Security audit
Security checks for vulnerabilities and agentic risk
This skill is a clearly scoped VPS troubleshooting guide that performs high-impact system changes, but it discloses them and requires confirmation, backups, and validation.
Install only if you understand the Vietnamese instructions or can have them translated accurately. Before allowing it to run, confirm you are the VPS owner, review the planned changes, and make sure backups are created before any OpenClaw config or /etc/fstab edit. The fstab and swap steps can affect boot behavior, so do not approve them unless the VPS is actually showing OOM or low-memory symptoms.
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
SWAPFILE=/swapfile
SWAPSIZE=2G
sudo fallocate -l $SWAPSIZE $SWAPFILE || sudo dd if=/dev/zero of=$SWAPFILE bs=1M count=2048 status=progress
sudo chmod 600 $SWAPFILE
sudo mkswap $SWAPFILE
sudo swapon $SWAPFILE
Piping echo into sudo tee -a /etc/fstab combines shell expansion with a privileged append to a boot-critical file, which is a risky chaining pattern. Even when intended for convenience, this style makes it easier to accidentally persist malformed entries or, if variables ever become user-influenced, to inject unauthorized configuration with root privileges.
- **Ghi fstab an toàn (KHÔNG ghi đè cả file):**
1. Backup: `sudo cp /etc/fstab /etc/fstab.bak.$(date +%F-%H%M)`
2. Kiểm tra trùng: `grep -nE '^[^#]*swap' /etc/fstab`
3. Chỉ append nếu chưa có: `echo "$SWAPFILE none swap sw 0 0" | sudo tee -a /etc/fstab`
4. **VALIDATE (BẮT BUỘC):** `sudo findmnt --verify --verbose` và `sudo swapon -a` — lỗi thì restore fstab backup ngay. **Sai fstab = máy không boot.**
## Bước 3 — Bảo vệ gateway khỏi OOM Killer (tùy chọn, cần xác nhận)
The manifest description and the entire skill instructions are written in Vietnamese, including user-facing trigger examples and required confirmations, with no indication that language is selectable or that the skill is intentionally limited to Vietnamese-speaking users. This creates a natural-language locale constraint that is not opt-in and is not justified as a region-specific skill.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
SWAPFILE=/swapfile
SWAPSIZE=2G
sudo fallocate -l $SWAPSIZE $SWAPFILE || sudo dd if=/dev/zero of=$SWAPFILE bs=1M count=2048 status=progress
sudo chmod 600 $SWAPFILE
sudo mkswap $SWAPFILE
sudo swapon $SWAPFILE
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
SWAPFILE=/swapfile
SWAPSIZE=2G
sudo fallocate -l $SWAPSIZE $SWAPFILE || sudo dd if=/dev/zero of=$SWAPFILE bs=1M count=2048 status=progress
sudo chmod 600 $SWAPFILE
sudo mkswap $SWAPFILE
sudo swapon $SWAPFILE
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
SWAPFILE=/swapfile
SWAPSIZE=2G
sudo fallocate -l $SWAPSIZE $SWAPFILE || sudo dd if=/dev/zero of=$SWAPFILE bs=1M count=2048 status=progress
sudo chmod 600 $SWAPFILE
sudo mkswap $SWAPFILE
sudo swapon $SWAPFILE
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
SWAPFILE=/swapfile
SWAPSIZE=2G
sudo fallocate -l $SWAPSIZE $SWAPFILE || sudo dd if=/dev/zero of=$SWAPFILE bs=1M count=2048 status=progress
sudo chmod 600 $SWAPFILE
sudo mkswap $SWAPFILE
sudo swapon $SWAPFILE
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
SWAPFILE=/swapfile
SWAPSIZE=2G
sudo fallocate -l $SWAPSIZE $SWAPFILE || sudo dd if=/dev/zero of=$SWAPFILE bs=1M count=2048 status=progress
sudo chmod 600 $SWAPFILE
sudo mkswap $SWAPFILE
sudo swapon $SWAPFILE
swapon --show; free -m
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
SWAPFILE=/swapfile
SWAPSIZE=2G
sudo fallocate -l $SWAPSIZE $SWAPFILE || sudo dd if=/dev/zero of=$SWAPFILE bs=1M count=2048 status=progress
sudo chmod 600 $SWAPFILE
sudo mkswap $SWAPFILE
sudo swapon $SWAPFILE
swapon --show; free -m
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
SWAPFILE=/swapfile
SWAPSIZE=2G
sudo fallocate -l $SWAPSIZE $SWAPFILE || sudo dd if=/dev/zero of=$SWAPFILE bs=1M count=2048 status=progress
sudo chmod 600 $SWAPFILE
sudo mkswap $SWAPFILE
sudo swapon $SWAPFILE
swapon --show; free -m
Appending to /etc/fstab via echo "$SWAPFILE none swap sw 0 0" | sudo tee -a /etc/fstab performs a privileged write using shell-expanded data and directly alters a boot-critical file. Although $SWAPFILE is hardcoded earlier, this pattern is dangerous because similar skills often later substitute user-controlled values, and a malformed or duplicate line can break boot or mount behavior.
- **Ghi fstab an toàn (KHÔNG ghi đè cả file):**
1. Backup: `sudo cp /etc/fstab /etc/fstab.bak.$(date +%F-%H%M)`
2. Kiểm tra trùng: `grep -nE '^[^#]*swap' /etc/fstab`
3. Chỉ append nếu chưa có: `echo "$SWAPFILE none swap sw 0 0" | sudo tee -a /etc/fstab`
4. **VALIDATE (BẮT BUỘC):** `sudo findmnt --verify --verbose` và `sudo swapon -a` — lỗi thì restore fstab backup ngay. **Sai fstab = máy không boot.**
## Bước 3 — Bảo vệ gateway khỏi OOM Killer (tùy chọn, cần xác nhận)
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
systemctl --user nếu gateway chạy user service):
mkdir -p ~/.config/systemd/user/<service>.d
printf '[Service]\nOOMScoreAdjust=-500\nMemoryHigh=75%%\nMemoryMax=90%%\n' \
> ~/.config/systemd/user/<service>.d/10-oom.conf
systemctl --user daemon-reload
No suspicious patterns detected.