Auto-renew and monitor SSL certificates on your VPS with PicoClaw
Manages SSL certificates on your VPS automatically. Checks expiry dates, renews via Let's Encrypt, reloads nginx or Apache after renewal and alerts you if renewal fails. Never let a certificate expire again.
Read this skill's SKILL.md in full before installing it. Run it against a disposable host or test account first, and give it the narrowest credentials that still work.
This skill executes commands on the machine running the agent. That is the broadest permission you can grant: anything the agent user can do, this skill can do.
This skill's own description refers to "nginx"
It modifies host-level configuration such as firewall rules, certificates or service definitions. A mistake here can lock you out of the machine.
This skill's own description refers to "ssl"
These permissions are inferred from this listing — the credentials it declares, any maintainer warning, and the operations its own description mentions. ClawVault has not audited this skill's source code. Treat it as a starting point for your own review, not a substitute for one.
PicoClaw does not have a skill-install command. Capabilities come from two places: skill packages, which are SKILL.md directories under workspace/skills/, and built-in tool groups configured in config.json under the tools field, which covers web, mcp, exec, cron and skills. MCP servers are managed through the mcp CLI command group.
mkdir -p workspace/skills/sslPicoClaw discovers skills as directories under workspace/skills/. Each one contains a SKILL.md describing the procedure, which the agent loads on demand.
$EDITOR workspace/skills/ssl/SKILL.mdKeep it short. Sipeed's own skill-creator guidance is explicit that the context window is a shared resource: include only what the model does not already know, and make each paragraph justify its token cost.
$EDITOR config.jsonThe tools field in config.json controls the web, mcp, exec, cron and skills groups. A skill that shells out needs exec enabled; a scheduled one needs cron. Leave filter_sensitive_data on so API keys and tokens are stripped from tool output before it reaches the model.
picoclaw mcpFor capabilities that already exist as an MCP server, the mcp command group manages those entries in your config rather than writing a skill by hand.
Commands follow the official PicoClaw documentation. Placeholders such as <owner> are filled in by the search step, because registry references are publisher-scoped.
PicoClaw filters sensitive values such as API keys and tokens out of tool results before they are sent to the model, controlled by filter_sensitive_data (on by default) and filter_min_length. Because exec grants shell access, enable it only when a skill genuinely needs it.
Deploy OpenClaw, Hermes, or PicoClaw on Bluehost with the right template for the job.
Clawaudit is the official automated security audit skill for OpenClaw gateway hosts — currently in active development. It performs threat modelling on your OpenClaw installation, audits skill configurations for dangerous patterns, checks for exposed environment variables, and produces a structured security report. Given thousands of unvetted community skills exist, having an automated auditor on your gateway is increasingly important.
Domain Trust Check gives your OpenClaw agent the ability to verify any URL before visiting it — checking for phishing indicators, active malware, brand abuse and known scam patterns. As agents become more autonomous and browse the web on your behalf, the risk of visiting a malicious URL silently increases. This skill acts as a real-time safety layer querying multiple threat intelligence sources before your agent loads any external page.
Firewall Security Manager gives your OpenClaw agent complete control over server firewalls — managing UFW, iptables and cloud security groups programmatically. Monitor open ports, detect unauthorized access attempts, automate rule changes and generate security reports. Unlike basic firewall skills that only list rules, this skill provides real-time threat detection, automatic blocking of suspicious IPs and integration with threat intelligence feeds.