Use when self-hosting OpenClaw on a cloud server, hardening a remote OpenClaw gateway, choosing between SSH tunneling, Tailscale, or reverse-proxy exposure, or reviewing Podman, pairing, sandboxing, token auth, and tool-permission defaults for a secure personal deployment.
SkillScore50Maintained
Automatic
◆DevOps & SRE pack
Last verified 7/26/2026
What it changes
Passed 11 of 22 test cases with the skill, and 1 of 22 without it.
Without skill5%
With skill50%
10 fixed1 passed either way11 still failing0 broke
Pass-rate lift
+45 pp
Tokens
+17%
Agent turns
0%
Response time
-29%
Model gemini-3.6-flashMeasured 7/26/2026v111 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
What's inside
The instructions your model reads when the skill loads.
SKILL.md152 lines2 files
Overview
Use this skill for the conservative "deploy first, expose later" pattern for
OpenClaw on a cloud server.
Default to a private control plane:
Harden the Linux host before exposing anything.
Keep the gateway bound to 127.0.0.1.
Reach the Control UI through an SSH tunnel first.
Keep token authentication, pairing, and sandboxing enabled.
Start with a narrow tool profile and loosen only with an explicit need.
This skill is for secure Linux cloud hosting. If the user only wants the
fastest generic OpenClaw install on a local machine, prefer the official
OpenClaw onboarding docs instead of forcing this flow.
Open references/REFERENCE.md when you need the
command matrix, baseline config shape, checklist, or access-path comparison.
When To Use
Use this skill when the user mentions any of the following:
OpenClaw on a cloud server, VM, or other Linux host
Secure self-hosting, hardening, or "run it privately"
Podman, loopback binding, SSH tunneling, or remote Control UI access
Tailscale vs reverse proxy for OpenClaw
Pairing, sandboxing, token auth, or locked-down tool permissions
Reviewing whether an existing OpenClaw host is too exposed
Do not use this skill for:
General Linux hardening with no OpenClaw component
Local single-machine onboarding where remote access is irrelevant
Pure local onboarding with no remote-host hardening questions
Non-Linux hosting unless the user explicitly wants this Linux-first pattern
adapted