security-posture

Collect host posture data and write findings to a SQLite database.

2|Updated Apr 12, 2026
One-click install
npx skills add https://github.com/metric-space-ai/ctox --skill security-posture-metric-space-ai
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: security-posture
Source: https://github.com/metric-space-ai/ctox/tree/main/skills/system/security_access/security-posture
Command: npx skills add https://github.com/metric-space-ai/ctox --skill security-posture-metric-space-ai

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Audit host and service security posture through concrete admin evidence such as users and groups, sudo, listening sockets, firewall state, certificate expiry, secret exposure, package or vulnerability posture, and config drift. Use when CTOX needs to inspect rights, certificates, network exposure, secret handling, or basic hardening state before recommending or applying narrow fixes.

Core Features & Use Cases

  • Exposure and privilege review: detect public listeners, weak permissions, and certificate drift to surface critical posture findings.
  • Comprehensive host hardening visibility: inventory sockets, firewall rules, service hardening, and secret exposure to guide remediation decisions.
  • Durable knowledge capture: persist findings and audit evidence into SQLite-backed runtime state for tickets, verification, and continuity.

Quick Start

Run the security_posture collectors and persist the results to the shared graph for review.

Frequently Asked Questions about security-posture

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit host security posture before applying hardening fixes?

You can inspect host security posture by collecting users, groups, sudo rights, listening sockets, firewall state, and certificate expiry. This Skill gathers that admin evidence to surface exposure and privilege issues before remediation.

What does a host security audit include for network exposure and privilege review?

A host security audit includes detecting public listeners, weak permissions, certificate drift, open sockets, and firewall rules. It inventories service hardening and secret exposure to provide comprehensive visibility for remediation.

How do I check certificate expiry and secret exposure across hosts?

Check certificate expiry and secret exposure by running collectors that analyze host posture data. This Skill identifies certificate drift and exposed secrets, persisting findings into SQLite-backed runtime state for verification and continuity.

Can I persist security audit findings to a SQLite database for ticketing?

Yes, you can persist security audit findings to a shared SQLite database. This Skill writes users, sockets, firewall, and certificate evidence into durable runtime state to support tickets, verification, and operational continuity.

Do I need any dependencies to run host hardening and firewall state checks?

No dependencies are required to run host hardening and firewall state checks. This Skill uses helper scripts and references to inventory sockets, firewall rules, and package state directly on the target host.

What's the best way to inventory sudo rights and package state for operational security reviews?

The best way to inventory sudo rights and package state is to run collectors that gather user, group, and vulnerability posture data. This Skill captures config drift and package state to support audits before hardening actions.