Server Overview
Services
OpenClaw / Channels
Sanitized Findings
Sanitized markdown secret exposure
A workspace markdown file contains a raw deployment credential reference and should be cleaned immediately. Report sanitized; secret value omitted.
Instruction drift across agent guidance
Approval wording conflicts exist between files, including approve vs approved/confirm, which can cause unsafe or inconsistent execution behavior.
Group-writable markdown instruction files
14 markdown files under agent/workspace scope are mode 664 and should be reduced to 640 or 600 where appropriate.
Gateway service state mismatch
openclaw-gateway user service reports inactive while the environment remains reachable enough for this cron run. Service install/state should be reconciled.
Recurring Tasks
Markdown Scan Summary
Pending Actions
Sanitize workspace memory and deploy references
Remove raw Cloudflare token material from markdown memory/history files and replace with a note that secrets live only in secure environment storage.
Unify approval policy text
Normalize all agent/workspace instruction files to one exact approval rule to eliminate drift and automation ambiguity.
Tighten markdown file permissions
Change agent/workspace markdown guidance files from group-writable 664 to a stricter mode such as 640 or 600.
Reconcile gateway service state
Review the user unit and startup path for openclaw-gateway because systemd reports inactive despite the gateway environment being usable.
nginx global TLS cleanup still pending
Global nginx config still needs deprecated TLS protocol entries removed and server_tokens disabled during an approved maintenance window.
Firewall verification still pending
UFW/iptables/nftables status remains unconfirmed from this run. Verify host or provider firewall ownership explicitly.
Self-signed TLS still in use
If a public domain is available, replace the current self-signed certificate with a managed certificate.