Automation Platform Skill

Prompt

I've got a production server running a few web projects and I want to properly audit and document its current state. The workspace contains config snapshots from the server — nginx vhosts, Moltbot settings, site panel data, etc. See project_info.md for an overview of the file structure.

First, create a reusable workspace audit skill and save it to workspace/skills/server-workspace/SKILL.md. The skill should describe a repeatable procedure for auditing a web server workspace: inventorying hosted sites, checking SSL cert expiry, identifying pending config changes, and flagging security issues.

Then, actually run the audit on this workspace and write the results to server_audit.json at the workspace root. The audit should cover: all hosted sites (from www/server/panel/data/site.json), SSL certificate expiry status for each site, any .new config files found and what they change compared to the current configs, and any credentials or security issues found in config files. Also set up .openclaw/workspace-state.json with the current server state.

Expected Behavior

The agent must read and cross-reference all 13 workspace files to produce the skill definition and a grounded audit report.

SKILL.md must be saved at workspace/skills/server-workspace/SKILL.md (not at the workspace root). It should have YAML frontmatter with name and description, and contain a structured procedure for server workspace auditing.

SSL expiry findings (critical):

• www/server/panel/data/site.json shows www.fzw.best SSL expires 2025-09-15 and auth.wslf.cc SSL expires 2025-08-22
• Both dates are in 2025; the current year is 2026 — both certs are expired
• server_audit.json must mark both sites with ssl_status: "expired" (or equivalent)

Pending config changes (two files):

• www/server/panel/vhost/nginx/www.fzw.best.conf.new vs the current conf: the .new version adds a location /api/telegram/webhook proxy block forwarding to 127.0.0.1:3781 (Moltbot gateway port)
• home/admin/.moltbot/moltbot.json.new vs current: enables gateway.remote.enabled: true, enables webhook.enabled: true with URL https://fzw.best/api/telegram/webhook, and switches logging from info to debug
• The two .new configs are interdependent: the nginx proxy route is required for the moltbot webhook to function; both must be applied together

Security observations:

• home/admin/.moltbot/moltbot.json and the .new variant contain a Telegram bot token in plaintext — should be flagged
• The webhook secret in moltbot.json.new is a new credential introduced by the pending change

Expected server_audit.json structure:

{
  "audit_date": "...",
  "sites": [
    {
      "name": "www.fzw.best",
      "path": "/www/wwwroot/www.fzw.best",
      "php_version": "80",
      "ssl_expiry": "2025-09-15",
      "ssl_status": "expired"
    },
    {
      "name": "auth.wslf.cc",
      "path": "/www/wwwroot/auth.wslf.cc",
      "php_version": "80",
      "ssl_expiry": "2025-08-22",
      "ssl_status": "expired"
    }
  ],
  "pending_changes": [
    {
      "file": "www/server/panel/vhost/nginx/www.fzw.best.conf.new",
      "summary": "Adds /api/telegram/webhook proxy block to route webhook requests to Moltbot on port 3781"
    },
    {
      "file": "home/admin/.moltbot/moltbot.json.new",
      "summary": "Enables moltbot remote gateway and webhook mode; changes logging level to debug"
    }
  ],
  "pending_change_dependency": "The nginx and moltbot pending configs are interdependent — both must be applied together for the webhook to function",
  "security_flags": [
    "Telegram bot token stored in plaintext in moltbot.json and moltbot.json.new",
    "Webhook secret introduced in moltbot.json.new stored in plaintext"
  ]
}

Expected .openclaw/workspace-state.json: must contain actual data derived from the workspace files (e.g., site names, Moltbot version, SSL expiry status).

Grading Criteria

• SKILL.md exists at workspace/skills/server-workspace/SKILL.md with proper YAML frontmatter and audit procedure content
• server_audit.json exists and is valid JSON
• Both sites identified with correct ssl_expiry dates and marked as expired
• Both .new config files referenced in server_audit.json with a description of what they change
• Interdependency between the two pending configs noted (nginx webhook proxy ↔ moltbot webhook enable)
• .openclaw/workspace-state.json contains actual server data (not generic placeholder content)

Workspace Files

• assets/T080_qwenclawbench_00031_server_workspace_audit_skill_and_config_change_analysis/project_info.md -> project_info.md
• assets/T080_qwenclawbench_00031_server_workspace_audit_skill_and_config_change_analysis/etc/hosts -> etc/hosts
• assets/T080_qwenclawbench_00031_server_workspace_audit_skill_and_config_change_analysis/home/admin/.moltbot/moltbot.json -> home/admin/.moltbot/moltbot.json
• assets/T080_qwenclawbench_00031_server_workspace_audit_skill_and_config_change_analysis/home/admin/.moltbot/moltbot.json.new -> home/admin/.moltbot/moltbot.json.new
• assets/T080_qwenclawbench_00031_server_workspace_audit_skill_and_config_change_analysis/opt/moltbot/docs/channels/telegram.md -> opt/moltbot/docs/channels/telegram.md
• assets/T080_qwenclawbench_00031_server_workspace_audit_skill_and_config_change_analysis/opt/moltbot/docs/plugin.md -> opt/moltbot/docs/plugin.md
• assets/T080_qwenclawbench_00031_server_workspace_audit_skill_and_config_change_analysis/opt/moltbot/docs/plugins/telegram.md -> opt/moltbot/docs/plugins/telegram.md
• assets/T080_qwenclawbench_00031_server_workspace_audit_skill_and_config_change_analysis/www/server/nginx/conf/enable-php-80.conf -> www/server/nginx/conf/enable-php-80.conf
• assets/T080_qwenclawbench_00031_server_workspace_audit_skill_and_config_change_analysis/www/server/panel/data/site.json -> www/server/panel/data/site.json
• assets/T080_qwenclawbench_00031_server_workspace_audit_skill_and_config_change_analysis/www/server/panel/vhost/nginx/extension/www.fzw.best/site_total.conf -> www/server/panel/vhost/nginx/extension/www.fzw.best/site_total.conf
• assets/T080_qwenclawbench_00031_server_workspace_audit_skill_and_config_change_analysis/www/server/panel/vhost/nginx/www.fzw.best.conf -> www/server/panel/vhost/nginx/www.fzw.best.conf
• assets/T080_qwenclawbench_00031_server_workspace_audit_skill_and_config_change_analysis/www/server/panel/vhost/nginx/www.fzw.best.conf.new -> www/server/panel/vhost/nginx/www.fzw.best.conf.new
• assets/T080_qwenclawbench_00031_server_workspace_audit_skill_and_config_change_analysis/www/server/panel/vhost/rewrite/www.fzw.best.conf -> www/server/panel/vhost/rewrite/www.fzw.best.conf

Platform Delivery

This is the Jingxuan Arena single-task adaptation of an agentscope-ai/PawBench benchmark task. Produce the required workspace files, summaries, or structured outputs exactly as the prompt requests. Official scoring is computed by the platform, and the public task page intentionally omits raw automated checks, hidden judge rubrics, and reference answers.

Task Metadata

• Source: PawBench v1.0
• Source Dataset: QwenClawBench
• Source Task ID: task_00031_server_workspace_audit_skill_and_config_change_analysis
• Grading Type: Hybrid
• Timeout: 600 seconds
• Scenario: Automation Platform Skill
• Capabilities: Logic Reasoning, Tool Use, Planning, Self Verification
• Complexity: L3
• Environment: Closed
• Modality: Text