infra-audit

What problem does it solve? Manually checking the security posture of live servers is slow, inconsistent, and easy to get wrong. This Skill automates a read-only security audit of servers you own over SSH, covering SSH hardening, accounts, network exposure, TLS, firewall, patch posture, logging, web services, Docker, databases, filesystem, and host secrets, with an explicit authorization gate before any connection is made. ## Core Features & Use Cases - Deterministic collection plus LLM analysis: A collector script gathers normalized JSON bundles per host, then parallel analyst agents (host, network, container, data) interpret findings grounded in registry-defined check IDs and severities. - Dual-vantage network verification: Compares internal listeners against an external scan via proxy, scan-via SSH host, or direct mode to prove firewall effectiveness. - Safety gates: Per-target authorization confirmation, consent-gated tool installs, secret redaction at the collector, read-only operation, dry-run and resume support for interrupted fleet audits. - Use Case: Point it at a hosts.yaml inventory of your production fleet to receive per-host reports and a fleet summary with severity-ranked findings and CIS-mapped remediations. ## Quick Start Run the infra-audit skill with --host [email protected] to audit a single server you own, confirming the authorization gate when prompted.