Server Maintenance

Automates server maintenance by checking disk usage, cleaning caches, optimizing resources, and supporting local and remote multi-server batch operations.

Security Scan

The skill mostly does what its README and SKILL.md say (disk checks + cache cleanup across servers), but there are notable mismatches and risky behaviors — hard-coded remote IPs, root SSH usage with host-key checking disabled, and claims (like automatic backups) that are not implemented — so review carefully before running it on real systems.

Purpose & Capability

The scripts (check.sh, cleanup.sh, maintain-all.sh) implement disk checks, cache cleanup and multi-server SSH operations that match the described purpose. Minor inconsistency: registry metadata lists no required binaries, but SKILL.md lists dependencies (bash, ssh, du, df, npm). Functionality generally aligns with the stated purpose.

Instruction Scope

The runtime instructions and scripts will operate as root (ssh root@host and inspect /root), run remote commands, and remove cached directories. The SKILL.md promises safety measures (backups, only cleaning safe caches, dry-run) but the scripts do not implement a pre-operation backup step and only partially implement dry-run behavior. maintain-all.sh directly attempts SSH to hard-coded IPs; check.sh and cleanup.sh inspect /root and other privileged locations. These behaviors expand scope to high-privilege host-level operations.

Install Mechanism

No install spec (instruction-only skill with bundled scripts). Nothing is downloaded or executed from external URLs during install — lower install-time risk. The presence of local script files means code will run on the host when invoked.

Credentials

No environment variables or credentials are declared, but the scripts require SSH access as root to remote hosts. The skill ships with a servers.json and maintain-all.sh hard-coded with external IP addresses (43.163.225.27 and 43.167.192.145). maintain-all.sh disables StrictHostKeyChecking (ssh -o StrictHostKeyChecking=no) which weakens host authenticity checks. Asking for root SSH access and embedding remote IPs without clearly asking the user to confirm them is disproportionate and risky.

Persistence & Privilege

The skill is not always-enabled and is user-invocable. It does not request persistent platform privileges or modify other skills. Autonomous invocation is allowed (default), which is normal — combine that with the high-privilege SSH actions in other dimensions when deciding whether to enable autonomous runs.

What to consider before installing

This skill largely implements its stated maintenance tasks, but has a few red flags you should address before running it on production systems: 1) Inspect and edit servers.json and maintain-all.sh: both contain hard-coded remote IPs. Remove or replace them with only servers you control. The bundled maintain-all.sh currently will attempt SSH to those addresses. 2) Root SSH & host-key checking: scripts use ssh root@host and maintain-all.sh sets StrictHostKeyChecking=no. That bypasses host authenticity checks; change this and avoid automatic root access unless you intentionally want it. Prefer connecting as a non-root user with sudo where possible. 3) Verify backup behavior: SKILL.md claims automatic backups of key configs, but the scripts do not perform backups. Add an explicit backup step (and test it) before any destructive operations. 4) Use dry-run and test in an isolated environment: cleanup.sh has a dry-run mode — use it first. Test everything on a disposable VM to confirm effects before running on production. 5) Code review: the scripts run rm -rf on cached directories and perform remote commands. Read and understand each command, and lock down who/what can invoke the skill (do not enable autonomous scheduled runs until you trust it). 6) Source verification: the skill's source is 'unknown' and the package.json points to a GitHub repo — if you plan to use this, verify the upstream repository and its history. If you want, I can produce a hardened version of these scripts that: - reads servers from a user-managed config and refuses to run against unknown hosts, - enforces StrictHostKeyChecking and key-based auth only, - performs safe backups before changes, - runs cleanup actions under a non-root account with sudo prompts. Confidence: high — the scripts are readable and the risky elements (hard-coded IPs, root SSH, disabled host-key checking, missing backups) are concrete and observable.

Server Maintenance Skill

描述

自动化服务器维护工具。检查磁盘使用率、清理缓存、优化系统资源。支持多服务器批量操作。

触发词

• 服务器维护
• 清理磁盘
• 检查磁盘
• server maintenance
• disk cleanup

功能

1. 磁盘检查

• 检查磁盘使用率
• 识别大文件和目录
• 分析缓存占用

2. 自动清理

• npm 缓存清理
• Playwright 旧版本清理
• 临时文件清理

3. 系统优化

• Swap 使用检查
• 内存占用分析
• 进程资源监控

4. 多服务器支持

• 支持本地和远程服务器
• SSH 批量操作
• 统一报告输出

使用方法

单服务器检查

bash ~/.openclaw/skills/server-maintenance/check.sh

多服务器批量维护

bash ~/.openclaw/skills/server-maintenance/maintain-all.sh

定时任务

在 OpenClaw 中设置 cron：

{
  "schedule": "0 2 * * 0",
  "task": "server-maintenance"
}

配置

服务器列表在 servers.json：

{
  "servers": [
    {
      "name": "硅谷",
      "host": "localhost",
      "type": "local"
    },
    {
      "name": "中央",
      "host": "43.163.225.27",
      "type": "ssh"
    },
    {
      "name": "东京",
      "host": "43.167.192.145",
      "type": "ssh"
    }
  ]
}

输出示例

=== 服务器维护报告 ===
时间：2026-03-03 10:08

| 服务器 | 清理前 | 清理后 | 释放空间 |
|--------|--------|--------|----------|
| 硅谷   | 79%    | 69%    | 4.7GB    |
| 中央   | 88%    | 78%    | 5.0GB    |
| 东京   | 71%    | 63%    | 4.0GB    |

总计释放：13.7GB

安全措施

• 只清理已知安全的缓存目录
• 不删除用户数据
• 操作前自动备份关键配置
• 支持 dry-run 模式

依赖

• bash
• ssh（远程服务器）
• du, df（磁盘工具）
• npm（缓存清理）

版本

v1.0.0 - 2026-03-03