls to CI before artifacts are promoted:\n\n1. Dependency and lockfile vulnerability scan (fail on critical CVEs).\n2. Image scan for OS\u002Fpackage vulnerabilities.\n3. Secret scanning across source and build context.\n4. SBOM generation and artifact signing.\n5. Policy check that blocks deploy when controls fail.\n\nExample CI step order:\n\n```bash\n# Build\nnpm ci\nnpm run build\n\n# Security gates\ntrivy fs .\ntrivy image my-registry\u002Fopenclaw:${GIT_SHA}\nsyft my-registry\u002Fopenclaw:${GIT_SHA} -o spdx-json > sbom.json\ncosign sign --key cosign.key my-registry\u002Fopenclaw:${GIT_SHA}\n```\n\n## Lock Down Container Runtime\n\nRun OpenClaw with restrictive defaults:\n\n- Non-root user in container\n- Read-only root filesystem where possible\n- Drop all Linux capabilities, add back only required\n- `no-new-privileges` enabled\n- Constrained CPU\u002Fmemory limits to reduce abuse impact\n- Seccomp\u002FAppArmor (or equivalent) profile enforced\n\nKubernetes-oriented expectations:\n\n- `runAsNonRoot: true`\n- `allowPrivilegeEscalation: false`\n- `readOnlyRootFilesystem: true`\n- network policy deny-all baseline with explicit allow rules\n\n## Gate Production Promotion\n\nRequire explicit promotion checks:\n\n- Security sign-off on CVE exceptions.\n- Signed artifact verification in deployment stage.\n- Drift check between expected and live manifest values.\n- Deployment only from immutable tags or digests.\n\nAvoid mutable `latest` tags for production OpenClaw services.\n\n## Protect Data and Session Surfaces\n\n- Minimize prompt\u002Fresponse retention by policy.\n- Mask secrets and PII in logs before shipping to SIEM.\n- Encrypt persistent volumes and backups.\n- Isolate tenant\u002Fsession data boundaries when serving multiple teams.\n\n## Post-Deploy Verification\n\nRun a hardening smoke test immediately after rollout:\n\n```bash\nkubectl get pods -n openclaw\nkubectl auth can-i --as=system:serviceaccount:openclaw:default list secrets -n openclaw\nkubectl get networkpolicy -n openclaw\nkubectl logs deploy\u002Fopenclaw -n openclaw --tail=200\n```\n\nVerify:\n\n- Pod security context matches policy.\n- Service account permissions are least privilege.\n- Ingress auth\u002Frate limits are effective.\n- No plaintext secrets appear in logs.\n\n## Incident-Ready Rollback Pattern\n\nMaintain a hardened rollback workflow:\n\n1. Freeze further rollouts.\n2. Revoke suspect tokens and rotate secrets.\n3. Roll back to last signed known-good image digest.\n4. Re-run post-deploy hardening verification.\n5. Capture timeline and artifacts for forensics.\n\n## Related Skills\n\n- container-hardening (`container-hardening`) - Container security baseline controls\n- kubernetes-hardening (`kubernetes-hardening`) - Pod and cluster hardening patterns\n- sbom-supply-chain (`sbom-supply-chain`) - SBOM, signing, and provenance controls\n\n## When to Use\n\n- You need the security workflow covered by this skill (secrets, scanning, network defense, operations, AI security) inside an authorized scope.\n\n## Limitations\n\n- Apply guidance only within authorized scope; test destructive steps in non-production first.\n- Docs-only import: upstream scripts and templates not bundled.\n\n### Example\n\n```bash\n# Read-only first: inventory before any active step.\nwhich \u003Ctool> && \u003Ctool> --help | head -n 20\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n",{"name":5,"risk":32,"source":48,"license":14,"category":42,"metadata":49,"date_added":52,"description":7,"source_repo":53,"source_type":35,"compatibility":54,"license_source":55},"https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills",{"author":50,"version":51},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Requires the relevant security tooling (scanners, vault CLIs) and an authorized scope for any active assessment. Docs-only; helper scripts and templates not bundled.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","f3312ba749561b6159f477dbfc9313c875d40a56",".agents\u002Fskills_archive\u002Fopenclaw-deployment-hardening","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612","2026-10-25 23:50:58",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill openclaw-deployment-hardening",{"tool":67,"command":68},"bunx","bunx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill openclaw-deployment-hardening",{"tool":70,"command":71},"pnpm","pnpm dlx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill openclaw-deployment-hardening","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fopenclaw-deployment-hardening\u002FSKILL.md",true,[],[76,92,116,141,169,193],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":83,"publishedAt":43},"01M6Q0FA5FZ410Z33Z3TFQ4DBA","zero-trust","Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzero-trust\u002FSKILL.md",[82],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},[84,85,86,87,40,39,78,88,36,89,90,27,35,34,33,32,31,30,29,91],"ZeRO","trust","zero trust","architecture","segmentation","access","configure","implementing",{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":43},"01M6Q0F1YZJW3KX5FBKEVZ8CV4","zcode-delegate","Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzcode-delegate\u002FSKILL.md",[],[99,100,101,102,103,104,105,106,107,108,109,110,111,27,112,35,113,114,32,115],"delegate","zcode","zcode delegate","review","cli","orchestration","tasks","run","Bash","model","node","read","orchestrator","files","desktop app","app","agent-orchestration",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":43},"01M6Q0ETK41VGNMYEXW0T00AJN","youtube-transcript","Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript\u002FSKILL.md",[],[123,124,125,126,127,128,129,130,131,132,133,134,135,35,34,136,137,138,139,140],"transcript","youtube transcript","youtube","safe","github","codex","research","license","https","text","fetch","tooling","clean","local","output","deepapi","youtube transcripts","blob",{"skillNo":142,"name":143,"nameZh":6,"description":144,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":145,"categories":146,"keywords":158,"publishedAt":43},"01M6Q0EPPH2PVMDW40017F8WX0","youtube-transcript-skills","Fetch YouTube video transcripts, search videos\u002Fchannels, browse channels, and extract playlists via the getyoutubetranscript.com API - free tier, no card required.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript-skills\u002FSKILL.md",[147,150,153],{"categoryNo":148,"categoryName":149,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":151,"categoryName":152,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":154,"categoryName":155,"taxonomyType":156,"taxonomyTypeDesc":157},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[123,124,125,159,126,160,127,128,130,161,162,163,164,133,165,35,34,166,167,168],"youtube transcript skills","gemini","search","api","Video","browse","api-integration","free","card","channels",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":179,"publishedAt":43},"01M6Q0EAB96PX83W5PTE8A0R8D","youtube-notetaker","Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-notetaker\u002FSKILL.md",[175,178],{"categoryNo":176,"categoryName":177,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":151,"categoryName":152,"taxonomyType":20,"taxonomyTypeDesc":21},[125,180,181,103,126,182,183,184,185,130,163,186,187,188,189,34,190,136,191,192],"youtube notetaker","notetaker","workflow","official","notes","code","markdown","slides","annotations","README","study","dair-academy","viewer",{"skillNo":194,"name":195,"nameZh":6,"description":196,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":197,"categories":198,"keywords":200,"publishedAt":43},"01M6Q0E55F0GW5MX48V8HXS8B5","youtube-full","Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-full\u002FSKILL.md",[199],{"categoryNo":148,"categoryName":149,"taxonomyType":20,"taxonomyTypeDesc":21},[201,125,202,203,126,160,161,204,205,162,163,164,133,206,165,35,34,166,207,139],"youtube full","full","google","server","dlp","credits","automatic"]